Support IAM authentication and access points.

README.md

@@ -87,27 +87,39 @@ To mount with the recommended default options, simply run:
 $ sudo mount -t efs file-system-id efs-mount-point/
 ```
 
-To mount automatically with recommended options, add an `/etc/fstab` entry like:
+To mount over TLS, simply add the `tls` option:
 
 ```
-file-system-id efs-mount-point efs _netdev 0 0
+$ sudo mount -t efs -o tls file-system-id efs-mount-point/
 ```
 
-To mount over TLS, simply add the `tls` option:
+To authenticate with EFS using the system’s IAM identity, add the `iam` option. This option requires the `tls` option.
 
 ```
-$ sudo mount -t efs -o tls file-system-id efs-mount-point/
+$ sudo mount -t efs -o tls,iam file-system-id efs-mount-point/
+```
+
+To mount using an access point, use the `accesspoint=` option. This option requires the `tls` option.
+
+```
+$ sudo mount -t efs -o tls,accesspoint=access-point-id file-system-id efs-mount-point/
+```
+
+To mount your file system automatically with any of the options above, you can add entries to `/efs/fstab` like:
+
+```
+file-system-id efs-mount-point efs _netdev,tls,iam,accesspoint=access-point-id 0 0
 ```
 
-To mount over TLS automatically, add an `/etc/fstab` entry like:
+For more information on mounting with the mount helper, see the manual page:
 
 ```
-file-system-id efs-mount-point efs _netdev,tls 0 0
+man mount.efs
 ```
 
-For more information on mounting with the mount helper, see the [documentation](https://docs.aws.amazon.com/efs/latest/ug/using-amazon-efs-utils.html).
+or refer to the [documentation](https://docs.aws.amazon.com/efs/latest/ug/using-amazon-efs-utils.html).
 
-#### amazon-efs-mount-watchdog
+### amazon-efs-mount-watchdog
 
 `efs-utils` contains a watchdog process to monitor the health of TLS mounts. This process is managed by either `upstart` or `systemd` depending on your Linux distribution, and is started automatically the first time an EFS file system is mounted over TLS.
 

build-deb.sh

@@ -11,7 +11,7 @@ set -ex
 
 BASE_DIR=$(pwd)
 BUILD_ROOT=${BASE_DIR}/build/debbuild
-VERSION=1.17
+VERSION=1.18
 
 echo 'Cleaning deb build workspace'
 rm -rf ${BUILD_ROOT}

config.ini

+#
+# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
+#
+# Licensed under the MIT License. See the LICENSE accompanying this file
+# for the specific language governing permissions and limitations under
+# the License.
+#
+
+[global]
+version=1.18

dist/amazon-efs-utils.control

 Package: amazon-efs-utils
 Architecture: all
-Version: 1.17
+Version: 1.18
 Section: utils
 Depends: python|python2, nfs-common, stunnel4 (>= 4.56)
 Priority: optional

dist/amazon-efs-utils.spec

@@ -20,7 +20,7 @@
 %endif
 
 Name      : amazon-efs-utils
-Version   : 1.17
+Version   : 1.18
 Release   : 1%{?dist}
 Summary   : This package provides utilities for simplifying the use of EFS file systems
 

dist/efs-utils.conf

@@ -10,12 +10,14 @@
 logging_level = INFO
 logging_max_bytes = 1048576
 logging_file_count = 10
-# mode for /var/run/efs in octal
+# mode for /var/run/efs and subdirectories in octal
 state_file_dir_mode = 750
 
 [mount]
-dns_name_format = {fs_id}.efs.{region}.amazonaws.com
+dns_name_format = {fs_id}.efs.{region}.{dns_name_suffix}
+dns_name_suffix = amazonaws.com
 stunnel_debug_enabled = false
+stunnel_cafile = /etc/amazon/efs/efs-utils.crt
 
 # Validate the certificate hostname on mount. This option is not supported by certain stunnel versions.
 stunnel_check_cert_hostname = true

man/mount.efs.8

@@ -81,6 +81,22 @@ more information, see \fBstunnel(8)\fR\&.
