# efs

Provisions an Amazon EFS file system with a dedicated security group, per-subnet mount targets, optional access points, lifecycle policies, resource policy, and cross-region replication.

## Usage

```hcl
module "efs" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__storage/efs/aws"
  version = "1.0.0"

  name   = "hca-efs-prod"
  vpc_id = module.vpc.vpc_id

  subnet_ids = module.vpc.private_subnet_ids

  allowed_security_group_ids = [module.ec2.security_group_id]

  performance_mode = "generalPurpose"
  throughput_mode  = "elastic"

  kms_key_id = aws_kms_key.efs.arn

  lifecycle_policies = [
    { transition_to_ia                    = "AFTER_30_DAYS" },
    { transition_to_primary_storage_class = "AFTER_1_ACCESS" },
  ]

  access_points = {
    app = {
      root_path      = "/app"
      posix_user_uid = 1000
      posix_user_gid = 1000
      owner_uid      = 1000
      owner_gid      = 1000
      permissions    = "755"
    }
  }

  tags = {
    Environment = "prod"
    Team        = "AWS Infra"
  }
}
```

## Throughput modes

| Mode          | Notes                                                 |
| ------------- | ----------------------------------------------------- |
| `elastic`     | Default — recommended, scales automatically           |
| `bursting`    | Throughput scales with storage size                   |
| `provisioned` | Fixed throughput — set `provisioned_throughput_mibps` |

## Performance modes

| Mode             | Notes                                                                 |
| ---------------- | --------------------------------------------------------------------- |
| `generalPurpose` | Default — recommended for most workloads                              |
| `maxIO`          | Higher throughput, higher latency — for highly parallelized workloads |

## Mount targets

One mount target is created per subnet in `subnet_ids`. One subnet per AZ is recommended for HA.

## Access points

Access points enforce POSIX user identity and root directory on mount. Each access point creates its `root_path` directory with the specified ownership and permissions on first mount.

## Lifecycle policies

Default transitions files to EFS-IA after 30 days of inactivity and back to primary storage on first access. Override via `lifecycle_policies`.

## Replication

Set `replication_destination_region` to enable cross-region replication to a new EFS file system in the target region.

## Mounting

Use `dns_name` output from Linux instances over NFS port 2049. Reference `security_group_id` output in other modules that need mount access. For access point mounts, use `access_point_arns` output.

## Destroy protection

`prevent_destroy` is currently commented out — uncomment in `main.tf` before production use.

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->

## Requirements

| Name                                                                     | Version            |
| ------------------------------------------------------------------------ | ------------------ |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | >= 1.15.0, < 2.0.0 |
| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | >= 6.0, < 7.0      |

## Providers

| Name                                             | Version       |
| ------------------------------------------------ | ------------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | >= 6.0, < 7.0 |

## Resources

| Name                                                                                                                                                      | Type     |
| --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_efs_access_point.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_access_point)                                 | resource |
| [aws_efs_file_system.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system)                                   | resource |
| [aws_efs_file_system_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system_policy)                     | resource |
| [aws_efs_mount_target.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_mount_target)                                 | resource |
| [aws_efs_replication_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_replication_configuration)       | resource |
| [aws_security_group.efs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group)                                      | resource |
| [aws_vpc_security_group_egress_rule.all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule)      | resource |
| [aws_vpc_security_group_ingress_rule.nfs_sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |

## Inputs

| Name                                                                                                                        | Description                                                                                  | Type                                                                                                                                                                                                                                                                          | Default                                                                                                                                               | Required |
| --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | :------: |
| <a name="input_name"></a> [name](#input_name)                                                                               | Name for the EFS file system. Applied as a Name tag on all resources.                        | `string`                                                                                                                                                                                                                                                                      | n/a                                                                                                                                                   |   yes    |
| <a name="input_subnet_ids"></a> [subnet_ids](#input_subnet_ids)                                                             | Subnet IDs in which to create EFS mount targets. One per AZ recommended.                     | `list(string)`                                                                                                                                                                                                                                                                | n/a                                                                                                                                                   |   yes    |
| <a name="input_vpc_id"></a> [vpc_id](#input_vpc_id)                                                                         | VPC ID in which the EFS security group will be created.                                      | `string`                                                                                                                                                                                                                                                                      | n/a                                                                                                                                                   |   yes    |
| <a name="input_access_points"></a> [access_points](#input_access_points)                                                    | Map of EFS access points to create.                                                          | <pre>map(object({<br/> posix_user_uid = optional(number, 1000)<br/> posix_user_gid = optional(number, 1000)<br/> root_path = string<br/> owner_uid = optional(number, 1000)<br/> owner_gid = optional(number, 1000)<br/> permissions = optional(string, "755")<br/> }))</pre> | `{}`                                                                                                                                                  |    no    |
| <a name="input_allowed_security_group_ids"></a> [allowed_security_group_ids](#input_allowed_security_group_ids)             | Security group IDs permitted to mount the filesystem (NFS port 2049).                        | `list(string)`                                                                                                                                                                                                                                                                | `[]`                                                                                                                                                  |    no    |
| <a name="input_kms_key_id"></a> [kms_key_id](#input_kms_key_id)                                                             | KMS key ARN for at-rest encryption. Omit to use the AWS-managed key (aws/elasticfilesystem). | `string`                                                                                                                                                                                                                                                                      | `null`                                                                                                                                                |    no    |
| <a name="input_lifecycle_policies"></a> [lifecycle_policies](#input_lifecycle_policies)                                     | Lifecycle policies for transitioning files to EFS-IA and back to primary storage.            | <pre>list(object({<br/> transition_to_ia = optional(string)<br/> transition_to_primary_storage_class = optional(string)<br/> }))</pre>                                                                                                                                        | <pre>[<br/> {<br/> "transition_to_ia": "AFTER_30_DAYS"<br/> },<br/> {<br/> "transition_to_primary_storage_class": "AFTER_1_ACCESS"<br/> }<br/>]</pre> |    no    |
| <a name="input_performance_mode"></a> [performance_mode](#input_performance_mode)                                           | EFS performance mode: generalPurpose or maxIO.                                               | `string`                                                                                                                                                                                                                                                                      | `"generalPurpose"`                                                                                                                                    |    no    |
| <a name="input_policy"></a> [policy](#input_policy)                                                                         | JSON EFS file system resource policy document. Null disables the policy resource.            | `string`                                                                                                                                                                                                                                                                      | `null`                                                                                                                                                |    no    |
| <a name="input_provisioned_throughput_mibps"></a> [provisioned_throughput_mibps](#input_provisioned_throughput_mibps)       | Provisioned throughput in MiB/s. Required when throughput_mode is 'provisioned'.             | `number`                                                                                                                                                                                                                                                                      | `null`                                                                                                                                                |    no    |
| <a name="input_replication_destination_region"></a> [replication_destination_region](#input_replication_destination_region) | AWS region for EFS replication. Null disables replication.                                   | `string`                                                                                                                                                                                                                                                                      | `null`                                                                                                                                                |    no    |
| <a name="input_tags"></a> [tags](#input_tags)                                                                               | Tags applied to all resources in this module.                                                | `map(string)`                                                                                                                                                                                                                                                                 | `{}`                                                                                                                                                  |    no    |
| <a name="input_throughput_mode"></a> [throughput_mode](#input_throughput_mode)                                              | EFS throughput mode: bursting, provisioned, or elastic.                                      | `string`                                                                                                                                                                                                                                                                      | `"elastic"`                                                                                                                                           |    no    |

## Outputs

| Name                                                                                   | Description                                                                             |
| -------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| <a name="output_access_point_arns"></a> [access_point_arns](#output_access_point_arns) | Map of access point logical key to ARN.                                                 |
| <a name="output_access_point_ids"></a> [access_point_ids](#output_access_point_ids)    | Map of access point logical key to ID.                                                  |
| <a name="output_arn"></a> [arn](#output_arn)                                           | EFS file system ARN.                                                                    |
| <a name="output_dns_name"></a> [dns_name](#output_dns_name)                            | EFS DNS name. Use this as the mount target from Linux instances.                        |
| <a name="output_id"></a> [id](#output_id)                                              | EFS file system ID.                                                                     |
| <a name="output_mount_target_ids"></a> [mount_target_ids](#output_mount_target_ids)    | Map of subnet index to mount target ID.                                                 |
| <a name="output_security_group_id"></a> [security_group_id](#output_security_group_id) | ID of the EFS security group. Reference this from other modules that need mount access. |

<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->