diff --git a/lib/fog/aws/efs.rb b/lib/fog/aws/efs.rb
index 1ac28448a..711c29038 100644
--- a/lib/fog/aws/efs.rb
+++ b/lib/fog/aws/efs.rb
@@ -26,6 +26,7 @@ module Fog
       request :describe_file_systems
       request :describe_mount_target_security_groups
       request :describe_mount_targets
+      request :modify_mount_target_security_groups
 
       class Mock
         def self.data
diff --git a/lib/fog/aws/models/efs/file_system.rb b/lib/fog/aws/models/efs/file_system.rb
index 5d1ed2e44..417c65689 100644
--- a/lib/fog/aws/models/efs/file_system.rb
+++ b/lib/fog/aws/models/efs/file_system.rb
@@ -25,19 +25,16 @@ module Fog
         def destroy
           requires :identity
 
-          service.delete_file_system(:id => self.identity)
+          service.delete_file_system(self.identity)
 
           true
         end
 
         def save
-          params = {
-            :creation_token => self.creation_token || Fog::Mock.random_hex(32)
-          }
-
+          params = {}
           params.merge!(:performance_mode => self.performance_mode) if self.performance_mode
 
-          merge_attributes(service.create_file_system(:creation_token => self.creation_token).body)
+          merge_attributes(service.create_file_system(self.creation_token || Fog::Mock.random_hex(32), params).body)
         end
       end
     end
diff --git a/lib/fog/aws/models/efs/mount_target.rb b/lib/fog/aws/models/efs/mount_target.rb
index 9b0017f4e..5acf42ce6 100644
--- a/lib/fog/aws/models/efs/mount_target.rb
+++ b/lib/fog/aws/models/efs/mount_target.rb
@@ -2,8 +2,6 @@ module Fog
   module AWS
     class EFS
       class MountTarget < Fog::Model
-        attr_accessor :security_groups
-
         identity :id, :aliases => "MountTargetId"
 
         attribute :file_system_id,       :aliases => "FileSystemId"
@@ -19,7 +17,7 @@ module Fog
 
         def destroy
           requires :identity
-          service.delete_mount_target(:id => self.identity)
+          service.delete_mount_target(self.identity)
           true
         end
 
@@ -29,21 +27,31 @@ module Fog
         end
 
         def security_groups
-          requires :identity
-          service.describe_mount_target_security_groups(self.identity).body["SecurityGroups"]
+          if persisted?
+            requires :identity
+            service.describe_mount_target_security_groups(self.identity).body["SecurityGroups"]
+          else
+            @security_groups || []
+          end
+        end
+
+        def security_groups=(security_groups)
+          if persisted?
+            requires :identity
+            service.modify_mount_target_security_groups(self.identity, security_groups)
+          else
+            @security_groups = security_groups
+          end
+          security_groups
         end
 
         def save
           requires :file_system_id, :subnet_id
-          params = {
-            :file_system_id => self.file_system_id,
-            :subnet_id      => self.subnet_id
-          }
-
+          params = {}
           params.merge!('IpAddress' => self.ip_address) if self.ip_address
           params.merge!('SecurityGroups' => @security_groups) if @security_groups
 
-          merge_attributes(service.create_mount_target(params).body)
+          merge_attributes(service.create_mount_target(self.file_system_id, self.subnet_id, params).body)
         end
       end
     end
diff --git a/lib/fog/aws/requests/efs/create_file_system.rb b/lib/fog/aws/requests/efs/create_file_system.rb
index 856197ce3..28d7a0029 100644
--- a/lib/fog/aws/requests/efs/create_file_system.rb
+++ b/lib/fog/aws/requests/efs/create_file_system.rb
@@ -10,25 +10,25 @@ module Fog
         # ==== Returns
         # * response<~Excon::Response>
         #   * body<~Hash>
-        def create_file_system(options={})
+        def create_file_system(creation_token, options={})
           request({
             :path             => "file-systems",
             :method           => 'POST',
             :expects          => 201,
-            'CreationToken'   => options[:creation_token],
-            'PerformanceMode' => options[:performance_mode] || 'generalPurpose'
+            'CreationToken'   => creation_token,
+            'PerformanceMode' => options[:peformance_mode] || 'generalPurpose'
           })
         end
       end
 