 Selects whether to perform OCSP validation on TLS certificates\&, \
 overriding /etc/amazon/efs/efs-utils.conf. \
 For more information, see \fBstunnel(8)\fR\&.
+.TP
+\fBiam\fR
+Use the system's IAM identity to authenticate with EFS. The mount helper will try \
+to retrieve the required IAM credentials from the following locations: the EC2 instance \
+profile, the AWS CLI credentials file (~/.aws/credentials), and the AWS CLI config \
+file (~/.aws/config). The first location that has credentials will be used. \
+This option requires the \fBtls\fR option\&.
+.TP
+\fBaccesspoint\fR
+Mount the EFS file system using the specified access point. This option requires the \
+\fBtls\fR option\&.
+.TP
+\fBawsprofile\fR
+Use the named profile used to lookup IAM credentials in the AWS CLI credentials file \
+(~/.aws/credentials) or AWS CLI config file (~/.aws/config). If "awsprofile" is not \
+specified, the "default" profile is used\&.
 .if n \{\
 .RE
 .\}
@@ -121,6 +137,16 @@ resolve to a fully-qualified EFS DNS name such as \
 "fs\-abcd1234\&.efs\&.us-east-1\&.amazonaws\&.com" \
 \(em at mount point "/mnt/efs" using encryption \
 of data in transit\&.
+.TP
+sudo mount -t efs -o tls,iam fs-abcd1234 /mnt/efs
+Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" \
+with encryption of data in transit. The mount helper will authenticate with EFS using \
+the system's IAM identity\&.
+.TP
+sudo mount -t efs -o tls,accesspoint=fsap-12345678 fs-abcd1234 /mnt/efs
+Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" \
+with encryption of data in transit. The file system is mounted using the access point \
+"fsap-12345678"\&.
 .SH "FILES"
 .TP
 \fI/sbin/mount.efs\fR

test/global_test/__init__.py

+#
+# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
+#
+# Licensed under the MIT License. See the LICENSE accompanying this file
+# for the specific language governing permissions and limitations under
+# the License.
+#

test/global_test/test_global_version_match.py

+#
+# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
+#
+# Licensed under the MIT License. See the LICENSE accompanying this file
+# for the specific language governing permissions and limitations under
+# the License.
+#
+
+import os
+
+try:
+    import ConfigParser
+except ImportError:
+    from configparser import ConfigParser
+
+FILE_LIST = ['src/watchdog/__init__.py', 'src/mount_efs/__init__.py', 'dist/amazon-efs-utils.spec',
+             'dist/amazon-efs-utils.control', 'build-deb.sh']
+
+GLOBAL_CONFIG = 'config.ini'
+
+
+def test_global_version_match():
+    global_version = get_global_version()
+
+    for f in FILE_LIST:
+        version_in_file = get_version_for_file(f)
+        assert version_in_file == global_version, \
+            'version in {} is {}, does not match global version {}'.format(f, version_in_file, global_version)
+
+
+def get_version_for_file(file_path):
+    mount_helper_root_folder = uppath(os.path.abspath(__file__), 3)
+    file_to_check = os.path.join(mount_helper_root_folder, file_path)
+    with open(file_to_check) as fp:
+        lines = fp.readlines()
+    for line in lines:
+        if line.startswith('VERSION'):
+            return line.split('=')[1].strip().replace("'", '')
+        if line.startswith('Version'):
+            return line.split(':')[1].strip()
+    return None
+
+
+def get_global_version():
+    mount_helper_root_folder = uppath(os.path.abspath(__file__), 3)
+    config_file = os.path.join(mount_helper_root_folder, GLOBAL_CONFIG)
+    cp = read_config(config_file)
+    version = str(cp.get('global', 'version'))
+    return version
+
