# fsx-windows

Provisions an FSx for Windows File Server filesystem with a dedicated security group, self-managed Active Directory integration, optional audit logging, and automatic backups. Supports both single-AZ and multi-AZ deployments.

## Prerequisites

- A self-managed Active Directory (on-prem or EC2-hosted) reachable from the target VPC
- AD service account credentials stored in Secrets Manager or SSM — resolve them in the calling stack before passing into this module
- Subnets in the target VPC with connectivity to AD DNS IPs

## Usage

```hcl
module "fsx_windows" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__storage/fsx-windows/aws"
  version = "1.0.0"

  name    = "hca-fsx-prod"
  vpc_id  = module.vpc.vpc_id

  subnet_ids = [
    module.vpc.private_subnet_ids[0],
    module.vpc.private_subnet_ids[1],
  ]

  allowed_security_group_ids = [module.ec2.security_group_id]

  storage_capacity_gb      = 512
  storage_type             = "SSD"
  throughput_capacity_mbps = 128
  deployment_type          = "MULTI_AZ_1"

  active_directory = {
    domain_name = "corp.hca.internal"
    dns_ips     = ["10.0.1.10", "10.0.1.11"]
    username    = data.aws_secretsmanager_secret_version.fsx_ad.secret_string["username"]
    password    = data.aws_secretsmanager_secret_version.fsx_ad.secret_string["password"]
    organizational_unit_distinguished_name = "OU=FSx,OU=Servers,DC=corp,DC=hca,DC=internal"
  }

  kms_key_id = aws_kms_key.fsx.arn

  automatic_backup_retention_days    = 7
  daily_automatic_backup_start_time  = "02:00"
  weekly_maintenance_start_time      = "7:03:00"
  copy_tags_to_backups               = true

  tags = {
    Environment = "prod"
    Team        = "AWS Infra"
  }
}
```

## Deployment types

| Type          | Subnets                 | Use case                             |
| ------------- | ----------------------- | ------------------------------------ |
| `MULTI_AZ_1`  | 2 (preferred + standby) | Production — HA across AZs           |
| `SINGLE_AZ_2` | 1                       | Non-prod or cost-sensitive workloads |

## Storage types

| Type  | Min capacity | Notes                                          |
| ----- | ------------ | ---------------------------------------------- |
| `SSD` | 32 GiB       | Default — recommended for most workloads       |
| `HDD` | 2000 GiB     | Only supported with MULTI_AZ_1 and SINGLE_AZ_2 |

## Throughput capacity

Valid values (MB/s): `8`, `16`, `32`, `64`, `128`, `256`, `512`, `1024`, `2048`

## Active Directory

Only self-managed AD is supported. Never pass credentials as literals in tfvars — resolve from Secrets Manager or SSM in the calling stack and pass the resolved strings.

## Audit logging

Disabled by default. Set `audit_log_destination_arn` to a CloudWatch Logs log group ARN or Kinesis Firehose delivery stream ARN to enable. Control granularity via `file_access_audit_log_level` and `file_share_access_audit_log_level`.

Valid levels: `DISABLED`, `SUCCESS_ONLY`, `FAILURE_ONLY`, `SUCCESS_AND_FAILURE`

## Destroy protection

This module sets `prevent_destroy = true` on the filesystem. Remove the lifecycle block explicitly when decommissioning.

## Mounting

Use `dns_name` output from Windows instances. Reference `security_group_id` output in other modules that need SMB access.

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->

## Requirements

| Name                                                                     | Version            |
| ------------------------------------------------------------------------ | ------------------ |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | >= 1.15.0, < 2.0.0 |
| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | >= 6.0, < 7.0      |

## Providers

| Name                                             | Version       |
| ------------------------------------------------ | ------------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | >= 6.0, < 7.0 |

## Resources

| Name                                                                                                                                                        | Type     |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_fsx_windows_file_system.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/fsx_windows_file_system)                     | resource |
| [aws_security_group.fsx](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group)                                        | resource |
| [aws_vpc_security_group_egress_rule.all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule)        | resource |
| [aws_vpc_security_group_ingress_rule.smb_cidr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.smb_sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule)   | resource |

