# How to Set up AWS EFS CSI Driver

## Create an IAM policy and role

1. Create an IAM policy that allows the CSI driver's service account to make calls to AWS APIs on your behalf.

Download the IAM policy document from GitHub. You can also view the policy document.

```
curl -o iam-policy-efs.json https://raw.githubusercontent.com/kubernetes-sigs/aws-efs-csi-driver/v1.3.2/docs/iam-policy-example.json
```

Create the policy. You can change AmazonEKS_EFS_CSI_Driver_Policy_ForNA to a different name, but if you do, make sure to change it in later steps too.

```
aws iam create-policy \
    --policy-name AmazonEKS_EFS_CSI_Driver_Policy_ForNA \
    --policy-document file://iam-policy-efs.json
```

```
{
    "Policy": {
        "PolicyName": "AmazonEKS_EFS_CSI_Driver_Policy_ForNA",
        "PolicyId": "ANPA3VJFN74AR764P5T47",
        "Arn": "arn:aws:iam::801626783489:policy/AmazonEKS_EFS_CSI_Driver_Policy_ForNA",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 0,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "CreateDate": "2022-01-08T17:10:46+00:00",
        "UpdateDate": "2022-01-08T17:10:46+00:00"
    }
}
```

2. Create an IAM role and attach the IAM policy to it. Annotate the Kubernetes service account with the IAM role ARN and the IAM role with the Kubernetes service account name. You can create the role using eksctl or the AWS CLI.

```
eksctl create iamserviceaccount \
    --name efs-csi-controller-sa \
    --namespace kube-system \
    --cluster wordpress-cluster \
    --attach-policy-arn arn:aws:iam::801626783489:policy/AmazonEKS_EFS_CSI_Driver_Policy_ForNA \
    --override-existing-serviceaccounts \
    --region us-west-1 \
    --approve 
```


## Install the Amazon EFS driver

1. Add the Helm repo.
```
helm repo add aws-efs-csi-driver https://kubernetes-sigs.github.io/aws-efs-csi-driver/
```

2. Update the repo.
```
helm repo update
```

3. Install a release of the driver using the Helm chart. Replace the repository address with the cluster's container image address.
```
helm upgrade -i aws-efs-csi-driver aws-efs-csi-driver/aws-efs-csi-driver \
    --namespace kube-system \
    --set image.repository=602401143452.dkr.ecr.us-west-1.amazonaws.com/eks/aws-efs-csi-driver \
    --set controller.serviceAccount.create=false \
    --set controller.serviceAccount.name=efs-csi-controller-sa
```