+
+# Given:    path  :   file path
+#            n    :   the number of parent level we want to reach
+# Returns: parent path of certain level n
+# Example: uppath('/usr/lib/java', 1) -> '/usr/lib'
+#          uppath('/usr/lib/java', 2) -> '/usr'
+def uppath(path, n):
+    return os.sep.join(path.split(os.sep)[:-n])
+
+
+def read_config(config_file):
+    try:
+        p = ConfigParser.SafeConfigParser()
+    except AttributeError:
+        p = ConfigParser()
+    p.read(config_file)
+    return p

test/mount_efs_test/test_add_stunnel_ca_options.py

@@ -11,34 +11,84 @@ import tempfile
 
 import pytest
 
+try:
+    import ConfigParser
+except ImportError:
+    from configparser import ConfigParser
+
 CAPATH = '/capath'
 CAFILE = '/cafile.crt'
 
 
-def create_temp_file(tmpdir, content=''):
+def _get_config():
+    try:
+        config = ConfigParser.SafeConfigParser()
+    except AttributeError:
+        config = ConfigParser()
+    config.add_section(mount_efs.CONFIG_SECTION)
+    return config
+
+
+def _create_temp_file(tmpdir, content=''):
     temp_file = tmpdir.join(tempfile.mktemp())
     temp_file.write(content, ensure=True)
     return temp_file
 
 
 def test_use_existing_cafile(tmpdir):
+    options = {'cafile': str(_create_temp_file(tmpdir))}
     efs_config = {}
-    stunnel_cafile = str(create_temp_file(tmpdir))
 
-    mount_efs.add_stunnel_ca_options(efs_config, stunnel_cafile)
+    mount_efs.add_stunnel_ca_options(efs_config, _get_config(), options)
 
-    assert stunnel_cafile == efs_config.get('CAfile')
+    assert options['cafile'] == efs_config.get('CAfile')
     assert 'CApath' not in efs_config
 
 
 def test_use_missing_cafile(capsys):
+    options = {'cafile': '/missing1'}
     efs_config = {}
-    stunnel_cafile = '/missing1'
 
     with pytest.raises(SystemExit) as ex:
-        mount_efs.add_stunnel_ca_options(efs_config, stunnel_cafile)
+        mount_efs.add_stunnel_ca_options(efs_config, _get_config(), options)
 
     assert 0 != ex.value.code
 
     out, err = capsys.readouterr()
-    assert 'Failed to find the EFS certificate authority file for verification' in err
+    assert 'Failed to find certificate authority file for verification' in err
+
+
+def test_stunnel_cafile_configuration_in_option(mocker):
+    options = {'cafile': CAFILE}
+    efs_config = {}
+
+    mocker.patch('os.path.exists', return_value=True)
+
+    mount_efs.add_stunnel_ca_options(efs_config, _get_config(), options)
+
+    assert CAFILE == efs_config.get('CAfile')
+
+
+def test_stunnel_cafile_configuration_in_config(mocker):
+    options = {}
+    efs_config = {}
+
+    config = _get_config()
+    config.set(mount_efs.CONFIG_SECTION, 'stunnel_cafile', CAFILE)
+
+    mocker.patch('os.path.exists', return_value=True)
+
+    mount_efs.add_stunnel_ca_options(efs_config, config, options)
+
+    assert CAFILE == efs_config.get('CAfile')
+
+
+def test_stunnel_cafile_not_configured(mocker):
+    options = {}
+    efs_config = {}
+
+    mocker.patch('os.path.exists', return_value=True)
+
+    mount_efs.add_stunnel_ca_options(efs_config, _get_config(), options)
+
+    assert mount_efs.DEFAULT_STUNNEL_CAFILE == efs_config.get('CAfile')

test/mount_efs_test/test_bootstrap_tls.py

@@ -12,9 +12,11 @@ import tempfile
 
 from mock import MagicMock
 
+AP_ID = 'fsap-beefdead'
 FS_ID = 'fs-deadbeef'
 DNS_NAME = '%s.efs.us-east-1.amazonaws.com' % FS_ID
 MOUNT_POINT = '/mnt'
+REGION = 'us-east-1'
 
 DEFAULT_TLS_PORT = 20049
 
@@ -30,7 +32,10 @@ def setup_mocks(mocker):
     mocker.patch('mount_efs.start_watchdog')
