NFS And SMB Volumes That Keep Their Backups

aws-fsx-ontap

Amazon FSx for NetApp ONTAP: a file system, one storage virtual machine (SVM) and its volumes. Works with Terraform and OpenTofu (>= 1.6), aws provider >= 6.0, < 7.0.

Backups are off unless you turn them on. The provider's automatic_backup_retention_days defaults to 0, which disables daily volume backups; the AWS API's default is 30 days. This module sets 30, copies tags to backups and takes a final backup of each volume it deletes. Setting the retention to 0 later also deletes every automatic backup already taken. A backup fails when its snapshot would take the volume past 98 percent full.

No VPC default security group. When no security group is given, AWS attaches the VPC's default one. This module creates its own and opens the NFS, SMB or iSCSI rows of AWS's port table (protocols, NFS by default) to the clients you name. The ONTAP CLI and REST API (TCP 22, 443) and SnapMirror (TCP 10000, 11104, 11105) stay closed until you name networks for them. Outbound traffic goes to the VPC's primary CIDR block (or the ranges you name) rather than everywhere. SNMP, Kerberos admin (TCP 749) and ICMP from AWS's table are not opened.

Throughput changes do not replace the file system. The provider replaces a first-generation file system (SINGLE_AZ_1, MULTI_AZ_1) when throughput_capacity_per_ha_pair goes up, but updates throughput_capacity in place. This module writes your value to the field that updates in place for each generation. Second-generation file systems wait six hours between throughput changes, and take 384 or 768 MBps only with one HA pair.

Nothing is kept in state that logs in. The fsxadmin and SVM administrator passwords are not set, so no one can log in to the ONTAP CLI or REST API until you set one outside Terraform:

aws fsx update-file-system --file-system-id <id> \
  --ontap-configuration FsxAdminPassword=<password>

SMB needs the SVM joined to Active Directory, which takes a service account password; join it with aws fsx update-storage-virtual-machine or the console. The module ignores that setting afterwards, so a plan does not undo the join.

Multi-AZ needs your route tables. FSx otherwise updates only the VPC's default route table, and clients in subnets with other route tables lose the file system at failover. Without endpoint_ip_address_range, FSx picks a 198.19.x.0/24 range, which WorkSpaces and AppStream 2.0 also use for their management interfaces.

Some changes replace things. deployment_type, subnet_ids, kms_key_arn, endpoint_ip_address_range and additional_security_group_ids replace the file system. name and root_volume_security_style replace the SVM and therefore every volume in it. Renaming a volume or changing its volume_style replaces that volume. Each replaced volume leaves a final backup unless skip_final_backup is set.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.