       class Mock
-        def create_file_system(options={})
+        def create_file_system(creation_token, options={})
           response = Excon::Response.new
 
           id = "fs-#{Fog::Mock.random_letters(8)}"
           file_system = {
             "OwnerId"              => Fog::AWS::Mock.owner_id,
-            "CreationToken"        => options[:creation_token],
+            "CreationToken"        => creation_token,
             "PerformanceMode"      => options[:performance_mode] || "generalPurpose",
             "FileSystemId"         => id,
             "CreationTime"         => Time.now.to_i.to_f,
diff --git a/lib/fog/aws/requests/efs/create_mount_target.rb b/lib/fog/aws/requests/efs/create_mount_target.rb
index 2dd13c386..d1e8bc6a7 100644
--- a/lib/fog/aws/requests/efs/create_mount_target.rb
+++ b/lib/fog/aws/requests/efs/create_mount_target.rb
@@ -12,22 +12,21 @@ module Fog
         # ==== Returns
         # * response<~Excon::Response>
         #   * body<~Hash>
-        def create_mount_target(options={})
+        def create_mount_target(file_system_id, subnet_id, options={})
           request({
             :path          => "mount-targets",
             :method        => "POST",
-            'FileSystemId' => options[:file_system_id],
-            'SubnetId'     => options[:subnet_id]
+            'FileSystemId' => file_system_id,
+            'SubnetId'     => subnet_id
           }.merge(options))
         end
       end
 
       class Mock
-        def create_mount_target(options={})
+        def create_mount_target(file_system_id, subnet_id, options={})
           response        = Excon::Response.new
-          file_system_id  = options[:file_system_id]
-          subnet_id       = options[:subnet_id]
-          security_groups = options["SecurityGroups"] || []
+          default_security_group = Fog::Compute[:aws].security_groups.detect { |sg| sg.description == "default group" }
+          security_groups = options["SecurityGroups"] || [default_security_group.group_id]
 
           unless file_system = self.data[:file_systems][file_system_id]
             raise Fog::AWS::EFS::NotFound.new("invalid file system ID: #{file_system_id}")
diff --git a/lib/fog/aws/requests/efs/delete_file_system.rb b/lib/fog/aws/requests/efs/delete_file_system.rb
index 21170d268..fcca67b9a 100644
--- a/lib/fog/aws/requests/efs/delete_file_system.rb
+++ b/lib/fog/aws/requests/efs/delete_file_system.rb
@@ -10,22 +10,17 @@ module Fog
         # * response<~Excon::Response>
         #   * body - Empty
         #   * status - 204
-        def delete_file_system(options={})
-          id = options.delete(:id)
+        def delete_file_system(id)
           request({
             :path             => "file-systems/#{id}",
             :method           => 'DELETE',
             :expects          => 204,
-            'CreationToken'   => options[:creation_token],
-            'PerformanceMode' => options[:performance_mode] || 'generalPurpose'
           })
         end
       end
 
       class Mock
-        def delete_file_system(options={})
-          id = options.delete(:id)
-
+        def delete_file_system(id)
           unless file_system = self.data[:file_systems][id]
             raise Fog::AWS::EFS::NotFound.new("invalid file system ID: #{id}")
           end
diff --git a/lib/fog/aws/requests/efs/delete_mount_target.rb b/lib/fog/aws/requests/efs/delete_mount_target.rb
index ddbcd955e..9cf0a3106 100644
--- a/lib/fog/aws/requests/efs/delete_mount_target.rb
+++ b/lib/fog/aws/requests/efs/delete_mount_target.rb
@@ -10,8 +10,7 @@ module Fog
         # * response<~Excon::Response>
         #   * body - Empty
         #   * status - 204
-        def delete_mount_target(options={})
-          id = options.delete(:id)
+        def delete_mount_target(id)
           request(
             :path    => "mount-targets/#{id}",
             :method  => "DELETE",
@@ -21,8 +20,7 @@ module Fog
       end
 