     mocker.patch('mount_efs.get_tls_port_range', return_value=(DEFAULT_TLS_PORT, DEFAULT_TLS_PORT + 10))
     mocker.patch('socket.socket', return_value=MagicMock())
-    mocker.patch('mount_efs.write_tls_tunnel_state_file', return_value="~mocktempfile")
+    mocker.patch('mount_efs.get_dns_name', return_value=DNS_NAME)
+    mocker.patch('mount_efs.get_region_helper', return_value=REGION)
+    mocker.patch('mount_efs.write_tls_tunnel_state_file', return_value='~mocktempfile')
+    mocker.patch('mount_efs.create_certificate')
     mocker.patch('os.rename')
     mocker.patch('os.kill')
 
@@ -43,11 +48,23 @@ def setup_mocks(mocker):
     return popen_mock, write_config_mock
 
 
+def setup_mocks_without_popen(mocker):
+    mocker.patch('mount_efs.start_watchdog')
+    mocker.patch('mount_efs.get_tls_port_range', return_value=(DEFAULT_TLS_PORT, DEFAULT_TLS_PORT + 10))
+    mocker.patch('socket.gethostname', return_value=DNS_NAME)
+    mocker.patch('mount_efs.get_dns_name', return_value=DNS_NAME)
+    mocker.patch('mount_efs.write_tls_tunnel_state_file', return_value='~mocktempfile')
+    mocker.patch('os.kill')
+
+    write_config_mock = mocker.patch('mount_efs.write_stunnel_config_file', return_value=EXPECTED_STUNNEL_CONFIG_FILE)
+    return write_config_mock
+
+
 def test_bootstrap_tls_state_file_dir_exists(mocker, tmpdir):
     popen_mock, _ = setup_mocks(mocker)
     state_file_dir = str(tmpdir)
 
-    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {}, state_file_dir):
+    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, AP_ID, MOUNT_POINT, {}, state_file_dir):
         pass
 
     args, _ = popen_mock.call_args
@@ -64,6 +81,8 @@ def test_bootstrap_tls_state_file_nonexistent_dir(mocker, tmpdir):
     def config_get_side_effect(section, field):
         if section == mount_efs.CONFIG_SECTION and field == 'state_file_dir_mode':
             return '0755'
+        elif section == mount_efs.CONFIG_SECTION and field == 'dns_name_format':
+            return '{fs_id}.efs.{region}.amazonaws.com'
         else:
             raise ValueError('Unexpected arguments')
 
@@ -71,18 +90,84 @@ def test_bootstrap_tls_state_file_nonexistent_dir(mocker, tmpdir):
 
     assert not os.path.exists(state_file_dir)
 
-    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {}, state_file_dir):
+    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, AP_ID, MOUNT_POINT, {}, state_file_dir):
         pass
 
     assert os.path.exists(state_file_dir)
 
 
+def test_bootstrap_tls_no_cert_creation(mocker, tmpdir):
+    setup_mocks_without_popen(mocker)
+    mocker.patch('mount_efs.get_mount_specific_filename', return_value=DNS_NAME)
+    state_file_dir = str(tmpdir)
+    tls_dict = mount_efs.tls_paths_dictionary(DNS_NAME, state_file_dir)
+
+    pk_path = os.path.join(str(tmpdir), 'privateKey.pem')
+    mocker.patch('mount_efs.get_private_key_path', return_value=pk_path)
+
+    def config_get_side_effect(section, field):
+        if section == mount_efs.CONFIG_SECTION and field == 'state_file_dir_mode':
+            return '0755'
+        elif section == mount_efs.CONFIG_SECTION and field == 'dns_name_format':
+            return '{fs_id}.efs.{region}.amazonaws.com'
+        else:
+            raise ValueError('Unexpected arguments')
+
+    MOCK_CONFIG.get.side_effect = config_get_side_effect
+
+    try:
+        with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, None, MOUNT_POINT, {}, state_file_dir):
+            pass
+    except OSError as e:
+        assert '[Errno 2] No such file or directory' in str(e)
+
+    assert not os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))
