Import IDs and attributes

This page lists the import ID of every importable resource, and the attributes each cluster resource needs in HCL after an import. The steps are in Import an existing cluster.

Import ID formats

Cloud filesystem IDs are slash-separated. Bare metal and cluster resource IDs are comma-separated and start with a connection profile name from the provider block.

Resource	Import ID	Example
qumulo_filesystem_aws	region/deployment_unique_name	us-east-1/qumulo-a1b2c3
qumulo_filesystem_azure	subscription_id/resource_group_name/deployment_unique_name	00000000-0000-0000-0000-000000000000/rg-qumulo/qumulo-a1b2c3
qumulo_filesystem_gcp	project_id/region/deployment_unique_name	my-project/us-central1/qumulo-a1b2c3
qumulo_filesystem_baremetal	profile	baremetal
qumulo_filesystem_edge_baremetal	profile	edge
qumulo_ad	profile	prod
qumulo_audit_cloudwatch	profile	prod
qumulo_audit_syslog	profile	prod
qumulo_cluster_settings	profile	prod
qumulo_cluster_ssl	profile	prod
qumulo_directory_quota	profile,directory_path	prod,/data/users
qumulo_file_system_settings	profile	prod
qumulo_ftp_settings	profile	prod
qumulo_ldap_settings	profile	prod
qumulo_local_group	profile,group_name	prod,developers
qumulo_local_group_member	profile,group_id,user_id	prod,501,1001
qumulo_local_user	profile,username	prod,alice
qumulo_nfs_export	profile,export_path	prod,/data
qumulo_nfs_settings	profile	prod
qumulo_portal	spoke_profile,hub_profile,spoke_id,hub_id	spoke,hub,123,456
qumulo_portal_hub	profile,portal_id	hub,456
qumulo_portal_hub_root	profile,hub_id,root_id	hub,21,12345
qumulo_portal_root	portal_id,local_root,spoke_root_path,hub_root_path	qpv1.<payload>,891872330,/data,/shared
qumulo_portal_spoke	profile,spoke_id	prod,123
qumulo_portal_spoke_root	profile,spoke_id,local_root,spoke_root_path,hub_root_path	prod,1,891872330,/cache/data,/data
qumulo_replication_object_relationship	profile,id	prod,obj-789
qumulo_replication_source_relationship	profile,id	prod,rel-123
qumulo_replication_target_relationship	profile,id	dr,rel-123
qumulo_role	profile,role_name	prod,BackupOperators
qumulo_role_member	profile,role_name,domain,auth_id	prod,BackupOperators,LOCAL,1001
qumulo_s3_access_key	profile,access_key_id	prod,AKIAIOSFODNN7EXAMPLE
qumulo_s3_bucket	profile,bucket_name	prod,my-bucket
qumulo_s3_bucket_policy	profile,bucket_name	prod,my-bucket
qumulo_s3_settings	profile	prod
qumulo_saml_settings	profile	prod
qumulo_smb_settings	profile	prod
qumulo_smb_share	profile,share_name	prod,my-share
qumulo_snapshot_policy	profile,policy_id	prod,123
qumulo_time_configuration	profile	prod
qumulo_web_ui_settings	profile	prod

The portal_id in a qumulo_portal_root ID is the opaque qpv1.-prefixed id of a qumulo_portal resource.

Resources that cannot be imported

qumulo_threat_detection_aws, qumulo_threat_detection_azure, qumulo_threat_detection_gcp, qumulo_neuralsearch_aws, qumulo_neuralsearch_azure, and qumulo_neuralsearch_gcp do not support terraform import. Terraform manages one of these appliances only when Terraform created it.

AWS attributes required in HCL

qumulo_filesystem_aws rejects a plan without these attributes. Recovered values can be copied from terraform state show.

Attribute	Recovered on import	Notes
cluster_name and deployment_name, or name	No	2 to 15 characters each. deployment_name is the bare name, without the suffix in deployment_unique_name.
region	Yes	From the import ID
node_count	Yes
instance_type	Yes
subnet_ids	Yes
cluster_product_type	No	HOT or COLD. Immutable.
storage_class	No	Recorded permanently by the first apply. Omitted, it records INTELLIGENT_TIERING for HOT and GLACIER_IR for COLD. The class of any object in a -qps- bucket is the value to declare.
admin_password	No	Write-only
allow_cidrs	Yes	From the cluster security group's ingress rule. Omit it when cluster_security_group_id and provisioner_security_group_id are set.

