fsx-windows

Provisions an FSx for Windows File Server filesystem with a dedicated security group, self-managed Active Directory integration, optional audit logging, and automatic backups. Supports both single-AZ and multi-AZ deployments.

Prerequisites

• A self-managed Active Directory (on-prem or EC2-hosted) reachable from the target VPC
• AD service account credentials stored in Secrets Manager or SSM — resolve them in the calling stack before passing into this module
• Subnets in the target VPC with connectivity to AD DNS IPs

Usage

module "fsx_windows" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__storage/fsx-windows/aws"
  version = "1.0.0"

  name    = "hca-fsx-prod"
  vpc_id  = module.vpc.vpc_id

  subnet_ids = [
    module.vpc.private_subnet_ids[0],
    module.vpc.private_subnet_ids[1],
  ]

  allowed_security_group_ids = [module.ec2.security_group_id]

  storage_capacity_gb      = 512
  storage_type             = "SSD"
  throughput_capacity_mbps = 128
  deployment_type          = "MULTI_AZ_1"

  active_directory = {
    domain_name = "corp.hca.internal"
    dns_ips     = ["10.0.1.10", "10.0.1.11"]
    username    = data.aws_secretsmanager_secret_version.fsx_ad.secret_string["username"]
    password    = data.aws_secretsmanager_secret_version.fsx_ad.secret_string["password"]
    organizational_unit_distinguished_name = "OU=FSx,OU=Servers,DC=corp,DC=hca,DC=internal"
  }

  kms_key_id = aws_kms_key.fsx.arn

  automatic_backup_retention_days    = 7
  daily_automatic_backup_start_time  = "02:00"
  weekly_maintenance_start_time      = "7:03:00"
  copy_tags_to_backups               = true

  tags = {
    Environment = "prod"
    Team        = "AWS Infra"
  }
}

Deployment types

Type	Subnets	Use case
MULTI_AZ_1	2 (preferred + standby)	Production — HA across AZs
SINGLE_AZ_2	1	Non-prod or cost-sensitive workloads

Storage types

Type	Min capacity	Notes
SSD	32 GiB	Default — recommended for most workloads
HDD	2000 GiB	Only supported with MULTI_AZ_1 and SINGLE_AZ_2

Throughput capacity

Valid values (MB/s): 8, 16, 32, 64, 128, 256, 512, 1024, 2048

Active Directory

Only self-managed AD is supported. Never pass credentials as literals in tfvars — resolve from Secrets Manager or SSM in the calling stack and pass the resolved strings.

Audit logging

Disabled by default. Set audit_log_destination_arn to a CloudWatch Logs log group ARN or Kinesis Firehose delivery stream ARN to enable. Control granularity via file_access_audit_log_level and file_share_access_audit_log_level.

Valid levels: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE

Destroy protection

This module sets prevent_destroy = true on the filesystem. Remove the lifecycle block explicitly when decommissioning.

Mounting

Use dns_name output from Windows instances. Reference security_group_id output in other modules that need SMB access.

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws	>= 6.0, < 7.0

Resources

Name	Type
aws_fsx_windows_file_system.this	resource
aws_security_group.fsx	resource
aws_vpc_security_group_egress_rule.all	resource
aws_vpc_security_group_ingress_rule.smb_cidr	resource
aws_vpc_security_group_ingress_rule.smb_sg	resource

Inputs

Name	Description	Type	Default	Required
active_directory	Self-managed Active Directory configuration.Credentials (username, password) must be sourced from Secrets Manager or SSMby the caller — pass resolved strings, never literals in tfvars.	object({ domain_name = string dns_ips = list(string) username = string password = string organizational_unit_distinguished_name = optional(string) file_system_administrators_group = optional(string, "Domain Admins") })	n/a	yes
name	Name used for the filesystem and derived resource names.	string	n/a	yes
storage_capacity_gb	Storage capacity in GiB. Minimum 32 for SSD, 2000 for HDD.	number	n/a	yes
subnet_ids	Subnet IDs for the filesystem.Single-element list for SINGLE_AZ_2. Two-element list (preferred + standby) for MULTI_AZ_1.	list(string)	n/a	yes
throughput_capacity_mbps	Throughput capacity in MB/s. Must be one of the FSx-valid values:8, 16, 32, 64, 128, 256, 512, 1024, 2048.	number	n/a	yes
vpc_id	VPC ID in which the FSx security group will be created.	string	n/a	yes
allowed_cidr_blocks	CIDR blocks permitted to mount the filesystem (SMB port 445). Use sparingly — prefer SG references.	list(string)	[]	no
allowed_security_group_ids	Security group IDs permitted to mount the filesystem (SMB port 445).	list(string)	[]	no
audit_log_destination_arn	ARN of the CloudWatch Logs log group or Kinesis Firehose delivery streamto receive FSx audit logs. Null disables audit logging.	string	null	no
automatic_backup_retention_days	Number of days to retain automatic backups. 0 disables backups.	number	7	no
copy_tags_to_backups	Whether to copy module tags to automatic and manual backups.	bool	true	no
daily_automatic_backup_start_time	Daily backup window in HH:MM format (UTC). Example: '02:00'.	string	"02:00"	no
deployment_type	FSx deployment type: SINGLE_AZ_2 or MULTI_AZ_1.	string	"MULTI_AZ_1"	no
dns_aliases	List of DNS alias FQDNs to associate with the filesystem.	list(string)	[]	no
file_access_audit_log_level	Audit level for file access events: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE.	string	"DISABLED"	no
file_share_access_audit_log_level	Audit level for file share access events: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE.	string	"DISABLED"	no
kms_key_id	KMS key ARN for at-rest encryption. Omit to use the AWS-managed key (aws/fsx).	string	null	no
preferred_subnet_id	Preferred subnet ID for the primary file server in MULTI_AZ_1 deployments.Defaults to the first entry in subnet_ids if not explicitly provided.Ignored for SINGLE_AZ_2.	string	null	no
storage_type	Storage type: SSD or HDD.	string	"SSD"	no
tags	Tags applied to all resources in this module.	map(string)	{}	no
weekly_maintenance_start_time	Weekly maintenance window in 'd:HH:MM' format (UTC).d = day of week: 1 (Mon) through 7 (Sun). Example: '7:03:00' = Sunday 03:00 UTC.	string	"7:03:00"	no

Outputs

Name	Description
arn	FSx filesystem ARN.
dns_name	DNS name of the filesystem. Use this as the mount target from Windows instances.
id	FSx filesystem ID.
preferred_file_server_ip	IP address of the primary file server (MULTI_AZ_1 only).
remote_administration_endpoint	Remote administration endpoint for managing the filesystem via Windows PowerShell.
security_group_id	ID of the FSx security group. Reference this from other modules that need mount access.
storage_capacity_gb	Provisioned storage capacity in GiB.
throughput_capacity_mbps	Provisioned throughput capacity in MB/s.