# terraform-efs

## Overview

> [!WARNING]
> Breaking changes! Starting with version 4.0.0, the Route 53 zone ID is automatically selected based on the environment.
> The `route53_zone_id` variable has been removed. See [Route 53 Records](#route-53-records) for more information.

> [!WARNING]
> Breaking changes! Starting with version 3.0.0, the module has been refactored to use a second provider for DNS record creation. This provider should be defined in the same directory as the module and should use the `networking` profile. See [Providers](#providers) for more information.

This module creates efs, mount point target, directory access point, file system policy, and file system iam policy

## General Usage

```
# Create efs file system.
module "ows_efs_environment" {
  source                   = "git@github.com:theorchard/terraform-efs.git//?ref=4.0.0"
  
  providers = {
    aws.dns = aws.networking
  }
  
  environment              = var.environment
  service_name             = var.service_name
  application_family       = var.application_family
  vpc_id                   = data.aws_vpc.vpc.id
  subnet_ids               = data.aws_subnets.private.ids
  zone_id                  = "Z2RSKZ9M7TJ9Z"
  owner_gid                = "1010"
  owner_uid                = "1010"
  access_point_permissions = "755"

  # Allow CIDR block access to EFS.
  efs_ingress_additional_cidr_blocks = [
    "10.40.0.0/22",
  ]
}
```

## Usage with fargate environment

```
provider "aws" {
  region = var.aws_region
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/ows-tan/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# As usual in ows-service main.tf
module "ows_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.2.0"
  
  providers = {
    aws.dns = aws.networking
  }
...
}

# This rule will add fargate security group to efs security group ingress rule so fargate task can access efs mount.
resource "aws_security_group_rule" "allow_efs_sg_inbound" {
  from_port                = 2049
  protocol                 = "tcp"
  security_group_id        = module.ows_efs_environment.efs_security_group_id_output
  source_security_group_id = module.ows_fargate_environment.fargate_security_group_id
  to_port                  = 2049
  type                     = "ingress"
 }

# Create efs file system.
module "ows_efs_environment" {
  source                   = "git@github.com:theorchard/terraform-efs.git//?ref=4.0.0"
  
  providers = {
    aws.dns = aws.networking
  }
  
  environment              = var.environment
  service_name             = var.service_name
  application_family       = var.application_family
  vpc_id                   = data.aws_vpc.vpc.id
  subnet_ids               = data.aws_subnets.private.ids
  zone_id                  = "Z2RSKZ9M7TJ9Z"
  owner_gid                = "1010"
  owner_uid                = "1010"
  access_point_permissions = "755"

  # Allow CIDR block access to EFS.
  efs_ingress_additional_cidr_blocks = [
    "192.168.32.0/24",
  ]
}
```

### Providers

The module requires an explicitly defined second AWS provider which specifies where Route 53 records will be created.

If you are creating Route 53 records in the same account (e.g. in dev), you can simply alias the default provider as `dns` as follows:

```hcl
provider "aws" {
  region = var.aws_region
}

module "ows_efs_environment" {
  source = "git@github.com:theorchard/terraform-efs.git//?ref=x.x.x"

  providers = {
    aws.dns = aws
  }
  
  // other settings
}
```

If you are creating Route 53 records in a different account (e.g. `theorchard.io`), you will need to define a second provider with the appropriate credentials:

```hcl
provider "aws" {
  region  = var.aws_region
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"
}

module "ows_efs_environment" {
  source = "git@github.com:theorchard/terraform-efs.git//?ref=x.x.x"

  providers = {
    aws.dns = aws.networking
  }
  
  // other settings
}
```

### Route 53 Records

The module manages Route 53 records for the cluster by default. This can be disabled by setting the `route53_record_creation_enabled` variable to false.

The Route 53 Zone ID is automatically selected based on the environment. If `environment` is dev, the zone ID defaults to that of the `dev.theorchard.io` domain. Otherwise, the zone ID defaults to that of the `theorchard.io` domain.

If you require a different zone to the default selection, you can specify it using the `override_route53_zone_id` variable instead.

The Route 53 records are created in the AWS account specified by the `dns` provider. See [Providers](#providers) for more information.