AWS customer-declared attributes

Attribute	Notes
soft_capacity_limit_tb	Not recovered. A mismatch causes drift on every apply.
networking_mode	host_managed or qumulo_managed. Immutable. Clusters built by aws-terraform-cnq use qumulo_managed.
floating_ip_count	The cluster's IPv4 floating IP count, 0 if none. Must be 0 in the qumulo_managed networking mode. The live addresses appear in the read-only floating_ips attribute.
floating_ip_count_ipv6	The size of an IPv6 floating pool, with floating_ip_count = 0. The two counts cannot both be non-zero. A plan that moves the pool to the other address family is refused.
provisioner_ami_id	Set only for a non-default provisioner AMI.
cluster_iam_role_arn	Recovered from the node instances when they run on a role other than the provider-managed one. After the import, copy the recovered value from terraform state show into the configuration. Omitted, the recovered value stays, but a later cluster replacement rebuilds on the provider-managed role. Any other value is rejected at plan time. Cannot change after adoption.
provisioner_iam_role_arn	Not recovered. Declare the bring-your-own provisioner role so the next operation launches the provisioner on it. Omitted, the provider creates and uses its own provisioner role. Cannot change once set.
ec2_key_pair, kms_key_id, permissions_boundary_arn	Set only when the deployment uses them.
cluster_uuid	Optional. The UUID from qq node_state_get or GET /v1/node/state, for when automatic recovery fails. Rejected on a plan that creates or replaces the cluster. Cannot change after adoption. A different UUID than the one in state replaces a qumulo_threat_detection_aws or qumulo_neuralsearch_aws appliance that references the cluster, once.

AWS import permissions

Beyond the AWS IAM permissions every cluster needs, the import and adoption flow uses these actions. Without them, the first refresh after import warns that it could not verify deletion protection, and the first apply fails.

Action	Used for
tag:TagResources	Tagging buckets that predate the Qumulo-Cluster tag
s3:ListAllMyBuckets	Listing buckets during adoption
ssm:GetParametersByPath	Removing the SSM parameters aws-terraform-cnq created, on destroy
secretsmanager:DeleteSecret	Removing the cluster secret aws-terraform-cnq created, on destroy
iam:GetInstanceProfile on the node instance profile	Recovering cluster_iam_role_arn on every refresh. Without it, a refresh of a cluster whose state does not yet record the node role fails and names this action

Azure attributes required in HCL

qumulo_filesystem_azure rejects a plan without these attributes. Recovered values can be copied from terraform state show.

Attribute	Recovered on import	Notes
cluster_name and deployment_name, or name	No	2 to 15 characters each. deployment_name is the bare name, without the suffix.
resource_group_name	Yes	From the import ID
node_count	Yes
vm_type	Yes
location	Yes
subnet_id	Yes	Full subnet resource ID
admin_password	No	Write-only
allow_cidrs	Yes	From the cluster NSG's inbound rule

storage_replication_type is optional and recovered from the SKU of the cluster's storage accounts. On a legacy cluster it is corrected on the first refresh after key_vault_id is applied.

Azure customer-declared attributes

Attribute	Notes
cluster_version	Set only if the original configuration pinned it.
networking_mode	host_managed or qumulo_managed. Immutable. Clusters built by azure-terraform-cnq use qumulo_managed.
floating_ip_count	The cluster's floating IP count, 0 if none. Resolves to 0 when unset, and applying a wrong 0 removes the cluster's floating IPs. The live addresses appear in the read-only floating_ips attribute.
service_account_email	Recovered from the node instances. Omit it, or set it to exactly that email. Any other value is rejected at plan time. Cannot change after adoption.
storage_class	Omitted, the first apply records INTELLIGENT_TIERING for HOT on Core 7.8.4 or later, STANDARD for HOT on older Core, and STANDARD for COLD. A storage account access tier of Smart means INTELLIGENT_TIERING, and Hot means STANDARD. Immutable once recorded.
soft_capacity_limit_tb	Not recovered. A mismatch causes drift on every apply.
key_vault_id	Required for a cluster this provider did not create. The provider reads the cluster's storage accounts from the vault's managed storage account registrations.
availability_zones	Recovered from the node VMs. Any value other than the zones the nodes use replaces every node VM in service on the first apply.
cluster_node_identity_id	Recovered from the node VMs. After the import, copy the recovered value from terraform state show into the configuration. Omitted, the recovered value stays, but a later cluster replacement rebuilds on a system-assigned identity. Any other value is rejected at plan time. Cannot change after adoption. Leave it unset for nodes on system-assigned identities.
provisioner_identity_id	Not recovered. For a legacy cluster that set provisioner_node_identity, declare that identity's resource ID so the next operation builds the provisioner VM on it. Omitted, the provisioner runs on a system-assigned identity and the provider must be able to create its role assignments. Cannot change once set.
custom_image_id, marketplace_image	Not recovered. Setting either replaces every node VM in service on the first apply.
cluster_uuid	Optional. The UUID from qq node_state_get or GET /v1/node/state, for when automatic recovery fails. Rejected on a plan that creates or replaces the cluster. Cannot change after adoption. A different UUID than the one in state replaces a qumulo_threat_detection_azure or qumulo_neuralsearch_azure appliance that references the cluster, once.

