1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

# EFS File System =============================================================

# Security Group ---------------------------------------------------------------

resource "aws_security_group" "efs" {
  name        = "${var.name}-sg"
  description = "Controls NFS access to EFS file system: ${var.name}."
  vpc_id      = var.vpc_id

  tags = merge(var.tags, local.module_tags, {
    resource-type = "security-group"
    Name          = "${var.name}-sg"
  })
}

resource "aws_vpc_security_group_ingress_rule" "nfs_sg" {
  for_each = toset(var.allowed_security_group_ids)

  security_group_id            = aws_security_group.efs.id
  description                  = "NFS from ${each.value}."
  from_port                    = 2049
  to_port                      = 2049
  ip_protocol                  = "tcp"
  referenced_security_group_id = each.value

  tags = merge(var.tags, local.module_tags, {
    resource-type = "sg-ingress-rule"
    Name          = "${var.name}-igr"
  })
}

resource "aws_vpc_security_group_egress_rule" "all" {
  security_group_id = aws_security_group.efs.id
  description       = "Allow all egress."
  ip_protocol       = "-1"
  cidr_ipv4         = "0.0.0.0/0"

  tags = merge(var.tags, local.module_tags, {
    resource-type = "sg-egress-rule"
    Name          = "${var.name}-egr"
  })
}

# File system ------------------------------------------------------------------

resource "aws_efs_file_system" "this" {
  performance_mode                = var.performance_mode
  throughput_mode                 = var.throughput_mode
  provisioned_throughput_in_mibps = var.provisioned_throughput_mibps
  encrypted                       = true
  kms_key_id                      = var.kms_key_id

  dynamic "lifecycle_policy" {
    for_each = var.lifecycle_policies
    content {
      transition_to_ia                    = lifecycle_policy.value.transition_to_ia
      transition_to_primary_storage_class = lifecycle_policy.value.transition_to_primary_storage_class
    }
  }

  tags = merge(var.tags, local.module_tags, {
    resource-type = "efs-file-system"
    Name          = var.name
  })

  lifecycle {
    # prevent_destroy = true
  }
}

# File system policy -----------------------------------------------------------

resource "aws_efs_file_system_policy" "this" {
  for_each = var.policy != null ? { policy = true } : {}

  file_system_id = aws_efs_file_system.this.id
  policy         = var.policy
}

# Mount targets ----------------------------------------------------------------

resource "aws_efs_mount_target" "this" {
  for_each = local.subnet_map

  file_system_id  = aws_efs_file_system.this.id
  subnet_id       = each.value
  security_groups = [aws_security_group.efs.id]
}

# Access points ----------------------------------------------------------------

resource "aws_efs_access_point" "this" {
  for_each = var.access_points

  file_system_id = aws_efs_file_system.this.id

  posix_user {
    uid = each.value.posix_user_uid
    gid = each.value.posix_user_gid
  }

  root_directory {
    path = each.value.root_path

    creation_info {
      owner_uid   = each.value.owner_uid
      owner_gid   = each.value.owner_gid
      permissions = each.value.permissions
    }
  }

  tags = merge(var.tags, local.module_tags, {
    resource-type = "efs-access-point"
    Name          = "${var.name}-${each.key}"
  })
}

# Replication ------------------------------------------------------------------

resource "aws_efs_replication_configuration" "this" {
  for_each = var.replication_destination_region != null ? { replication = true } : {}

  source_file_system_id = aws_efs_file_system.this.id

  destination {
    region = var.replication_destination_region
  }
}