You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| <aname="input_access_points"></a> [access\_points](#input\_access\_points)| A map of access point definitions to create |`any`|`{}`| no |
163
+
| <aname="input_access_points"></a> [access\_points](#input\_access\_points)| A map of access point definitions to create |<pre>map(object({<br/> name = optional(string)<br/> tags = optional(map(string), {})<br/> posix_user = optional(object({<br/> gid = number<br/> uid = number<br/> secondary_gids = optional(list(number))<br/> }))<br/> root_directory = optional(object({<br/> path = optional(string)<br/> creation_info = optional(object({<br/> owner_gid = number<br/> owner_uid = number<br/> permissions = string<br/> }))<br/> }))<br/> }))</pre>|`{}`| no |
153
164
| <aname="input_attach_policy"></a> [attach\_policy](#input\_attach\_policy)| Determines whether a policy is attached to the file system |`bool`|`true`| no |
154
165
| <aname="input_availability_zone_name"></a> [availability\_zone\_name](#input\_availability\_zone\_name)| The AWS Availability Zone in which to create the file system. Used to create a file system that uses One Zone storage classes |`string`|`null`| no |
155
166
| <aname="input_bypass_policy_lockout_safety_check"></a> [bypass\_policy\_lockout\_safety\_check](#input\_bypass\_policy\_lockout\_safety\_check)| A flag to indicate whether to bypass the `aws_efs_file_system_policy` lockout safety check. Defaults to `false`|`bool`|`null`| no |
@@ -163,18 +174,20 @@ No modules.
163
174
| <aname="input_enable_backup_policy"></a> [enable\_backup\_policy](#input\_enable\_backup\_policy)| Determines whether a backup policy is `ENABLED` or `DISABLED`|`bool`|`true`| no |
164
175
| <aname="input_encrypted"></a> [encrypted](#input\_encrypted)| If `true`, the disk will be encrypted |`bool`|`true`| no |
165
176
| <aname="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn)| The ARN for the KMS encryption key. When specifying `kms_key_arn`, encrypted needs to be set to `true`|`string`|`null`| no |
166
-
| <aname="input_lifecycle_policy"></a> [lifecycle\_policy](#input\_lifecycle\_policy)| A file system [lifecycle policy](https://docs.aws.amazon.com/efs/latest/ug/API_LifecyclePolicy.html) object |`any`|`{}`| no |
167
-
| <aname="input_mount_targets"></a> [mount\_targets](#input\_mount\_targets)| A map of mount target definitions to create |`any`|`{}`| no |
177
+
| <aname="input_lifecycle_policy"></a> [lifecycle\_policy](#input\_lifecycle\_policy)| A file system [lifecycle policy](https://docs.aws.amazon.com/efs/latest/ug/API_LifecyclePolicy.html) object |<pre>object({<br/> transition_to_ia = optional(string)<br/> transition_to_archive = optional(string)<br/> transition_to_primary_storage_class = optional(string)<br/> })</pre>|`{}`| no |
178
+
| <aname="input_mount_targets"></a> [mount\_targets](#input\_mount\_targets)| A map of mount target definitions to create |<pre>map(object({<br/> ip_address = optional(string)<br/> ip_address_type = optional(string)<br/> ipv6_address = optional(string)<br/> region = optional(string)<br/> security_groups = optional(list(string), [])<br/> subnet_id = string<br/> }))</pre>|`{}`| no |
168
179
| <aname="input_name"></a> [name](#input\_name)| The name of the file system |`string`|`""`| no |
169
180
| <aname="input_override_policy_documents"></a> [override\_policy\_documents](#input\_override\_policy\_documents)| List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid`|`list(string)`|`[]`| no |
170
181
| <aname="input_performance_mode"></a> [performance\_mode](#input\_performance\_mode)| The file system performance mode. Can be either `generalPurpose` or `maxIO`. Default is `generalPurpose`|`string`|`null`| no |
171
-
| <aname="input_policy_statements"></a> [policy\_statements](#input\_policy\_statements)| A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage |`any`|`[]`| no |
172
-
| <aname="input_protection"></a> [protection](#input\_protection)| A map of file protection configurations |`any`|`{}`| no |
182
+
| <a name="input_policy_statements"></a> [policy\_statements](#input\_policy\_statements) | A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | <pre>map(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string)<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> conditions = optional(list(object({<br/> test = string<br/> values = list(string)<br/> variable = string<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> values = list(string)<br/> variable = string<br/> })))<br/> }))</pre> | `null` | no |
183
+
| <aname="input_protection"></a> [protection](#input\_protection)| A map of file protection configurations |<pre>object({<br/> replication_overwrite = optional(string)<br/> })</pre> |`null`| no |
173
184
| <aname="input_provisioned_throughput_in_mibps"></a> [provisioned\_throughput\_in\_mibps](#input\_provisioned\_throughput\_in\_mibps)| The throughput, measured in MiB/s, that you want to provision for the file system. Only applicable with `throughput_mode` set to `provisioned`|`number`|`null`| no |
174
-
| <aname="input_replication_configuration_destination"></a> [replication\_configuration\_destination](#input\_replication\_configuration\_destination)| A destination configuration block |`any`|`{}`| no |
185
+
| <aname="input_region"></a> [region](#input\_region)| Region where this resource will be managed. Defaults to the Region set in the provider configuration |`string`|`null`| no |
186