GCP attributes required in HCL

qumulo_filesystem_gcp rejects a plan without these attributes. Recovered values can be copied from terraform state show.

Attribute	Recovered on import	Notes
cluster_name and deployment_name, or name	No	2 to 15 characters each. deployment_name is the bare name, without the suffix.
node_count	Yes
instance_type	Yes
subnetwork	Yes	Short name
admin_password	No	Write-only
allow_cidrs	Yes	From the external firewall rule's source ranges

project_id and region come from the import ID, and fall back to the provider's gcp block in HCL.

GCP customer-declared attributes

Attribute	Notes
cluster_version	Set only if the original configuration pinned it.
soft_capacity_limit_tb	Not recovered. Defaults to 500. A mismatch causes drift on every apply.
cluster_product_type	HOT, or unset, which means HOT. COLD cannot be declared on an imported cluster. Declaring HOT plans a one-time in-place update with no cloud changes.
networking_mode	host_managed or qumulo_managed. Immutable. Clusters built by qumulo-terraform-gcp use host_managed.
floating_ip_count	The cluster's floating IP count, 0 if none. Resolves to 0 when unset, and applying a wrong 0 removes the cluster's floating IPs. The live addresses appear in the read-only floating_ips attribute.
node_image, provisioner_image	Set only if the original configuration pinned an image. Import recovers the image family pair, so a pinned image shows a diff until reconciled.
cluster_uuid	Optional. The UUID from qq node_state_get or GET /v1/node/state, for when the nodes lack the recovery label. Rejected on a plan that creates or replaces the cluster. Cannot change after adoption. A different UUID than the one in state replaces a qumulo_threat_detection_gcp or qumulo_neuralsearch_gcp appliance that references the cluster, once.

Bare metal attributes not recovered

Resource	Not recovered on import
qumulo_filesystem_baremetal	cluster_name, admin_password, cluster_version, blocks_per_stripe, max_drive_failures, max_node_failures
qumulo_filesystem_edge_baremetal	cluster_name, admin_password, cluster_version

Each listed attribute shows a diff on every plan unless it is in lifecycle { ignore_changes }.

Cluster resource attributes to declare

These singletons need more than connection_profile in HCL before the first plan.

Resource	Also declare
qumulo_cluster_settings	cluster_name, the live cluster name. A mismatch plans a rename.
qumulo_ldap_settings	use_ldap, bind_uri, base_distinguished_names, ldap_schema, and the write-only bind password
qumulo_audit_syslog	enabled, plus server_address when enabled
qumulo_audit_cloudwatch	enabled, plus log_group_name and region when enabled
qumulo_ad	domain, ad_username, ad_password

These values are never recovered on import.

Resource	Not recovered	Effect
qumulo_ad	ad_username, ad_password	Configured values show as a change on the first plan. Import fails if the cluster is not joined to a domain.
qumulo_cluster_ssl	Certificate and private key	Supply your own PEM material to manage them.
qumulo_local_user	password	Setting it after import pushes a new password.
qumulo_role	None	An omitted privileges defaults to an empty list and plans to remove every live privilege.
qumulo_s3_access_key	secret_access_key	Set to an empty string with a warning.
qumulo_snapshot_policy	source_path	Setting it on an imported policy forces replacement. Use source_file_id.
qumulo_replication_object_relationship	secret_access_key, local_directory_path	Set to empty strings. A configured local_directory_path forces replacement unless it is in ignore_changes.