Skip to main content
idle · aws

EFS file systems with near-zero reads and writes and no clients for 30 days

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags Amazon EFS file systems whose total read and total write bytes stay at or below 1 MiB in every period across 30 days, measured with the `Sum` statistic of `DataReadIOBytes` and `DataWriteIOBytes`. Any `ClientConnections` of 1 or more vetoes it. The saving is the full monthly storage cost.

Signal and threshold

How ZopNight evaluates EFS file systems with near-zero reads and writes and no clients for 30 days.
Field Value
Rule IDsRC-076
Categoryidle
Severitymedium
MetricDataReadIOBytes
Threshold1 MiB per period, no clients
Evaluation window30d
SourceZopNight
Permissions usedelasticfilesystem:DescribeFileSystems · elasticfilesystem:DescribeMountTargets · elasticfilesystem:DescribeAccessPoints · cloudwatch:GetMetricStatistics

EFS charges for what is stored, not for how often it is used

EFS pricing has no minimum fee: you pay for the primary and backup storage you use, plus read, write and tiering activity. When the reads and writes stop, the storage charge carries on at the same rate every month. A file system left behind by a retired cluster or a finished migration costs as much as the data it holds.

Measuring activity the right way

The EFS metrics guide is precise about statistics: for the I/O byte metrics, Sum is the total bytes across all operations, while Maximum is only the size of the largest single operation. Busy file systems doing many small reads can show a small Maximum, so total volume has to come from Sum. ClientConnections counts one connection per mounted EC2 instance with a standard client.

Terminal window
aws efs describe-file-systems \
--query 'FileSystems[].[FileSystemId,Name,SizeInBytes.Value,NumberOfMountTargets]'
aws cloudwatch get-metric-statistics --namespace AWS/EFS --metric-name DataReadIOBytes \
--dimensions Name=FileSystemId,Value=fs-0123456789abcdef0 \
--start-time 2026-08-26T00:00:00Z --end-time 2026-09-25T00:00:00Z \
--period 86400 --statistics Sum

Repeat with DataWriteIOBytes and ClientConnections.

The idle test

  • Both total read bytes and total write bytes cover at least 30 days of data.
  • Every period in both series is at or below 1 MiB. The floor is near zero rather than exactly zero, because health checks and monitoring agents move a trickle of bytes.
  • If a ClientConnections series is present, its average and peak are below 1. A single mounted client is a veto, since something still depends on the file system.
  • ZopNight has a positive monthly cost for the file system.

When it does not fire

Any I/O series that is missing or shorter than 30 days blocks the finding. A missing connections series does not block it, because a month of near-zero reads and writes is already strong evidence. File systems with real I/O, however small the stored data, are left alone.

The saving is the storage bill

Terminal window
saving = full monthly cost of the file system
cost after deletion = 0

Deleting an idle file system

  1. List mount targets and access points: aws efs describe-mount-targets --file-system-id fs-0123456789abcdef0 and aws efs describe-access-points --file-system-id fs-0123456789abcdef0
  2. Back up anything worth keeping with AWS Backup or a copy to S3.
  3. Remove each mount target, which AWS requires before a CLI delete: aws efs delete-mount-target --mount-target-id fsmt-0123456789abcdef0
  4. Delete: aws efs delete-file-system --file-system-id fs-0123456789abcdef0

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·