       class Mock
-        def delete_mount_target(options={})
-          id       = options.delete(:id)
+        def delete_mount_target(id)
           response = Excon::Response.new
 
           unless self.data[:mount_targets][id]
diff --git a/lib/fog/aws/requests/efs/modify_mount_target_security_groups.rb b/lib/fog/aws/requests/efs/modify_mount_target_security_groups.rb
new file mode 100644
index 000000000..c67b314f3
--- /dev/null
+++ b/lib/fog/aws/requests/efs/modify_mount_target_security_groups.rb
@@ -0,0 +1,35 @@
+module Fog
+  module AWS
+    class EFS
+      class Real
+        def modify_mount_target_security_groups(id, security_groups)
+          request({
+            :path            => "mount-targets/#{id}/security-groups",
+            :method          => "PUT",
+            :expects         => 204,
+            'SecurityGroups' => security_groups
+          })
+        end
+      end
+
+      class Mock
+        def modify_mount_target_security_groups(id, security_groups)
+          response = Excon::Response.new
+
+          unless self.data[:mount_targets][id]
+            raise Fog::AWS::EFS::NotFound.new("invalid mount target ID: #{id}")
+          end
+
+          security_groups.each do |sg|
+            raise Fog::AWS::EFS::NotFound.new("invalid security group ID: #{sg}") unless Fog::Compute[:aws].data[:security_groups].values.detect { |sgd| sgd["groupId"] == sg }
+          end
+
+          self.data[:security_groups][id] = security_groups
+
+          response.status = 204
+          response
+        end
+      end
+    end
+  end
+end
diff --git a/tests/models/efs/mount_target_tests.rb b/tests/models/efs/mount_target_tests.rb
index d513675ab..fbc5f8094 100644
--- a/tests/models/efs/mount_target_tests.rb
+++ b/tests/models/efs/mount_target_tests.rb
@@ -28,6 +28,11 @@ Shindo.tests("AWS::EFS | mount target", ["aws", "efs"]) do
     tests("#security_groups") do
       returns([security_group.group_id]) { @instance.security_groups }
     end
+
+    tests("#security_groups=") do
+      @instance.security_groups = []
+      returns([]) { @instance.security_groups }
+    end
   end
 
   @file_system.wait_for { number_of_mount_targets == 0 }
diff --git a/tests/requests/efs/file_system_tests.rb b/tests/requests/efs/file_system_tests.rb
index c2604d0a9..09ee111d2 100644
--- a/tests/requests/efs/file_system_tests.rb
+++ b/tests/requests/efs/file_system_tests.rb
@@ -4,8 +4,8 @@ Shindo.tests('AWS::EFS | file systems', ['aws', 'efs']) do
   @creation_token = "fogtest#{suffix}"
 
   tests('success') do
-    tests("#create_file_system").formats(AWS::EFS::Formats::FILE_SYSTEM_FORMAT) do
-      result = Fog::AWS[:efs].create_file_system(:creation_token => @creation_token).body
+    tests("#create_file_system('#{@creation_token}')").formats(AWS::EFS::Formats::FILE_SYSTEM_FORMAT) do
+      result = Fog::AWS[:efs].create_file_system(@creation_token).body
       returns('creating') { result['LifeCycleState'] }
       result
     end
@@ -28,13 +28,16 @@ Shindo.tests('AWS::EFS | file systems', ['aws', 'efs']) do
     end
 
