When trying to set up a aws_efs_replication_configuration between two EFS instances on different accounts, AWS API fails as the RoleARN is not provided. This is due to the provider not allowing to set the ARN of the IAM role in the source account that allows Amazon EFS to perform replication on its behalf. For cross-account replication this is mandatory. Documentation of EFS Replication Destination
│ Error: creating EFS Replication Configuration (fs-xxxxxxxx): BadRequest: No RoleArn provided. RoleArn is required for cross-account replication.
│ {
│ RespMetadata: {
│ StatusCode: 400,
│ RequestID: "<request-id>"
│ },
│ Message_: "No RoleArn provided. RoleArn is required for cross-account replication."
│ }
│
│ with aws_efs_replication_configuration.efs_replication[0],
│ on efs-replication.tf line 1, in resource "aws_efs_replication_configuration" "efs_replication":
│ 1: resource "aws_efs_replication_configuration" "efs_replication" {
│
╵
I'm running provider version 5.32.0 (where support for file_system_id to point to a preexistent EFS on a replication was added) but neither on that version or even the latest (v5.99.0) I'm seeing the attribute for setting this ARN.
aws_efs_replication_configuration
resource "aws_efs_replication_configuration" "efs_replication" {
count = 1
# Source File System of replication
source_file_system_id = aws_efs_file_system.efs-instance.id
# Destination File System of replication on other AWS account
destination {
# Destination File System Region
region = var.replication_destination_file_system_region
# As this is cross account, the ARN of the kms key alias that should be used for encryption.
kms_key_id = var.replication_destination_file_system_encryption_kms_alias
# As this is cross account, the ARN of the file system should be used.
file_system_id = var.replication_destination_file_system_arn
# New attribute that should be added.
role_arn = var.replication_source_file_system_role_arn
}
}
No