Terraform: Dynamically Create AWS EFS Access Points

Question

I am trying to create AWS EFS Access Points dynamically thru terraform.

Firstly, here is the code that I am using:

• module/main.tf

resource "aws_efs_access_point" "this" {
  for_each = { for k, v in var.access_points : k => v if var.create }

  file_system_id = var.aws_efs_file_system_id

  dynamic "posix_user" {
    for_each = try([each.value.posix_user], [])

    content {
      gid            = posix_user.value.gid
      uid            = posix_user.value.uid
      secondary_gids = try(posix_user.value.secondary_gids, null)
    }
  }

  dynamic "root_directory" {
    for_each = try([each.value.root_directory], [])

    content {
      path = try(root_directory.value.path, null)

      dynamic "creation_info" {
        for_each = try([root_directory.value.creation_info], [])

        content {
          owner_gid   = creation_info.value.owner_gid
          owner_uid   = creation_info.value.owner_uid
          permissions = creation_info.value.permissions
        }
      }
    }
  }

  /*tags = merge(
    var.tags,
    try(each.value.tags, {}),
    { Name = try(each.value.name, each.key) },
  )*/
}

• module/variable.tf

variable "create" {
  description = "Determines whether resources will be created (affects all resources)"
  type        = bool
  default     = true
}

variable "access_points" {
  description = "A map of access point definitions to create"
  type        = any
}

variable "aws_efs_file_system_id" {
  description = "ID of Elastic File system to which access points will be associated"
  type        = string
}

/*variable "tags" {
  description = "Tags"
  type        = string
}*/

• root main.tf

module "EFS-ap" {
  source                 = "../modules/xxx/xxx/accessPoints"
  aws_efs_file_system_id = "fs-0bcf0c0xxxx"
  access_points          = {
    posix_user = {
      gid = 1001,
      uid = 1001
    },
    root_directory = {
      creation_info = {
      owner_gid = 1001,
      owner_uid = 1001,
      permissions = 0775
    },
      path : "/hengg/git",
    }
  } 
}

As a result of the above, I could see 3 access points are being created with default path forward slash with no other details populated.

I know I am not passing the values for the variable access_points in the right way which is causing this issue. But unable to figure out the right way.

I basically have to create access points dynamically for multiple root directory paths but right now, I want to make it work for single root directory path first.

I have tried multiple ways to pass the access_points variable values but no luck.

I am expecting my code to create AWS EFS Access Points dynamically.

Answer 1

Your current code here, is just passing a single access point definition directly to the access_points input.

access_points = {
    posix_user = {
      gid = 1001,
      uid = 1001
    },
    root_directory = {
      creation_info = {
      owner_gid = 1001,
      owner_uid = 1001,
      permissions = 0775
    },
    path : "/hengg/git",
    }
  } 

From your code comments, and the actual code in the module, it appears you expect that to be a map of access point definitions. A map of access point definitions would look like this (you have to provide a map key):

access_points = {
  "my_access_point" = {
    posix_user = {
      gid = 1001,
      uid = 1001
    },
    root_directory = {
      creation_info = {
      owner_gid = 1001,
      owner_uid = 1001,
      permissions = 0775
    },
    path : "/hengg/git",
    }
  } 
}

Passing multiple access point definitions would look like this:

access_points = {
  "my_access_point" = {
    posix_user = {
      gid = 1001,
      uid = 1001
    },
    root_directory = {
      creation_info = {
      owner_gid = 1001,
      owner_uid = 1001,
      permissions = 0775
    },
    path : "/hengg/git",
    }
  }

  "another_access_point" = {
    posix_user = {
      gid = 1001,
      uid = 1001
    },
    root_directory = {
      creation_info = {
      owner_gid = 1001,
      owner_uid = 1001,
      permissions = 0775
    },
    path : "/hengg/git",
    }
  }  
}