     if Fog.mocking?
-      vpc = Fog::Compute[:aws].vpcs.create(:cidr_block => "10.0.0.0/16")
-      Fog::Compute[:aws].subnets.create(
+      vpc    = Fog::Compute[:aws].vpcs.create(:cidr_block => "10.0.0.0/16")
+      subnet = Fog::Compute[:aws].subnets.create(
         :vpc_id     => vpc.id,
         :cidr_block => "10.0.1.0/24"
       )
+      default_security_group = Fog::Compute[:aws].security_groups.detect { |sg| sg.description == 'default group' }
     else
       vpc = Fog::Compute[:aws].vpcs.first
+      subnet = vpc.subnets.first
+      default_security_group = Fog::Compute[:aws].security_groups.detect { |sg| sg.description == 'default VPC security group' }
     end
 
     security_group = Fog::Compute[:aws].security_groups.create(
@@ -43,21 +46,19 @@ Shindo.tests('AWS::EFS | file systems', ['aws', 'efs']) do
       :description => "fog#{suffix}"
     )
 
-    subnet_id = vpc.subnets.first.identity
-
     raises(Fog::AWS::EFS::InvalidSubnet, "invalid subnet ID: foobar#{suffix}") do
-      Fog::AWS[:efs].create_mount_target(:file_system_id => file_system_id, :subnet_id => "foobar#{suffix}")
+      Fog::AWS[:efs].create_mount_target(file_system_id, "foobar#{suffix}")
     end
 
     raises(Fog::AWS::EFS::NotFound, "invalid file system ID: foobar#{suffix}") do
-      Fog::AWS[:efs].create_mount_target(:file_system_id => "foobar#{suffix}", :subnet_id => subnet_id)
+      Fog::AWS[:efs].create_mount_target("foobar#{suffix}", subnet.identity)
     end
 
     if Fog.mocking?
       tests("#create_mount_target") do
         Fog::AWS[:efs].data[:file_systems][file_system_id]["LifeCycleState"] = 'creating'
         raises(Fog::AWS::EFS::IncorrectFileSystemLifeCycleState) do
-          Fog::AWS[:efs].create_mount_target(:file_system_id => file_system_id, :subnet_id => subnet_id)
+          Fog::AWS[:efs].create_mount_target(file_system_id, subnet.identity)
         end
 
         Fog::AWS[:efs].data[:file_systems][file_system_id]["LifeCycleState"] = 'available'
@@ -65,19 +66,11 @@ Shindo.tests('AWS::EFS | file systems', ['aws', 'efs']) do
     end
 
     raises(Fog::AWS::EFS::NotFound, "invalid security group ID: foobar#{suffix}") do
-      Fog::AWS[:efs].create_mount_target(
-        :file_system_id  => file_system_id,
-        :subnet_id       => subnet_id,
-        'SecurityGroups' => ["foobar#{suffix}"]
-      )
+      Fog::AWS[:efs].create_mount_target(file_system_id, subnet.identity, 'SecurityGroups' => ["foobar#{suffix}"])
     end
 
-    tests("#create_mount_target(file_system_id: #{file_system_id}, subnet_id: #{subnet_id})").formats(AWS::EFS::Formats::MOUNT_TARGET_FORMAT) do
-      Fog::AWS[:efs].create_mount_target(
-        :file_system_id  => file_system_id,
-        :subnet_id       => subnet_id,
-        'SecurityGroups' => [security_group.group_id]
-      ).body
+    tests("#create_mount_target(#{file_system_id}, #{subnet.identity})").formats(AWS::EFS::Formats::MOUNT_TARGET_FORMAT) do
+      Fog::AWS[:efs].create_mount_target(file_system_id, subnet.identity).body
     end
 
     tests("#describe_mount_targets(file_system_id: #{file_system_id})").formats(AWS::EFS::Formats::DESCRIBE_MOUNT_TARGETS_RESULT) do
@@ -86,6 +79,24 @@ Shindo.tests('AWS::EFS | file systems', ['aws', 'efs']) do
 
     mount_target_id = Fog::AWS[:efs].describe_mount_targets(:file_system_id => file_system_id).body["MountTargets"].first["MountTargetId"]
 
