Amazon EFS Troubleshooting: The Relationship Between NFS I/O Hang and Security Group Outbound Rules | Amazon Web Services

AWS EFS maintenance can trigger 1–2 minute NFS stalls on some EC2 instances.

The root cause was a mount target security group without default outbound allow-all or equivalent TCP egress rules.

During maintenance, TCP RST packets were blocked, so clients could not detect the reset and reconnect quickly.

The issue can freeze EFS-backed workloads without data loss, and tcpdump helped confirm the failure mode.