+    assert not os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
+    assert not os.path.exists(os.path.join(tls_dict['mount_dir'], 'config.conf'))
+    assert not os.path.exists(pk_path)
+
+
+def test_bootstrap_tls_cert_created(mocker, tmpdir):
+    setup_mocks_without_popen(mocker)
+    mocker.patch('mount_efs.get_mount_specific_filename', return_value=DNS_NAME)
+    mocker.patch('mount_efs.get_region_helper', return_value=REGION)
+    state_file_dir = str(tmpdir)
+    tls_dict = mount_efs.tls_paths_dictionary(DNS_NAME + '+', state_file_dir)
+
+    pk_path = os.path.join(str(tmpdir), 'privateKey.pem')
+    mocker.patch('mount_efs.get_private_key_path', return_value=pk_path)
+
+    def config_get_side_effect(section, field):
+        if section == mount_efs.CONFIG_SECTION and field == 'state_file_dir_mode':
+            return '0755'
+        elif section == mount_efs.CONFIG_SECTION and field == 'dns_name_format':
+            return '{fs_id}.efs.{region}.amazonaws.com'
+        else:
+            raise ValueError('Unexpected arguments')
+
+    MOCK_CONFIG.get.side_effect = config_get_side_effect
+
+    try:
+        with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, AP_ID, MOUNT_POINT, {},
+                                     state_file_dir=state_file_dir):
+            pass
+    except OSError as e:
+        assert '[Errno 2] No such file or directory' in str(e)
+
+    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'certificate.pem'))
+    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'request.csr'))
+    assert os.path.exists(os.path.join(tls_dict['mount_dir'], 'config.conf'))
+    assert os.path.exists(pk_path)
+
+
 def test_bootstrap_tls_non_default_port(mocker, tmpdir):
     popen_mock, write_config_mock = setup_mocks(mocker)
+    mocker.patch('os.rename')
     state_file_dir = str(tmpdir)
 
     tls_port = 1000
-    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {'tlsport': tls_port}, state_file_dir):
+    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, AP_ID, MOUNT_POINT, {'tlsport': tls_port},
+                                 state_file_dir):
         pass
 
     popen_args, _ = popen_mock.call_args
@@ -99,7 +184,8 @@ def test_bootstrap_tls_non_default_verify_level(mocker, tmpdir):
     state_file_dir = str(tmpdir)
 
     verify = 0
-    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {'verify': verify}, state_file_dir):
+    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, AP_ID, MOUNT_POINT, {'verify': verify},
+                                 state_file_dir):
         pass
 
     popen_args, _ = popen_mock.call_args
@@ -115,7 +201,7 @@ def test_bootstrap_tls_ocsp_option(mocker, tmpdir):
     popen_mock, write_config_mock = setup_mocks(mocker)
     state_file_dir = str(tmpdir)
 
-    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {'ocsp': None}, state_file_dir):
+    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, AP_ID, MOUNT_POINT, {'ocsp': None}, state_file_dir):
         pass
 
     popen_args, _ = popen_mock.call_args
@@ -132,7 +218,7 @@ def test_bootstrap_tls_noocsp_option(mocker, tmpdir):
     popen_mock, write_config_mock = setup_mocks(mocker)
     state_file_dir = str(tmpdir)
 
-    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {'noocsp': None}, state_file_dir):
+    with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, AP_ID, MOUNT_POINT, {'noocsp': None}, state_file_dir):
         pass
 
     popen_args, _ = popen_mock.call_args
@@ -143,18 +229,3 @@ def test_bootstrap_tls_noocsp_option(mocker, tmpdir):
     assert EXPECTED_STUNNEL_CONFIG_FILE in popen_args
