A file system with mount targets still needs two things before an instance can use it: a way in through the firewall, and a mount.

The port

Instances talk to a mount target over NFS, on TCP port 2049. The mount target's group must allow it from the instances. Naming the instances' group as the source admits every web server, including ones launched later, and nobody else:

aws ec2 authorize-security-group-ingress --group-id $SG --protocol tcp --port 2049 --source-group $WEB_SG

$SG is the mount target's group; $WEB_SG the web servers' group. Without the rule, a mount waits and fails with Connection timed out.

The mount

Inside a session on the instance:

sudo mkdir /mnt/shared

sudo mount -t nfs4 $FS.efs.us-east-1.amazonaws.com:/ /mnt/shared

-t nfs4 says how to talk to it, and the file system's DNS name is its id, .efs., and the region. There is no mkfs: EFS is already a file system. Type the id itself in the session, where $FS is not set.

Mount the same file system on a second instance, and a file written on one is there on the other at once. df -h lists it with a size of many terabytes: EFS has no fixed size.