A Transfer that Does Not Delete What It Finds
preserve_deleted_files = REMOVE deletes files at the DESTINATION that are absent from the source, so an unmounted share or a renamed path empties the destination on schedule and the task reports success. PRESERVE here, with verification on, a bandwidth ceiling so it cannot take the whole Direct Connect, and a per-file report of what failed.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "datasync" {
source = "www.iac-bazaar.com/iac-bazaar/aws-datasync/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-datasync
A DataSync task that verifies what it copied, cannot delete at the destination
by accident, and cannot take the whole link doing it. Works with Terraform and
OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.
preserve_deleted_files = REMOVE turns a copy into a mirror, and a mirror
deletes. Files absent from the source are removed from the
destination. That is the intended behaviour of a sync and it is also the
single most dangerous setting in this service: if the source is ever wrong - an
unmounted share, a renamed path, a permissions failure that presents as an empty
directory - the destination is emptied, on schedule, and the task reports
success, because it did exactly what it was told. PRESERVE here, with a
precondition that refuses REMOVE unless accept_destination_deletes says
so, and deletes_at_destination as an output.
verify_mode = NONE copies without checking. The AWS default does verify,
but NONE is what people reach for when a transfer is slow - and it trades the
only evidence that the copy is intact for throughput.
bytes_per_second is unlimited by default. DataSync will use everything
available, which on a hybrid transfer means your Direct Connect or your VPN,
shared with production traffic. The first symptom is unrelated latency somewhere
else entirely.
Without a log group there is no per-file record. "12,000 files transferred,
3 failed" with no way to learn which three. A log group, a task_report, or
both; names_failed_files is an output.
Smaller things: atime and mtime are coupled at the API - BEST_EFFORT
requires PRESERVE, NONE requires NONE - so preconditions check the pairing
rather than letting create fail on it; object_tags defaults to PRESERVE
because tags often carry lifecycle and cost-allocation meaning and dropping them
silently changes retention at the destination; and task_queueing is enabled so
a scheduled task queues rather than skipping a night when the previous run is
still going.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-s3-bucket
Private S3 bucket with encryption, versioning, public-access block, and TLS-only policy.
aws-backup
A vault, its plans and what they protect, with the service role that can restore as well as back up. Vault Lock is stated rather than defaulted: COMPLIANCE mode cannot be removed by anybody once its window elapses, which is the point and is irreversible.
aws-efs
An EFS file system with mount targets, a least-privilege NFS security group, lifecycle tiering, automatic backups, and a resource policy that enforces encryption in transit.
aws-ebs-volume
Volumes that are always encrypted, optional attachment, and a DLM snapshot schedule in the same module - because a volume with no schedule is one copy of your data on hardware that can fail, and leaving snapshots to somebody else usually means nobody.
aws-fsx-lustre
A Lustre file system with the S3 link, root squash and compression set deliberately. SCRATCH deployments are not replicated - a lost file server loses the data - so this defaults to PERSISTENT_2 and refuses the combinations FSx accepts quietly.
aws-transfer-family
SFTP, FTPS and FTP in front of S3. A generated host key does not survive replacing the server, so every client reports a changed key - the warning that means interception - and after the second time nobody reads it. Supply one.