# Amazon S3 Files File System Creates an Amazon S3 Files file system on a general purpose bucket, with its IAM role, mount targets, access points, file system policy and synchronization configuration. The bucket must have versioning enabled. > [!IMPORTANT] > Pass the versioning resource's own status to `bucket_versioning_status`, as in > `aws_s3_bucket_versioning.this.versioning_configuration[0].status`. That reference is what makes the > file system wait for versioning on create, and be deleted before versioning is suspended on destroy. > A literal `"Enabled"` passes the check and leaves no such ordering, so a destroy can fail with > `BucketHasS3FileSystemAttached`. This applies only when calling this module directly. The root > module's `file_systems` input passes the reference for you. ```hcl module "file_system" { source = "terraform-aws-modules/s3-bucket/aws//modules/file-system" name = "training" bucket_arn = aws_s3_bucket.this.arn bucket_versioning_status = aws_s3_bucket_versioning.this.versioning_configuration[0].status security_group_vpc_id = "vpc-1234556abcdef" security_group_ingress_rules = { clients = { referenced_security_group_id = "sg-1234556abcdef" } } mount_targets = { "eu-west-1a" = { subnet_id = "subnet-1234556abcdef" } } } ``` When the bucket is created by the root module, use its `file_systems` input instead, which calls this module for each entry. ## Requirements | Name | Version | | ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.5.7 | | [aws](#requirement\_aws) | >= 6.44 | ## Providers | Name | Version | | ---- | ------- | | [aws](#provider\_aws) | >= 6.44 | ## Modules No modules. ## Resources | Name | Type | | ---- | ---- | | [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_s3files_access_point.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3files_access_point) | resource | | [aws_s3files_file_system.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3files_file_system) | resource | | [aws_s3files_file_system_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3files_file_system_policy) | resource | | [aws_s3files_mount_target.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3files_mount_target) | resource | | [aws_s3files_synchronization_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3files_synchronization_configuration) | resource | | [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | | [aws_vpc_security_group_egress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource | | [aws_vpc_security_group_ingress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | | [aws_service_principal.elasticfilesystem](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/service_principal) | data source | ## Inputs | Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | [accept\_bucket\_warning](#input\_accept\_bucket\_warning) | Whether to acknowledge the warning AWS raises when the bucket holds enough objects that renaming a prefix is slow | `bool` | `null` | no | | [access\_points](#input\_access\_points) | Map of access points to create on the file system. An access point cannot be edited, so any change replaces it |

map(object({
    name = optional(string) # Will fall back to map key
    tags = optional(map(string))

    posix_user = optional(object({
      gid            = number
      uid            = number
      secondary_gids = optional(list(number))
    }))
    root_directory = optional(object({
      path = optional(string)
      creation_permissions = optional(object({
        owner_gid   = number
        owner_uid   = number
        permissions = string
      }))
    }))

    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
    }))

    # A principal listed here is denied every other way into this file system, including mounting without an access point
    read_access_arns       = optional(list(string))
    read_write_access_arns = optional(list(string))
  }))

