Skip to content

Deploy a production AWS cluster

When you finish, a six-node Qumulo cluster spans three availability zones and follows your organization's encryption and IAM rules.

Before you start

1. Copy the configuration

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  aws {}
}

resource "qumulo_filesystem_aws" "cluster" {
  cluster_name    = "qumulo-prod"
  deployment_name = "qumulo-prod"
  region          = "us-east-1" # <-- Replace with your region
  subnet_ids = [
    "subnet-0aaaaaaaaaaaaaaaa", # <-- Replace with a subnet in your first availability zone
    "subnet-0bbbbbbbbbbbbbbbb", # <-- Replace with a subnet in your second availability zone
    "subnet-0cccccccccccccccc", # <-- Replace with a subnet in your third availability zone
  ]
  node_count             = 6
  instance_type          = "m6idn.4xlarge"
  soft_capacity_limit_tb = 3000
  cluster_product_type   = "HOT"
  admin_password         = "YourSecurePassword123!" # <-- Replace with your admin password
  allow_cidrs            = ["10.0.0.0/8"]           # <-- Replace with your client networks
  ec2_key_pair           = "my-prod-keypair"        # <-- Replace with your EC2 key pair name
  deletion_protection    = true

  tags = {
    Environment = "Production"
    ManagedBy   = "Terraform"
  }
}

output "endpoint_ips" {
  value = qumulo_filesystem_aws.cluster.endpoint_ips
}

output "web_ui" {
  value = "https://${qumulo_filesystem_aws.cluster.endpoint_ips[0]}"
}

Replace the seven values marked <-- Replace, and leave the rest as written. To size the cluster differently, check the capacity each node supports in AWS instance types.

2. Enable KMS encryption

If your organization requires a customer-managed key, add this line to the qumulo_filesystem_aws block.

kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab" # <-- Replace with your key ARN

The key must live in the cluster's region and allow the KMS actions the cluster roles need. The plan in step 4 shows kms_key_id set to your key ARN.

Warning

kms_key_id cannot change after the cluster exists. Add it before the first apply or not at all.

3. Apply a permissions boundary

If your organization requires a permissions boundary on every IAM role, add this line to the same block.

permissions_boundary_arn = "arn:aws:iam::123456789012:policy/qumulo-boundary" # <-- Replace with your boundary policy ARN

The provider attaches the boundary to both roles it creates, so the boundary must allow what those roles need. The plan in step 4 shows permissions_boundary_arn set to your policy ARN.

4. Apply

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 1 to add, 0 to change, 0 to destroy. The apply typically runs 60 to 80 minutes and ends with Apply complete! Resources: 1 added, 0 changed, 0 destroyed., followed by the endpoint_ips and web_ui outputs.

5. Check the cluster

Open the web_ui address in a browser on a network inside allow_cidrs, and accept the cluster's self-signed certificate. Sign in as admin with the password you set, and the web UI shows the cluster named qumulo-prod.

Next

Give clients one endpoint that survives a zone outage with Put a Network Load Balancer in front of a multi-AZ AWS cluster, since a multi-AZ cluster has no floating IPs. The qumulo_filesystem_aws reference lists every attribute.