<p>I deployed an EFS in AWS and a test pod on EKS from this document: <a href="https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html" rel="nofollow noreferrer">Amazon EFS CSI driver</a>.</p>
<p>EFS CSI Controller pods in the <code>kube-system</code>:</p>
<pre><code>kube-system    efs-csi-controller-5bb76d96d8-b7qhk        3/3     Running   0          26s
kube-system    efs-csi-controller-5bb76d96d8-hcgvc        3/3     Running   0          26s
</code></pre>
<p>After deployed a sample application from the doc, when confirm <code>efs-csi-controller</code> sa pod logs, it seems they didn't work well.</p>
<p>Pod 1:</p>
<pre><code>$ kubectl logs efs-csi-controller-5bb76d96d8-b7qhk \
&gt;     -n kube-system \
&gt;     -c csi-provisioner \
&gt;     --tail 10
W1030 08:15:59.073406       1 feature_gate.go:235] Setting GA feature gate Topology=true. It will be removed in a future release.
I1030 08:15:59.073485       1 feature_gate.go:243] feature gates: &amp;{map[Topology:true]}
I1030 08:15:59.073500       1 csi-provisioner.go:132] Version: v2.1.1-0-g353098c90
I1030 08:15:59.073520       1 csi-provisioner.go:155] Building kube configs for running in cluster...
I1030 08:15:59.087072       1 connection.go:153] Connecting to unix:///var/lib/csi/sockets/pluginproxy/csi.sock
I1030 08:15:59.087512       1 common.go:111] Probing CSI driver for readiness
I1030 08:15:59.090672       1 csi-provisioner.go:202] Detected CSI driver efs.csi.aws.com
I1030 08:15:59.091694       1 csi-provisioner.go:244] CSI driver does not support PUBLISH_UNPUBLISH_VOLUME, not watching VolumeAttachments
I1030 08:15:59.091997       1 controller.go:756] Using saving PVs to API server in background
I1030 08:15:59.092834       1 leaderelection.go:243] attempting to acquire leader lease kube-system/efs-csi-aws-com...
</code></pre>
<p>Pod 2:</p>
<pre><code>$ kubectl logs efs-csi-controller-5bb76d96d8-hcgvc \
&gt;     -n kube-system \
&gt;     -c csi-provisioner \
&gt;     --tail 10
I1030 08:16:32.628759       1 controller.go:1099] Final error received, removing PVC 111111a-d6fb-440a-9bb1-132901jfas from claims in progress
W1030 08:16:32.628783       1 controller.go:958] Retrying syncing claim &quot;111111a-d6fb-440a-9bb1-132901jfas&quot;, failure 5
E1030 08:16:32.628798       1 controller.go:981] error syncing claim &quot;111111a-d6fb-440a-9bb1-132901jfas&quot;: failed to provision volume with StorageClass &quot;efs-sc&quot;: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied
I1030 08:16:32.628845       1 event.go:282] Event(v1.ObjectReference{Kind:&quot;PersistentVolumeClaim&quot;, Namespace:&quot;default&quot;, Name:&quot;efs-claim&quot;, UID:&quot;111111a-d6fb-440a-9bb1-132901jfas&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;1724705&quot;, FieldPath:&quot;&quot;}): type: 'Warning' reason: 'ProvisioningFailed' failed to provision volume with StorageClass &quot;efs-sc&quot;: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied
I1030 08:17:04.628997       1 controller.go:1332] provision &quot;default/efs-claim&quot; class &quot;efs-sc&quot;: started
I1030 08:17:04.629193       1 event.go:282] Event(v1.ObjectReference{Kind:&quot;PersistentVolumeClaim&quot;, Namespace:&quot;default&quot;, Name:&quot;efs-claim&quot;, UID:&quot;111111a-d6fb-440a-9bb1-132901jfas&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;1724705&quot;, FieldPath:&quot;&quot;}): type: 'Normal' reason: 'Provisioning' External provisioner is provisioning volume for claim &quot;default/efs-claim&quot;
I1030 08:17:04.687957       1 controller.go:1099] Final error received, removing PVC 111111a-d6fb-440a-9bb1-132901jfas from claims in progress
W1030 08:17:04.687977       1 controller.go:958] Retrying syncing claim &quot;111111a-d6fb-440a-9bb1-132901jfas&quot;, failure 6
E1030 08:17:04.688001       1 controller.go:981] error syncing claim &quot;111111a-d6fb-440a-9bb1-132901jfas&quot;: failed to provision volume with StorageClass &quot;efs-sc&quot;: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied
I1030 08:17:04.688044       1 event.go:282] Event(v1.ObjectReference{Kind:&quot;PersistentVolumeClaim&quot;, Namespace:&quot;default&quot;, Name:&quot;efs-claim&quot;, UID:&quot;111111a-d6fb-440a-9bb1-132901jfas&quot;, APIVersion:&quot;v1&quot;, ResourceVersion:&quot;1724705&quot;, FieldPath:&quot;&quot;}): type: 'Warning' reason: 'ProvisioningFailed' failed to provision volume with StorageClass &quot;efs-sc&quot;: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied
</code></pre>
<p>From the events, I can see:</p>
<pre><code>$ kubectl get events
27m         Warning   FailedScheduling         pod/efs-app                                    skip schedule deleting pod: default/efs-app
7m38s       Warning   FailedScheduling         pod/efs-app                                    0/2 nodes are available: 2 pod has unbound immediate PersistentVolumeClaims.
