OpenZFS File Storage That Is Not Exported to Every Client
Amazon FSx for OpenZFS. With no export set, AWS shares the root volume read-write to every client the network admits, and the Terraform provider turns automatic backups off where AWS keeps 30 days. This module writes the export to named networks, refuses a wildcard and no_root_squash, keeps 30 days of backups, opens the NFS ports AWS lists and requires route tables for Multi-AZ.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-16 · how we verify
Use it from the registry
terraform · opentofumodule "fsx_openzfs" {
source = "www.iac-bazaar.com/iac-bazaar/aws-fsx-openzfs/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-fsx-openzfs
Amazon FSx for OpenZFS. Works with Terraform and OpenTofu (>= 1.6), aws
provider >= 6.0, < 7.0.
AWS exports the root volume to everyone by default. With no export
configured the root volume is shared to * with rw, so every client the
security group admits can read and write. This module always writes the export:
to allowed_cidr_blocks, or to the VPC's own CIDR ranges when access is granted
by security group. It refuses a wildcard and no_root_squash.
Backups are off unless you set them, in Terraform. AWS keeps automatic backups for 30 days by default, but the provider's default is 0, which turns them off. This module sets 30, and keeps the final backup FSx takes when the file system is deleted.
NFS needs more than port 2049. The security group opens TCP and UDP 111, 2049 and 20001 to 20003, which AWS lists as required.
Multi-AZ needs your route tables. For MULTI_AZ_1, FSx only updates the
route tables you name, and by default only the VPC's default one, so clients
elsewhere cannot reach the file system. The module requires route_table_ids
for that type.
Some changes replace the file system, which means restoring from a backup:
deployment_type, subnet_ids, kms_key_arn, endpoint_ip_address_range, and
additional_security_group_ids. The Single-AZ HA types are only offered in some
Regions.
Child volumes block destroy. A delete fails while child volumes exist
below the root volume, and this module does not pass the option that deletes
them with the file system.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-datasync
preserve_deleted_files = REMOVE deletes files at the DESTINATION that are absent from the source, so an unmounted share or a renamed path empties the destination on schedule and the task reports success. PRESERVE here, with verification on, a bandwidth ceiling so it cannot take the whole Direct Connect, and a per-file report of what failed.
aws-s3-bucket
Private S3 bucket with encryption, versioning, public-access block, and TLS-only policy.
aws-backup
A vault, its plans and what they protect, with the service role that can restore as well as back up. Vault Lock is stated rather than defaulted: COMPLIANCE mode cannot be removed by anybody once its window elapses, which is the point and is irreversible.
aws-efs
An EFS file system with mount targets, a least-privilege NFS security group, lifecycle tiering, automatic backups, and a resource policy that enforces encryption in transit.
aws-ebs-volume
Volumes that are always encrypted, optional attachment, and a DLM snapshot schedule in the same module - because a volume with no schedule is one copy of your data on hardware that can fail, and leaving snapshots to somebody else usually means nobody.
aws-fsx-lustre
A Lustre file system with the S3 link, root squash and compression set deliberately. SCRATCH deployments are not replicated - a lost file server loses the data - so this defaults to PERSISTENT_2 and refuses the combinations FSx accepts quietly.