## Inputs

| Name                                                                                                                                 | Description                                                                                                                                                                                        | Type                                                                                                                                                                                                                                                                     | Default        | Required |
| ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------- | :------: |
| <a name="input_active_directory"></a> [active_directory](#input_active_directory)                                                    | Self-managed Active Directory configuration.<br/>Credentials (username, password) must be sourced from Secrets Manager or SSM<br/>by the caller — pass resolved strings, never literals in tfvars. | <pre>object({<br/> domain_name = string<br/> dns_ips = list(string)<br/> username = string<br/> password = string<br/> organizational_unit_distinguished_name = optional(string)<br/> file_system_administrators_group = optional(string, "Domain Admins")<br/> })</pre> | n/a            |   yes    |
| <a name="input_name"></a> [name](#input_name)                                                                                        | Name used for the filesystem and derived resource names.                                                                                                                                           | `string`                                                                                                                                                                                                                                                                 | n/a            |   yes    |
| <a name="input_storage_capacity_gb"></a> [storage_capacity_gb](#input_storage_capacity_gb)                                           | Storage capacity in GiB. Minimum 32 for SSD, 2000 for HDD.                                                                                                                                         | `number`                                                                                                                                                                                                                                                                 | n/a            |   yes    |
| <a name="input_subnet_ids"></a> [subnet_ids](#input_subnet_ids)                                                                      | Subnet IDs for the filesystem.<br/>Single-element list for SINGLE_AZ_2. Two-element list (preferred + standby) for MULTI_AZ_1.                                                                     | `list(string)`                                                                                                                                                                                                                                                           | n/a            |   yes    |
| <a name="input_throughput_capacity_mbps"></a> [throughput_capacity_mbps](#input_throughput_capacity_mbps)                            | Throughput capacity in MB/s. Must be one of the FSx-valid values:<br/>8, 16, 32, 64, 128, 256, 512, 1024, 2048.                                                                                    | `number`                                                                                                                                                                                                                                                                 | n/a            |   yes    |
| <a name="input_vpc_id"></a> [vpc_id](#input_vpc_id)                                                                                  | VPC ID in which the FSx security group will be created.                                                                                                                                            | `string`                                                                                                                                                                                                                                                                 | n/a            |   yes    |
| <a name="input_allowed_cidr_blocks"></a> [allowed_cidr_blocks](#input_allowed_cidr_blocks)                                           | CIDR blocks permitted to mount the filesystem (SMB port 445). Use sparingly — prefer SG references.                                                                                                | `list(string)`                                                                                                                                                                                                                                                           | `[]`           |    no    |
| <a name="input_allowed_security_group_ids"></a> [allowed_security_group_ids](#input_allowed_security_group_ids)                      | Security group IDs permitted to mount the filesystem (SMB port 445).                                                                                                                               | `list(string)`                                                                                                                                                                                                                                                           | `[]`           |    no    |
| <a name="input_audit_log_destination_arn"></a> [audit_log_destination_arn](#input_audit_log_destination_arn)                         | ARN of the CloudWatch Logs log group or Kinesis Firehose delivery stream<br/>to receive FSx audit logs. Null disables audit logging.                                                               | `string`                                                                                                                                                                                                                                                                 | `null`         |    no    |
| <a name="input_automatic_backup_retention_days"></a> [automatic_backup_retention_days](#input_automatic_backup_retention_days)       | Number of days to retain automatic backups. 0 disables backups.                                                                                                                                    | `number`                                                                                                                                                                                                                                                                 | `7`            |    no    |
| <a name="input_copy_tags_to_backups"></a> [copy_tags_to_backups](#input_copy_tags_to_backups)                                        | Whether to copy module tags to automatic and manual backups.                                                                                                                                       | `bool`                                                                                                                                                                                                                                                                   | `true`         |    no    |
| <a name="input_daily_automatic_backup_start_time"></a> [daily_automatic_backup_start_time](#input_daily_automatic_backup_start_time) | Daily backup window in HH:MM format (UTC). Example: '02:00'.                                                                                                                                       | `string`                                                                                                                                                                                                                                                                 | `"02:00"`      |    no    |
| <a name="input_deployment_type"></a> [deployment_type](#input_deployment_type)                                                       | FSx deployment type: SINGLE_AZ_2 or MULTI_AZ_1.                                                                                                                                                    | `string`                                                                                                                                                                                                                                                                 | `"MULTI_AZ_1"` |    no    |
| <a name="input_dns_aliases"></a> [dns_aliases](#input_dns_aliases)                                                                   | List of DNS alias FQDNs to associate with the filesystem.                                                                                                                                          | `list(string)`                                                                                                                                                                                                                                                           | `[]`           |    no    |
| <a name="input_file_access_audit_log_level"></a> [file_access_audit_log_level](#input_file_access_audit_log_level)                   | Audit level for file access events: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE.                                                                                                     | `string`                                                                                                                                                                                                                                                                 | `"DISABLED"`   |    no    |
| <a name="input_file_share_access_audit_log_level"></a> [file_share_access_audit_log_level](#input_file_share_access_audit_log_level) | Audit level for file share access events: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE.                                                                                               | `string`                                                                                                                                                                                                                                                                 | `"DISABLED"`   |    no    |
| <a name="input_kms_key_id"></a> [kms_key_id](#input_kms_key_id)                                                                      | KMS key ARN for at-rest encryption. Omit to use the AWS-managed key (aws/fsx).                                                                                                                     | `string`                                                                                                                                                                                                                                                                 | `null`         |    no    |
| <a name="input_preferred_subnet_id"></a> [preferred_subnet_id](#input_preferred_subnet_id)                                           | Preferred subnet ID for the primary file server in MULTI_AZ_1 deployments.<br/>Defaults to the first entry in subnet_ids if not explicitly provided.<br/>Ignored for SINGLE_AZ_2.                  | `string`                                                                                                                                                                                                                                                                 | `null`         |    no    |
| <a name="input_storage_type"></a> [storage_type](#input_storage_type)                                                                | Storage type: SSD or HDD.                                                                                                                                                                          | `string`                                                                                                                                                                                                                                                                 | `"SSD"`        |    no    |
| <a name="input_tags"></a> [tags](#input_tags)                                                                                        | Tags applied to all resources in this module.                                                                                                                                                      | `map(string)`                                                                                                                                                                                                                                                            | `{}`           |    no    |
| <a name="input_weekly_maintenance_start_time"></a> [weekly_maintenance_start_time](#input_weekly_maintenance_start_time)             | Weekly maintenance window in 'd:HH:MM' format (UTC).<br/>d = day of week: 1 (Mon) through 7 (Sun). Example: '7:03:00' = Sunday 03:00 UTC.                                                          | `string`                                                                                                                                                                                                                                                                 | `"7:03:00"`    |    no    |

