New Sagemaker domain creates EFS volume by default

Sagemaker does not support mounting custom EFS volumes when creating a domain. It will always provision a new EFS volume.

Consider the following:

• Use the default EFS volume provisioned by Sagemaker and ensure it has appropriate IAM policies. The volume will be encrypted using an AWS managed KMS key.
• Provision the EFS volume separately before creating the Sagemaker domain. Use the FileSystemId parameter when creating the domain to associate the existing EFS volume. You will need to ensure the volume has appropriate encryption and IAM policies.
• Leverage lifecycle policies on the EFS volume to automatically move files to infrequent access storage classes after a period of inactivity. This can help reduce storage costs over time.
• Consider using Sagemaker Studio instead of domains if your use case allows for per-user file storage instead of shared storage.

SageMaker Studio automatically creates an EFS volume per domain for storage. You cannot associate a different default EFS volume for a Studio domain.

For the new Studio experience, you can bring your own EFS volume (see the CustomFileSystemConfigs parameter), but for the intents and purposes of this post, I don't think you're looking at this use case.

The EFS policy required by SageMaker is below, as Didier mentioned on the comments, you can get the HomeEfsFileSystemId via CFN and update the policy for the EFS volume -

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientMount"
            ],
            "Resource": "<efs-file-system-arn>",
            "Condition": {
                "Bool": {
                    "elasticfilesystem:AccessedViaMountTarget": "true"
                }
            }
        },
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "*",
            "Resource": "<efs-file-system-arn>",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}