efs

Provisions an Amazon EFS file system with a dedicated security group, per-subnet mount targets, optional access points, lifecycle policies, resource policy, and cross-region replication.

Usage

module "efs" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__storage/efs/aws"
  version = "1.0.0"

  name   = "hca-efs-prod"
  vpc_id = module.vpc.vpc_id

  subnet_ids = module.vpc.private_subnet_ids

  allowed_security_group_ids = [module.ec2.security_group_id]

  performance_mode = "generalPurpose"
  throughput_mode  = "elastic"

  kms_key_id = aws_kms_key.efs.arn

  lifecycle_policies = [
    { transition_to_ia                    = "AFTER_30_DAYS" },
    { transition_to_primary_storage_class = "AFTER_1_ACCESS" },
  ]

  access_points = {
    app = {
      root_path      = "/app"
      posix_user_uid = 1000
      posix_user_gid = 1000
      owner_uid      = 1000
      owner_gid      = 1000
      permissions    = "755"
    }
  }

  tags = {
    Environment = "prod"
    Team        = "AWS Infra"
  }
}

Throughput modes

Mode	Notes
elastic	Default — recommended, scales automatically
bursting	Throughput scales with storage size
provisioned	Fixed throughput — set provisioned_throughput_mibps

Performance modes

Mode	Notes
generalPurpose	Default — recommended for most workloads
maxIO	Higher throughput, higher latency — for highly parallelized workloads

Mount targets

One mount target is created per subnet in subnet_ids. One subnet per AZ is recommended for HA.

Access points

Access points enforce POSIX user identity and root directory on mount. Each access point creates its root_path directory with the specified ownership and permissions on first mount.

Lifecycle policies

Default transitions files to EFS-IA after 30 days of inactivity and back to primary storage on first access. Override via lifecycle_policies.

Replication

Set replication_destination_region to enable cross-region replication to a new EFS file system in the target region.

Mounting

Use dns_name output from Linux instances over NFS port 2049. Reference security_group_id output in other modules that need mount access. For access point mounts, use access_point_arns output.

Destroy protection

prevent_destroy is currently commented out — uncomment in main.tf before production use.

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws	>= 6.0, < 7.0

Resources

Name	Type
aws_efs_access_point.this	resource
aws_efs_file_system.this	resource
aws_efs_file_system_policy.this	resource
aws_efs_mount_target.this	resource
aws_efs_replication_configuration.this	resource
aws_security_group.efs	resource
aws_vpc_security_group_egress_rule.all	resource
aws_vpc_security_group_ingress_rule.nfs_sg	resource

Inputs

Name	Description	Type	Default	Required
name	Name for the EFS file system. Applied as a Name tag on all resources.	string	n/a	yes
subnet_ids	Subnet IDs in which to create EFS mount targets. One per AZ recommended.	list(string)	n/a	yes
vpc_id	VPC ID in which the EFS security group will be created.	string	n/a	yes
access_points	Map of EFS access points to create.	map(object({ posix_user_uid = optional(number, 1000) posix_user_gid = optional(number, 1000) root_path = string owner_uid = optional(number, 1000) owner_gid = optional(number, 1000) permissions = optional(string, "755") }))	{}	no
allowed_security_group_ids	Security group IDs permitted to mount the filesystem (NFS port 2049).	list(string)	[]	no
kms_key_id	KMS key ARN for at-rest encryption. Omit to use the AWS-managed key (aws/elasticfilesystem).	string	null	no
lifecycle_policies	Lifecycle policies for transitioning files to EFS-IA and back to primary storage.	list(object({ transition_to_ia = optional(string) transition_to_primary_storage_class = optional(string) }))	[ { "transition_to_ia": "AFTER_30_DAYS" }, { "transition_to_primary_storage_class": "AFTER_1_ACCESS" }]	no
performance_mode	EFS performance mode: generalPurpose or maxIO.	string	"generalPurpose"	no
policy	JSON EFS file system resource policy document. Null disables the policy resource.	string	null	no
provisioned_throughput_mibps	Provisioned throughput in MiB/s. Required when throughput_mode is 'provisioned'.	number	null	no
replication_destination_region	AWS region for EFS replication. Null disables replication.	string	null	no
tags	Tags applied to all resources in this module.	map(string)	{}	no
throughput_mode	EFS throughput mode: bursting, provisioned, or elastic.	string	"elastic"	no

Outputs

Name	Description
access_point_arns	Map of access point logical key to ARN.
access_point_ids	Map of access point logical key to ID.
arn	EFS file system ARN.
dns_name	EFS DNS name. Use this as the mount target from Linux instances.
id	EFS file system ID.
mount_target_ids	Map of subnet index to mount target ID.
security_group_id	ID of the EFS security group. Reference this from other modules that need mount access.