Skip to content

Azure SMB FileStore Module

This OpenTofu module provisions Azure Storage Accounts with SMB file shares, designed for secure, scalable file storage with encryption at rest and in transit.

Features

  • Encryption at Rest: All data automatically encrypted using Azure Storage Service Encryption (SSE) with 256-bit AES
  • Encryption in Transit: HTTPS enforcement, TLS 1.2+, and SMB 3.0 protocol-level encryption
  • Multi-shard Architecture: Each shard gets its own dedicated storage account for isolation and scalability
  • Network Security: VNet service endpoints and IP whitelisting to restrict access
  • Azure Integration: Seamless integration with Azure Container Apps, VMs, and Kubernetes

Requirements

No requirements.

Providers

Name Version
azurerm 4.77.0

Modules

No modules.

Resources

Name Type
azurerm_role_assignment.umi_share_access resource
azurerm_storage_account.smb resource
azurerm_storage_share.smb_shares resource

Inputs

Name Description Type Default Required
allowed_ips List of IPs to whitelist list(string) [] no
allowed_subnet_ids The IDs of the subnets that can access the file store. list(string) n/a yes
base_name [d] The base name prefix used for resources. string n/a yes
enable_firewall Enables storage account firewall bool true no
location [d] The location where resources will be created. string n/a yes
resource_group_name [d] The name of the resource group. string n/a yes
shards [d] A map of SMB shard objects (each will get its own storage account) 
map(object({
    quota_gb = number
  }))
 n/a yes
suffix [d] A suffix to append to the resource name. string n/a yes
tags A map of tags to apply to the resource. map(string) n/a yes
user_managed_identity_principal_id [d] The principal ID of the user managed identity (required for role assignments). string n/a yes

[d] Destructive: changing this input forces one or more resources to be destroyed and recreated (an OpenTofu/Terraform replacement) rather than updated in place.

Outputs

Name Description
file_shares Map of SMB file share details
file_shares_config Map of SMB file share metadata (non-sensitive, safe for for_each)
smb_connection_strings SMB connection strings for mounting shares

Example Usage

module "smb_filestore" {
  source = "oci://acrmerkalisdist0c66.azurecr.io/modules/azure/filestore?tag=<module-version>"

  base_name           = "myapp"
  suffix              = "prod"
  location            = "eastus"
  resource_group_name = azurerm_resource_group.main.name

  user_managed_identity_principal_id = "00000000-0000-0000-0000-000000000000"

  allowed_subnet_ids = [
    azurerm_subnet.container_apps.id
  ]

  allowed_ips = [
    "203.0.113.0/24"  # Office network
  ]

  shards = {
    "media" = {
      quota_gb = 1024
    }
    "uploads" = {
      quota_gb = 512
    }
  }

  tags = {
    Environment = "production"
    Application = "myapp"
  }
}

Encryption Details

Encryption at Rest

  • Technology: Azure Storage Service Encryption (SSE)
  • Algorithm: 256-bit AES encryption
  • Scope: All data, metadata, and snapshots
  • Key Management: Microsoft-managed keys (default)
  • Status: Always enabled, cannot be disabled

Encryption in Transit

  • HTTPS: Enforced for all management operations (https_traffic_only_enabled = true)
  • TLS Version: Minimum TLS 1.2 required (min_tls_version = "TLS1_2")
  • SMB Protocol: SMB 3.0+ with built-in encryption for data transfer
  • Network: All client-to-storage communication is encrypted

Mounting SMB Shares

To mount the SMB file shares into Azure Container Apps created using the compute/azure module, you would configure the appropriate share_mounts object on the desired apps/app jobs. (See the compute/azure module documentation.)

Mounting the share to a VM or Azure Container Apps created outside of the compute/azure module is outside the file's scope. We refer you to Azure documentation for details on this.

Notes

1. Network Access

a. For security reasons this module enforces (sub-) network isolation by creating network rules with default_action = "Deny" for each storage account created. - Access is only allowed from the specified subnet_id. - Access is also allowed for trusted AzureServices. - Access via Managed Identity requires the identity to be running within the allowed subnet or have appropriate network routing. - You will not be able to access the data from the Azure Portal unless your client IP is added to the firewall or you are accessing it from a VM within the allowed subnet.

b. Because network isolation is enforced by denying access to all non-whitelisted IPs, Terraform/OpenTofu plans/applies will fail (in the survey phase) with 403 Forbidden if the Terraform/OpenTofu runner's IP address is not contained in allowed_ips.

Troubleshooting

Port 445 Blocked

Issue: Cannot connect to SMB share
Solution: Ensure port 445 (SMB) is open in your network/firewall. Many ISPs block port 445.

Access Denied

Issue: Authentication failures
Solution: - Verify storage account name and access key are correct - Check that client IP is in allowed_ips or subnet is in allowed_subnet_ids - Ensure SMB 3.0+ is supported on the client

Performance Issues

Issue: Slow file access
Solution: - Use VNet service endpoints for better performance within Azure - Consider Premium tier for higher IOPS requirements - Check quota limits on shares

Available versions

  • v0.9.1