+
| <aname="input_replication_configuration_destination"></a> [replication\_configuration\_destination](#input\_replication\_configuration\_destination)| A destination configuration block | <pre>object({<br/> availability_zone_name = optional(string)<br/> file_system_id = optional(string)<br/> kms_key_id = optional(string)<br/> region = optional(string)<br/> })</pre> |`null`| no |
175
187
| <aname="input_security_group_description"></a> [security\_group\_description](#input\_security\_group\_description)| Security group description. Defaults to Managed by Terraform |`string`|`null`| no |
188
+
| <aname="input_security_group_egress_rules"></a> [security\_group\_egress\_rules](#input\_security\_group\_egress\_rules)| Map of security group egress rules to add to the security group created | <pre>map(object({<br/> name = optional(string)<br/><br/> cidr_ipv4 = optional(string)<br/> cidr_ipv6 = optional(string)<br/> description = optional(string)<br/> from_port = optional(number, 2049)<br/> ip_protocol = optional(string, "tcp")<br/> prefix_list_id = optional(string)<br/> referenced_security_group_id = optional(string)<br/> region = optional(string)<br/> tags = optional(map(string), {})<br/> to_port = optional(number, 2049)<br/> }))</pre> |`{}`| no |
189
+
| <aname="input_security_group_ingress_rules"></a> [security\_group\_ingress\_rules](#input\_security\_group\_ingress\_rules)| Map of security group ingress rules to add to the security group created | <pre>map(object({<br/> name = optional(string)<br/><br/> cidr_ipv4 = optional(string)<br/> cidr_ipv6 = optional(string)<br/> description = optional(string)<br/> from_port = optional(number, 2049)<br/> ip_protocol = optional(string, "tcp")<br/> prefix_list_id = optional(string)<br/> referenced_security_group_id = optional(string)<br/> region = optional(string)<br/> tags = optional(map(string), {})<br/> to_port = optional(number, 2049)<br/> }))</pre> |`{}`| no |
176
190
| <aname="input_security_group_name"></a> [security\_group\_name](#input\_security\_group\_name)| Name to assign to the security group. If omitted, Terraform will assign a random, unique name |`string`|`null`| no |
177
-
| <aname="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules)| Map of security group rule definitions to create |`any`|`{}`| no |
178
191
| <aname="input_security_group_use_name_prefix"></a> [security\_group\_use\_name\_prefix](#input\_security\_group\_use\_name\_prefix)| Determines whether to use a name prefix for the security group. If `true`, the `security_group_name` value will be used as a prefix |`bool`|`false`| no |
179
192
| <aname="input_security_group_vpc_id"></a> [security\_group\_vpc\_id](#input\_security\_group\_vpc\_id)| The VPC ID where the security group will be created |`string`|`null`| no |
180
193
| <aname="input_source_policy_documents"></a> [source\_policy\_documents](#input\_source\_policy\_documents)| List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s |`list(string)`|`[]`| no |
Please consult the `examples` directory for reference example configurations. If you find a bug, please open an issue with supporting configuration to reproduce.
4
+
5
+
## List of backwards incompatible changes
6
+
7
+
- Terraform `v1.5.7` is now minimum supported version
8
+
- AWS provider `v6.12` is now minimum supported version
9
+
-`security_group_rules` has been split into `security_group_ingress_rules` and `security_group_egress_rules` to better match the AWS API and allow for more flexibility in defining security group rules.
10
+
-`policy_statements` changed from type `any` to `map`
11
+
12
+
## Additional changes
13
+
14
+
### Added
15
+
16
+
- Support for `region` parameter to specify the AWS region for the resources created if different from the provider region.
17
+
18
+
### Modified
19
+
20
+
- Variable definitions now contain detailed `object` types in place of the previously used any type.
21
+
22
+
### Variable and output changes
23
+
24
+
1. Removed variables:
25
+
26
+
-`security_group_rules`
27
+
28
+
2. Renamed variables:
29
+
30
+
- None
31
+
32
+
3. Added variables:
33
+
34
+
-`security_group_ingress_rules`
35
+
-`security_group_egress_rules`
36
+
37
+
4. Removed outputs:
38
+
39
+
- None
40
+
41
+
5. Renamed outputs:
42
+
43
+
- None
44
+
45
+
6. Added outputs:
46
+
47
+
- None
48
+
49
+
## Upgrade Migrations
50
+
51
+
### Before 2.x Example
52
+
53
+
```hcl
54
+
module "efs" {
55
+
source = "terraform-aws-modules/efs/aws"
56
+
version = "~> 1.0"
57
+
58
+
# Truncated for brevity ...
59
+
60
+
# Security Groups
61
+
security_group_rules = {
62
+
vpc = {
63
+
# relying on the defaults provided for EFS/NFS (2049/TCP + ingress)
64
+
description = "NFS ingress from VPC private subnets"
Due to the change from `aws_security_group_rule` to `aws_vpc_security_group_ingress_rule` and `aws_vpc_security_group_egress_rule`, the following reference state changes are required to maintain the current security group rules. (Note: these are different resources so they cannot be moved with `terraform mv ...`)
132
+
133
+
```sh
134
+
terraform state rm 'module.efs.aws_security_group_rule.this["vpc"]'
135
+
terraform state import 'module.efs.aws_vpc_security_group_ingress_rule.this["vpc_1"]''sg-xxx'
136
+
terraform state import 'module.efs.aws_vpc_security_group_ingress_rule.this["vpc_2"]''sg-xxx'
137
+
terraform state import 'module.efs.aws_vpc_security_group_ingress_rule.this["vpc_3"]''sg-xxx'
0 commit comments