| `{}` | no | | [bucket\_arn](#input\_bucket\_arn) | ARN of the general purpose bucket the file system is created on | `string` | n/a | yes | | [bucket\_versioning\_status](#input\_bucket\_versioning\_status) | Versioning status of the bucket, which must be `Enabled`. Pass the versioning resource's own attribute, which makes the file system wait for versioning on create and be deleted before it is suspended on destroy | `string` | n/a | yes | | [create](#input\_create) | Whether to create the file system and its associated resources | `bool` | `true` | no | | [create\_iam\_role](#input\_create\_iam\_role) | Whether to create an IAM role for the file system | `bool` | `true` | no | | [create\_policy](#input\_create\_policy) | Whether to create a file system policy. Required for the access point `read_access_arns` and `read_write_access_arns` grants to take effect | `bool` | `false` | no | | [create\_security\_group](#input\_create\_security\_group) | Whether to create a security group for the mount targets. The group is created even when `security_groups` is set, so set this to `false` to use only the groups you supply | `bool` | `true` | no | | [iam\_role\_arn](#input\_iam\_role\_arn) | ARN of an existing IAM role for the file system to assume. Used when `create_iam_role` is `false` | `string` | `null` | no | | [iam\_role\_description](#input\_iam\_role\_description) | Description of the IAM role created | `string` | `null` | no | | [iam\_role\_kms\_key\_arns](#input\_iam\_role\_kms\_key\_arns) | KMS key ARNs the role may use with S3 Files. Defaults to every key in this account and Region, which is the scope AWS's own policy template uses | `list(string)` | `null` | no | | [iam\_role\_name](#input\_iam\_role\_name) | Name of the IAM role created. Falls back to the file system name suffixed with `-s3files` | `string` | `null` | no | | [iam\_role\_override\_assume\_policy\_documents](#input\_iam\_role\_override\_assume\_policy\_documents) | List of IAM policy documents that are merged together into the role's trust policy. In merging, statements with non-blank `sid`s will override statements with the same `sid` | `list(string)` | `[]` | no | | [iam\_role\_override\_policy\_documents](#input\_iam\_role\_override\_policy\_documents) | List of IAM policy documents that are merged together into the role's permissions policy. In merging, statements with non-blank `sid`s will override statements with the same `sid` | `list(string)` | `[]` | no | | [iam\_role\_path](#input\_iam\_role\_path) | Path of the IAM role created | `string` | `null` | no | | [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IAM role created | `string` | `null` | no | | [iam\_role\_policies](#input\_iam\_role\_policies) | Policies to attach to the IAM role this module creates, keyed by a name of your choosing, valued by the policy ARN. Ignored when `create_iam_role` is `false`, since a role brought in must already carry its permissions | `map(string)` | `{}` | no | | [iam\_role\_policy\_name](#input\_iam\_role\_policy\_name) | Name of the role's inline permissions policy. Falls back to the role's own name | `string` | `null` | no | | [iam\_role\_source\_assume\_policy\_documents](#input\_iam\_role\_source\_assume\_policy\_documents) | List of IAM policy documents that are merged together into the role's trust policy. Statements must have unique `sid`s | `list(string)` | `[]` | no | | [iam\_role\_source\_policy\_documents](#input\_iam\_role\_source\_policy\_documents) | List of IAM policy documents that are merged together into the role's permissions policy. Statements must have unique `sid`s | `list(string)` | `[]` | no | | [iam\_role\_tags](#input\_iam\_role\_tags) | Additional tags for the IAM role created | `map(string)` | `null` | no | | [iam\_role\_use\_name\_prefix](#input\_iam\_role\_use\_name\_prefix) | Whether to use the IAM role name as a prefix | `bool` | `true` | no | | [kms\_key\_id](#input\_kms\_key\_id) | ARN of the KMS key used to encrypt the file system. A key ID or alias is rejected by the provider. An AWS owned key is used when not set | `string` | `null` | no | | [mount\_targets](#input\_mount\_targets) | Map of mount targets to create for the file system, keyed by a value known at plan time such as the Availability Zone. One per Availability Zone at most |

map(object({
    subnet_id       = string
    ip_address_type = optional(string)
    ipv4_address    = optional(string)
    ipv6_address    = optional(string)
    security_groups = optional(list(string), [])
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      update = optional(string)
    }))
  }))

| `{}` | no | | [name](#input\_name) | Name of the file system, used for the `Name` tag and as the prefix of any names this module generates | `string` | `null` | no | | [override\_policy\_documents](#input\_override\_policy\_documents) | List of IAM policy documents that are merged together into the file system policy. In merging, statements with non-blank `sid`s will override statements with the same `sid` | `list(string)` | `[]` | no | | [policy\_statements](#input\_policy\_statements) | List of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) to add to the file system policy |

