---
title: "Configure per-node access to an SFS"
description: "Choose read-only or read-write access to an SFS for each node."
content_type: "how-to"
product: "sfs"
platform: "MyAccount"
url: "/myaccount/sfs/how-to/configure-per-node-access-to-an-sfs/"
topic: ["create-and-connect"]
relationships: {"requires":["/myaccount/sfs/how-to/create-an-sfs/"]}
---

# Configure per-node access to an SFS

Per-node access lets you pick which nodes can reach an SFS, and give each one **Read Only** or
**Read/Write** permission. You can change a node's permission later. To give a whole VPC read and
write access at once, see
[Grant a VPC access to an SFS](/myaccount/sfs/how-to/grant-vpc-access-to-an-sfs/).

## Before you begin

- The SFS reads **Available**.
- The node reads **Running** and is attached to the SFS's VPC.
- The SFS gives access node by node. If VPC-wide access is on, turn it off first with
  **Disable all access** in the SFS's **Actions** menu.

## Add a node

1. Open the SFS and go to its **ACL** tab.
2. Click **Configure ACL**. The nodes in the SFS's VPC are listed.
3. For the node you want, choose a permission under **Permission**: **Read/Write** for a node that
   saves files, or **Read Only** for one that only reads them.
4. Click **Allow**.

The SFS reads **Configuring** while the access is applied, usually for two to three minutes, then
**Available** again. The node now appears in the **ACL** tab with its permission, and it can mount
the SFS; see [Mount an SFS](/myaccount/sfs/how-to/mount-an-sfs/).

## Change a node's permission

On the **ACL** tab, change the node's **Permission** to **Read Only** or **Read/Write**, and save
it. You can change it while the SFS reads **Available**. The SFS reads **Configuring**, then
**Available** again, and the new permission applies.

## Remove a node

On the **ACL** tab, click **Disallow** next to the node, then click **Disable**. The node's access
ends once the SFS reads **Available** again; the node itself keeps running as before.

Deleting a node removes its access too. The SFS reads **Configuring** while the node is removed from
its ACL, then **Available** again. If **Configure ACL** is not available, see
[Troubleshooting SFS](/myaccount/sfs/troubleshooting/sfs/#configure-acl-is-not-available).