How to Import an AWS EFS Access Point into Terraform

Import AWS EFS Access Point with Terraback (recommended)

Terraback reverse-engineers your live infrastructure: it reads the Amazon EFS resource with read-only credentials, generates the HCL, and produces the exact import block. Two commands take you from a live AWS EFS Access Point to managed Terraform.

terraback scan all aws --region us-east-1

terraback aws import --method bulk

The Terraform import block

Terraback emits a Terraform 1.5+ import block like the one below. Because the block lives in your configuration, the import is reviewable in a pull request and repeatable across environments.

import {
  to = aws_efs_access_point.app
  id = "fsap-0a1b2c3d4e5f6a7b8"
}

Example aws_efs_access_point configuration

Here is a realistic AWS EFS Access Point block. Terraback generates a fuller version from your actual resource attributes; this is a minimal, valid starting point.

resource "aws_efs_access_point" "app" {
  file_system_id = "fs-0a1b2c3d4e5f6a7b8"

  posix_user {
    uid = 1000
    gid = 1000
  }

  root_directory {
    path = "/app"
    creation_info {
      owner_uid   = 1000
      owner_gid   = 1000
      permissions = "0755"
    }
  }
}

Gotchas when importing a AWS EFS Access Point

• Import by the fsap- access point ID, not the fs- file system ID.
• An access point belongs to a file system; import or declare the parent aws_efs_file_system first and reference it via file_system_id.
• root_directory.path, posix_user, and creation_info are immutable; any mismatch forces a destroy and recreate, so copy them exactly.
• creation_info only applies when the root_directory path does not already exist; if the directory was created out of band the values may not round-trip cleanly.

Doing it manually with terraform import

The native approach is to write the aws_efs_access_point block by hand, then run terraform import aws_efs_access_point.example <import-id> for every resource, one at a time. That works for a handful of resources, but it does not scale: you author all the HCL yourself and repeat the command for each item. Terraback generates the HCL and the import blocks for your whole account in one pass.

Import other AWS resources