     # positional argument for ocsp_override
     assert write_config_args[7] is False
-
-
-def test_bootstrap_tls_ocsp_and_noocsp_option(mocker, tmpdir):
-    setup_mocks(mocker)
-    state_file_dir = str(tmpdir)
-
-    exception_thrown = False
-    try:
-        with mount_efs.bootstrap_tls(MOCK_CONFIG, INIT_SYSTEM, DNS_NAME, FS_ID, MOUNT_POINT, {'ocsp': None, 'noocsp': None},
-                                     state_file_dir):
-            pass
-    except SystemExit:
-        exception_thrown = True
-
-    assert exception_thrown

test/mount_efs_test/test_check_unsupported_options.py

@@ -8,6 +8,7 @@
 
 import mount_efs
 
+
 def test_no_unsupported_options(capsys):
     options = {}
 
@@ -17,7 +18,7 @@ def test_no_unsupported_options(capsys):
     assert not out
 
 
-def test_cafile_unsupported(capsys):
+def test_capath_unsupported(capsys):
     options = {'capath': '/capath'}
 
     mount_efs.check_unsupported_options(options)
@@ -26,14 +27,3 @@ def test_cafile_unsupported(capsys):
     assert 'not supported' in err
     assert 'capath' in err
     assert 'capath' not in options
-
-
-def test_capath_unsupported(capsys):
-    options = {'cafile': '/cafile'}
-
-    mount_efs.check_unsupported_options(options)
-
-    out, err = capsys.readouterr()
-    assert 'not supported' in err
-    assert 'cafile' in err
-    assert 'cafile' not in options

test/mount_efs_test/test_create_self_signed_cert.py

+#
+# Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.
+#
+# Licensed under the MIT License. See the LICENSE accompanying this file
+# for the specific language governing permissions and limitations under
+# the License.
+#
+
+import mount_efs
+import os
+
+import pytest
+
+from datetime import datetime
+from mock import MagicMock
+
+try:
+    import ConfigParser
+except ImportError:
+    from configparser import ConfigParser
+
+FS_ID = 'fs-deadbeef'
+AP_ID = 'fsap-fedcba9876543210'
+REGION = 'us-east-1'
+COMMON_NAME = 'fs-deadbeef.efs.us-east-1.amazonaws.com'
+MOUNT_NAME = 'fs-deadbeef.mount.dir.12345'
+ACCESS_KEY_ID_VAL = 'FAKE_AWS_ACCESS_KEY_ID'
+SECRET_ACCESS_KEY_VAL = 'FAKE_AWS_SECRET_ACCESS_KEY'
+SESSION_TOKEN_VAL = 'FAKE_SESSION_TOKEN'
+CREDENTIALS = {
+    'AccessKeyId': ACCESS_KEY_ID_VAL,
+    'SecretAccessKey': SECRET_ACCESS_KEY_VAL,
+    'Token': SESSION_TOKEN_VAL
+}
+FIXED_DT = datetime(2000, 1, 1, 12, 0, 0)
+
+
+@pytest.fixture(autouse=True)
+def setup_method(mocker):
+    mocker.patch('mount_efs.get_region', return_value=REGION)
+    mocker.patch('mount_efs.get_region_helper', return_value=REGION)
+    mocker.patch('mount_efs.get_aws_security_credentials', return_value=CREDENTIALS)
+    mocker.patch('mount_efs.get_utc_now', return_value=FIXED_DT)
+    mocker.patch('socket.gethostbyname')
+
+
+def _get_config():
+    try:
+        config = ConfigParser.SafeConfigParser()
+    except AttributeError:
+        config = ConfigParser()
+    config.add_section(mount_efs.CONFIG_SECTION)
+    config.set(mount_efs.CONFIG_SECTION, 'state_file_dir_mode', '750')
+    config.set(mount_efs.CONFIG_SECTION, 'dns_name_format', '{fs_id}.efs.{region}.amazonaws.com')
+    return config
+
+
+def _get_ca_conf_body(config_path, common_name, directory, private_key, date, region, fs_id, iam, ap_id):
+    ca_conf_str = mount_efs.create_ca_conf(config_path, common_name, directory, private_key, date, region, fs_id, iam, ap_id)
+    return ca_conf_str
+
+
+def _get_mock_config(dns_name_format='{fs_id}.efs.{region}.amazonaws.com'):
+    def config_get_side_effect(section, field):
+        if section == mount_efs.CONFIG_SECTION and field == 'state_file_dir_mode':