+    tests("#describe_mount_target_security_groups(#{mount_target_id})").formats(AWS::EFS::Formats::DESCRIBE_MOUNT_TARGET_SECURITY_GROUPS_FORMAT) do
+      result = Fog::AWS[:efs].describe_mount_target_security_groups(mount_target_id).body
+      returns([default_security_group.group_id]) { result["SecurityGroups"] }
+      result
+    end
+
+    tests("#modify_mount_target_security_groups(#{mount_target_id}, [#{security_group.group_id}])") do
+      returns(204) do
+        Fog::AWS[:efs].modify_mount_target_security_groups(mount_target_id, [security_group.group_id]).status
+      end
+    end
+
+    tests("#describe_mount_target_security_groups(#{mount_target_id})").formats(AWS::EFS::Formats::DESCRIBE_MOUNT_TARGET_SECURITY_GROUPS_FORMAT) do
+      result = Fog::AWS[:efs].describe_mount_target_security_groups(mount_target_id).body
+      returns([security_group.group_id]) { result["SecurityGroups"] }
+      result
+    end
+
     tests("#describe_mount_targets(id: #{mount_target_id})").formats(AWS::EFS::Formats::DESCRIBE_MOUNT_TARGETS_RESULT) do
       Fog::AWS[:efs].describe_mount_targets(:id => mount_target_id).body
     end
@@ -95,12 +106,12 @@ Shindo.tests('AWS::EFS | file systems', ['aws', 'efs']) do
     end
 
     raises(Fog::AWS::EFS::NotFound, "invalid mount target id: foobar#{suffix}") do
-      Fog::AWS[:efs].delete_mount_target(:id => "foobar#{suffix}")
+      Fog::AWS[:efs].delete_mount_target("foobar#{suffix}")
     end
 
     tests("#delete_mount_target(id: #{mount_target_id})") do
       returns(true) do
-        result = Fog::AWS[:efs].delete_mount_target(:id => mount_target_id)
+        result = Fog::AWS[:efs].delete_mount_target(mount_target_id)
         result.body.empty?
       end
     end
@@ -110,18 +121,18 @@ Shindo.tests('AWS::EFS | file systems', ['aws', 'efs']) do
     if Fog.mocking?
       Fog::AWS[:efs].data[:file_systems][file_system_id]["NumberOfMountTargets"] = 1
       raises(Fog::AWS::EFS::FileSystemInUse) do
-        Fog::AWS[:efs].delete_file_system(:id => file_system_id)
+        Fog::AWS[:efs].delete_file_system(file_system_id)
       end
       Fog::AWS[:efs].data[:file_systems][file_system_id]["NumberOfMountTargets"] = 0
     end
 
     raises(Fog::AWS::EFS::NotFound, "invalid file system ID: foobar#{suffix}") do
-      Fog::AWS[:efs].delete_file_system(:id => "foobar#{suffix}")
+      Fog::AWS[:efs].delete_file_system("foobar#{suffix}")
     end
 
     tests("#delete_file_system") do
       returns(true) do
-        result = Fog::AWS[:efs].delete_file_system(:id => file_system_id)
+        result = Fog::AWS[:efs].delete_file_system(file_system_id)
         result.body.empty?
       end
     end
diff --git a/tests/requests/efs/helper.rb b/tests/requests/efs/helper.rb
index be347dba9..09bb4b84b 100644
--- a/tests/requests/efs/helper.rb
+++ b/tests/requests/efs/helper.rb
@@ -33,6 +33,10 @@ class AWS
       DESCRIBE_MOUNT_TARGETS_RESULT = {
         "MountTargets" => [MOUNT_TARGET_FORMAT]
       }
+
+      DESCRIBE_MOUNT_TARGET_SECURITY_GROUPS_FORMAT = {
+        "SecurityGroups" => Array
+      }
     end
   end
 end