## Outputs

| Name                                                                                                                          | Description                                                                             |
| ----------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| <a name="output_arn"></a> [arn](#output_arn)                                                                                  | FSx filesystem ARN.                                                                     |
| <a name="output_dns_name"></a> [dns_name](#output_dns_name)                                                                   | DNS name of the filesystem. Use this as the mount target from Windows instances.        |
| <a name="output_id"></a> [id](#output_id)                                                                                     | FSx filesystem ID.                                                                      |
| <a name="output_preferred_file_server_ip"></a> [preferred_file_server_ip](#output_preferred_file_server_ip)                   | IP address of the primary file server (MULTI_AZ_1 only).                                |
| <a name="output_remote_administration_endpoint"></a> [remote_administration_endpoint](#output_remote_administration_endpoint) | Remote administration endpoint for managing the filesystem via Windows PowerShell.      |
| <a name="output_security_group_id"></a> [security_group_id](#output_security_group_id)                                        | ID of the FSx security group. Reference this from other modules that need mount access. |
| <a name="output_storage_capacity_gb"></a> [storage_capacity_gb](#output_storage_capacity_gb)                                  | Provisioned storage capacity in GiB.                                                    |
| <a name="output_throughput_capacity_mbps"></a> [throughput_capacity_mbps](#output_throughput_capacity_mbps)                   | Provisioned throughput capacity in MB/s.                                                |

<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->