list(object({
    sid           = optional(string)
    actions       = optional(list(string))
    not_actions   = optional(list(string))
    effect        = optional(string)
    resources     = optional(list(string))
    not_resources = optional(list(string))
    principals = optional(list(object({
      type        = string
      identifiers = list(string)
    })))
    not_principals = optional(list(object({
      type        = string
      identifiers = list(string)
    })))
    conditions = optional(list(object({
      test     = string
      values   = list(string)
      variable = string
    })))
  }))

map(object({
    name = optional(string)

    cidr_ipv4                    = optional(string)
    cidr_ipv6                    = optional(string)
    description                  = optional(string)
    from_port                    = optional(number)
    ip_protocol                  = string
    prefix_list_id               = optional(string)
    referenced_security_group_id = optional(string)
    tags                         = optional(map(string))
    to_port                      = optional(number)
  }))

| `{}` | no | | [security\_group\_ingress\_rules](#input\_security\_group\_ingress\_rules) | Map of ingress rules to add to the security group. Clients reach a mount target over TCP 2049 |

map(object({
    name = optional(string)

    cidr_ipv4                    = optional(string)
    cidr_ipv6                    = optional(string)
    description                  = optional(string)
    from_port                    = optional(number, 2049)
    ip_protocol                  = optional(string, "tcp")
    prefix_list_id               = optional(string)
    referenced_security_group_id = optional(string)
    tags                         = optional(map(string))
    to_port                      = optional(number, 2049)
  }))

| `{}` | no | | [security\_group\_name](#input\_security\_group\_name) | Name of the security group created. Falls back to the file system name suffixed with `-s3files` | `string` | `null` | no | | [security\_group\_tags](#input\_security\_group\_tags) | Additional tags for the security group created | `map(string)` | `null` | no | | [security\_group\_use\_name\_prefix](#input\_security\_group\_use\_name\_prefix) | Whether to use the security group name as a prefix | `bool` | `true` | no | | [security\_group\_vpc\_id](#input\_security\_group\_vpc\_id) | ID of the VPC the security group is created in | `string` | `null` | no | | [security\_groups](#input\_security\_groups) | Security groups added to every mount target, alongside the group this module creates | `list(string)` | `[]` | no | | [source\_policy\_documents](#input\_source\_policy\_documents) | List of IAM policy documents that are merged together into the file system policy. Statements must have unique `sid`s | `list(string)` | `[]` | no | | [synchronization\_configuration](#input\_synchronization\_configuration) | Synchronization configuration for the file system |

object({
    import_data_rule = list(object({
      prefix         = string
      size_less_than = number
      trigger        = string
    }))
    # Required: the API takes exactly one expiration rule with every synchronization configuration
    expiration_data_rule = object({
      days_after_last_access = number
    })
  })

| `null` | no | | [tags](#input\_tags) | Key-value map of resource tags | `map(string)` | `{}` | no | | [timeouts](#input\_timeouts) | Create and delete timeouts for the file system |

object({
    create = optional(string)
    delete = optional(string)
  })

| `null` | no | ## Outputs | Name | Description | | ---- | ----------- | | [access\_points](#output\_access\_points) | Map of access points created and their attributes | | [arn](#output\_arn) | ARN of the file system | | [iam\_role\_arn](#output\_iam\_role\_arn) | ARN of the IAM role the file system assumes, whether created here or supplied by the caller | | [iam\_role\_name](#output\_iam\_role\_name) | Name of the IAM role created | | [iam\_role\_unique\_id](#output\_iam\_role\_unique\_id) | Unique ID of the IAM role created | | [id](#output\_id) | ID of the file system | | [mount\_targets](#output\_mount\_targets) | Map of mount targets created and their attributes | | [name](#output\_name) | Name of the file system | | [security\_group\_arn](#output\_security\_group\_arn) | ARN of the security group created | | [security\_group\_id](#output\_security\_group\_id) | ID of the security group created | | [status](#output\_status) | Status of the file system |

Inputs

Set by controls 5

Optional 73