Developers mounting EFS volumes in EKS often encounter a cryptic `mount.nfs4: access denied` error, even with correct security groups. The culprit is frequently a missing `iam` mount option in the PersistentVolume definition. This oversight prevents proper authentication when EFS file system policies are active, causing the mount to fail at the authorization layer rather than the network level.

The issue arises because EFS file system policies with IAM conditions like `aws:PrincipalArn` aren't enforced for standard NFS mounts. Without the `iam` option, the EFS CSI driver performs an anonymous mount, which the policy rejects. Only specific conditions, such as `aws:SecureTransport` or `elasticfilesystem:AccessedViaMountTarget`, are actually supported for NFS client authentication.

To resolve this, add `mountOptions: [tls, iam]` to your PersistentVolume YAML. This enables IAM role authentication for the mount operation. For file system policies, rely on supported conditions and use security groups for network-level access control. Always test manually on a worker node to verify the configuration works outside Kubernetes before deploying.