7m24s       Warning   FailedScheduling         pod/efs-app                                    0/2 nodes are available: 2 persistentvolumeclaim &quot;efs-claim&quot; is being deleted.
7m24s       Warning   FailedScheduling         pod/efs-app                                    skip schedule deleting pod: default/efs-app
17s         Warning   FailedScheduling         pod/efs-app                                    0/2 nodes are available: 2 pod has unbound immediate PersistentVolumeClaims.
27m         Normal    ExternalProvisioning     persistentvolumeclaim/efs-claim                waiting for a volume to be created, either by external provisioner &quot;efs.csi.aws.com&quot; or manually created by system administrator
10m         Normal    ExternalProvisioning     persistentvolumeclaim/efs-claim                waiting for a volume to be created, either by external provisioner &quot;efs.csi.aws.com&quot; or manually created by system administrator
11m         Normal    Provisioning             persistentvolumeclaim/efs-claim                External provisioner is provisioning volume for claim &quot;default/efs-claim&quot;
11m         Warning   ProvisioningFailed       persistentvolumeclaim/efs-claim                failed to provision volume with StorageClass &quot;efs-sc&quot;: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied
7m47s       Normal    Provisioning             persistentvolumeclaim/efs-claim                External provisioner is provisioning volume for claim &quot;default/efs-claim&quot;
7m47s       Warning   ProvisioningFailed       persistentvolumeclaim/efs-claim                failed to provision volume with StorageClass &quot;efs-sc&quot;: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied
74s         Normal    ExternalProvisioning     persistentvolumeclaim/efs-claim                waiting for a volume to be created, either by external provisioner &quot;efs.csi.aws.com&quot; or manually created by system administrator
2m56s       Normal    Provisioning             persistentvolumeclaim/efs-claim                External provisioner is provisioning volume for claim &quot;default/efs-claim&quot;
2m56s       Warning   ProvisioningFailed       persistentvolumeclaim/efs-claim                failed to provision volume with StorageClass &quot;efs-sc&quot;: rpc error: code = Unauthenticated desc = Access Denied. Please ensure you have the right AWS permissions: Access denied
</code></pre>
<p><code>ServiceAccount</code> was created by:</p>
<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: efs-csi-controller-sa
  namespace: kube-system
  labels:
    app.kubernetes.io/name: aws-efs-csi-driver
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::111111111111:role/AmazonEKS_EFS_CSI_Driver_Policy
</code></pre>
<p>The <code>AmazonEKS_EFS_CSI_Driver_Policy</code> is the json from <a href="https://raw.githubusercontent.com/kubernetes-sigs/aws-efs-csi-driver/v1.3.2/docs/iam-policy-example.json" rel="nofollow noreferrer">here</a>.</p>
<hr />
<h1>Example code</h1>
<p>storageclass.yaml</p>
<pre><code>kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: efs-sc
provisioner: efs.csi.aws.com
parameters:
  provisioningMode: efs-ap
  fileSystemId: fs-92107410
  directoryPerms: &quot;700&quot;
  gidRangeStart: &quot;1000&quot; # optional
  gidRangeEnd: &quot;2000&quot; # optional
  basePath: &quot;/dynamic_provisioning&quot; # optional
</code></pre>
<p>pod.yaml</p>
<pre><code>---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: efs-claim
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: efs-sc
  resources:
    requests:
      storage: 5Gi
---
apiVersion: v1
kind: Pod
metadata:
  name: efs-app
spec:
  containers:
    - name: app
      image: centos
      command: [&quot;/bin/sh&quot;]
      args: [&quot;-c&quot;, &quot;while true; do echo $(date -u) &gt;&gt; /data/out; sleep 5; done&quot;]
      volumeMounts:
        - name: persistent-storage
          mountPath: /data
  volumes:
    - name: persistent-storage
      persistentVolumeClaim:
        claimName: efs-claim
</code></pre>

Miantian
<p>Posted community wiki answer for better visibility. Feel free to expand it.</p>
<hr />
<p>Based on @Miantian comment:</p>
<blockquote>
<p>The reason was the efs driver image is using the different region from mine. I changed to the right one and it works.</p>
</blockquote>
<p>You can find steps to setup the Amazon EFS CSI driver in the proper region in <a href="https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html" rel="nofollow noreferrer">this documentation</a>.</p>
