AWS User-Data Hooks Example

This example wires all four boot-script hooks on qumulo_filesystem_aws. Each hook splices your shell into the provisioner or node boot script at a defined point; Qumulo's cluster-formation logic stays untouched. See the Customizing Cluster Boot guide for the full reference.

What each hook does in this example:

Hook	Runs
provisioner_hooks.pre_run	On the provisioner, before bucket-access validation. Fixes the S3 Gateway bucket policy via a blessed CloudFormation stack, using $cluster_persistent_bucket_names.
provisioner_hooks.post_run	On the provisioner, after the cluster is formed. Reports readiness to a CMDB.
node_hooks.pre_run	On each node, before the first network op. Configures a corporate proxy + CA so all later downloads traverse them.
node_hooks.post_run	On each node, after qumulo-core install. Installs a monitoring agent.

Hooks run as root under set -xe

A failing hook command aborts the deploy, and hook output is logged. Never embed secrets in a hook body: it is stored in Terraform state and appears in logs. Use the instance's IAM role or a secret store.

Configuration

resource "qumulo_filesystem_aws" "hooks_demo" {
  name                = "hooks-demo"
  region              = "us-west-2"
  node_count          = 3
  instance_type       = "m6i.xlarge"
  subnet_ids          = ["subnet-EXAMPLE"]
  admin_password      = var.admin_password
  deletion_protection = true # recommended: guard the cluster's EC2 instances and S3 buckets

  provisioner_hooks = {
    pre_run  = file("${path.module}/hooks/provisioner-pre-run.sh")
    post_run = file("${path.module}/hooks/provisioner-post-run.sh")
  }

  node_hooks = {
    pre_run  = file("${path.module}/hooks/node-pre-run.sh")
    post_run = file("${path.module}/hooks/node-post-run.sh")
  }

  timeouts {
    create = "90m"
    delete = "30m"
  }
}

The full runnable configuration, including the four hook scripts, lives in the provider repo under examples/aws-user-data-hooks/.

Usage

1. Edit main.tf with real subnet_ids, then adjust the hook scripts to your environment: the blessed CloudFormation stack URL, proxy host, CA path, and agent installer.

2. Initialize and deploy:

   export TF_VAR_admin_password='...'
   terraform init
   terraform apply
   

3. Watch hook execution in the boot logs: the provisioner streams /var/log/user-data.log to CloudWatch under /qumulo/<deployment>/provisioner. To inspect the rendered user-data, including your spliced hooks, run aws ec2 describe-instance-attribute --attribute userData.

Notes

• Hooks must be idempotent. The provisioner script re-runs on scale, replace, and config-update operations. Node hooks run on every node at boot, including nodes added later by scaling or replacement.
• Changing only a hook value does not re-run boot on existing instances; it takes effect on the next operation that provisions or re-runs the relevant script.