SMB Shares Example

This example demonstrates how to manage SMB shares on an existing Qumulo cluster.

Features

• Basic read-only share for public access
• Secure share with access-based enumeration and encryption
• Department shares using for_each for scalable management
• Network-based permission restrictions

Prerequisites

1. An existing Qumulo cluster with REST API access
2. Admin credentials for the cluster
3. Network connectivity to the cluster endpoint

Usage

1. Initialize, plan, and apply with your cluster variables:

   terraform init -upgrade
   terraform plan \
     -var="cluster_endpoint=https://your-cluster:8000" \
     -var="cluster_password=your-password"
   terraform apply \
     -var="cluster_endpoint=https://your-cluster:8000" \
     -var="cluster_password=your-password"
   

Or create a terraform.tfvars file with your values and run terraform apply without -var flags.

Configuration

Variables

Name	Description	Type	Required
cluster_endpoint	Qumulo cluster REST API endpoint	string	Yes
cluster_username	Cluster admin username	string	No (default: admin)
cluster_password	Cluster admin password	string	Yes
departments	Map of department share configs	map(object)	No

Outputs

Name	Description
public_share_id	ID of the public data share
secure_share_id	ID of the secure data share
department_share_ids	Map of department names to share IDs

Security Considerations

• Store cluster_password in a secure location (environment variable, secrets manager)
• Use network permissions to restrict access by IP range
• Enable require_encryption for sensitive data shares
• Use access_based_enumeration_enabled to hide files users can't access

Full Configuration

# Example: Managing SMB Shares on a Qumulo Cluster
#
# This example demonstrates how to create and manage SMB shares
# on an existing Qumulo cluster using the qumulo_smb_share resource.

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

variable "cluster_endpoint" {
  description = "Qumulo cluster REST API endpoint (e.g., https://cluster:8000)"
  type        = string
}

variable "cluster_username" {
  description = "Qumulo cluster admin username"
  type        = string
  default     = "admin"
}

variable "cluster_password" {
  description = "Qumulo cluster admin password"
  type        = string
  sensitive   = true
}

# Define connection profile for the cluster
provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = var.cluster_endpoint
      username             = var.cluster_username
      password             = var.cluster_password
      insecure_skip_verify = true # Required for clusters with self-signed certificates
    }
  ]
}

# Basic read-only share for everyone
resource "qumulo_smb_share" "public_data" {
  connection_profile = "cluster1"

  share_name  = "public-data"
  fs_path     = "/public"
  description = "Public read-only data share"

  permission {
    type = "ALLOWED"
    trustee {
      name = "Everyone"
    }
    rights = ["READ"]
  }
}

# Secure share with access-based enumeration
resource "qumulo_smb_share" "secure_data" {
  connection_profile = "cluster1"

  share_name  = "secure-data"
  fs_path     = "/secure"
  description = "Secure data share with restricted access"

  access_based_enumeration_enabled = true
  require_encryption               = true

  permission {
    type = "ALLOWED"
    trustee {
      name = "DataAdmins"
    }
    rights = ["READ", "MODIFY", "WRITE_ACL"]
  }

  permission {
    type = "ALLOWED"
    trustee {
      name = "DataUsers"
    }
    rights = ["READ", "MODIFY"]
  }

  network_permission {
    type           = "ALLOWED"
    address_ranges = ["10.0.0.0/8"]
    rights         = ["READ", "MODIFY"]
  }
}

# Department shares using for_each
variable "departments" {
  description = "Map of department names to their share configuration"
  type = map(object({
    path   = string
    rights = list(string)
  }))
  default = {
    engineering = {
      path   = "/departments/engineering"
      rights = ["READ", "MODIFY"]
    }
    marketing = {
      path   = "/departments/marketing"
      rights = ["READ"]
    }
    finance = {
      path   = "/departments/finance"
      rights = ["READ", "MODIFY"]
    }
  }
}

resource "qumulo_smb_share" "departments" {
  for_each = var.departments

  connection_profile = "cluster1"

  share_name  = each.key
  fs_path     = each.value.path
  description = "Department share for ${each.key}"

  permission {
    type = "ALLOWED"
    trustee {
      name = "${title(each.key)}Users"
    }
    rights = each.value.rights
  }
}

# Outputs
output "public_share_id" {
  description = "ID of the public data share"
  value       = qumulo_smb_share.public_data.id
}

output "secure_share_id" {
  description = "ID of the secure data share"
  value       = qumulo_smb_share.secure_data.id
}

output "department_share_ids" {
  description = "Map of department names to share IDs"
  value       = { for k, v in qumulo_smb_share.departments : k => v.id }
}