resource/aws_efs_file_system: Add support for encryption

aws/data_source_aws_efs_file_system.go

@@ -22,12 +22,20 @@ func dataSourceAwsEfsFileSystem() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: validateMaxLength(64),
 			},
+			"encrypted": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
 			"file_system_id": {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
 				ForceNew: true,
 			},
+			"kms_key_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"performance_mode": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -108,6 +116,8 @@ func dataSourceAwsEfsFileSystemRead(d *schema.ResourceData, meta interface{}) er
 	d.Set("creation_token", fs.CreationToken)
 	d.Set("performance_mode", fs.PerformanceMode)
 	d.Set("file_system_id", fs.FileSystemId)
+	d.Set("encrypted", fs.Encrypted)
+	d.Set("kms_key_id", fs.KmsKeyId)
 
 	return nil
 }

aws/resource_aws_efs_file_system.go

@@ -1,6 +1,7 @@
 package aws
 
 import (
+	"errors"
 	"fmt"
 	"log"
 	"time"
@@ -48,6 +49,21 @@ func resourceAwsEfsFileSystem() *schema.Resource {
 				ValidateFunc: validatePerformanceModeType,
 			},
 
+			"encrypted": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+
+			"kms_key_id": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: validateArn,
+			},
+
 			"tags": tagsSchema(),
 		},
 	}
@@ -76,6 +92,21 @@ func resourceAwsEfsFileSystemCreate(d *schema.ResourceData, meta interface{}) er
 		createOpts.PerformanceMode = aws.String(v.(string))
 	}
 
+	encrypted, hasEncrypted := d.GetOk("encrypted")
+	kmsKeyId, hasKmsKeyId := d.GetOk("kms_key_id")
+
+	if hasEncrypted {
+		createOpts.Encrypted = aws.Bool(encrypted.(bool))
+	}
+
+	if hasKmsKeyId {
+		createOpts.KmsKeyId = aws.String(kmsKeyId.(string))
+	}
+
+	if encrypted == false && hasKmsKeyId {
+		return errors.New("encrypted must be set to true when kms_key_id is specified")
+	}
+
 	log.Printf("[DEBUG] EFS file system create options: %#v", *createOpts)
 	fs, err := conn.CreateFileSystem(createOpts)
 	if err != nil {
@@ -196,6 +227,8 @@ func resourceAwsEfsFileSystemRead(d *schema.ResourceData, meta interface{}) erro
 
 	d.Set("creation_token", fs.CreationToken)
 	d.Set("performance_mode", fs.PerformanceMode)
+	d.Set("encrypted", fs.Encrypted)
+	d.Set("kms_key_id", fs.KmsKeyId)
 
 	return nil
 }

aws/resource_aws_efs_file_system_test.go

@@ -3,6 +3,7 @@ package aws
 import (
 	"fmt"
 	"reflect"
+	"regexp"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -170,6 +171,41 @@ func TestAccAWSEFSFileSystem_pagedTags(t *testing.T) {
 	})
 }
 
+func TestAccAWSEFSFileSystem_kmsKey(t *testing.T) {
+	rInt := acctest.RandInt()
+	keyRegex := regexp.MustCompile("^arn:aws:([a-zA-Z0-9\\-])+:([a-z]{2}-[a-z]+-\\d{1})?:(\\d{12})?:(.*)$")
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckEfsFileSystemDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSEFSFileSystemConfigWithKmsKey(rInt),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestMatchResourceAttr("aws_efs_file_system.foo-with-kms", "kms_key_id", keyRegex),
+					resource.TestCheckResourceAttr("aws_efs_file_system.foo-with-kms", "encrypted", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSEFSFileSystem_kmsConfigurationWithoutEncryption(t *testing.T) {
+	rInt := acctest.RandInt()
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckEfsFileSystemDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAWSEFSFileSystemConfigWithKmsKeyNoEncryption(rInt),
+				ExpectError: regexp.MustCompile(`encrypted must be set to true when kms_key_id is specified`),
+			},
+		},
+	})
+}
+
 func testAccCheckEfsFileSystemDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).efsconn
 	for _, rs := range s.RootModule().Resources {
@@ -351,3 +387,29 @@ resource "aws_efs_file_system" "foo-with-performance-mode" {
 	performance_mode = "maxIO"
 }
 `
+
+func testAccAWSEFSFileSystemConfigWithKmsKey(rInt int) string {
+	return fmt.Sprintf(`
+resource "aws_kms_key" "foo" {
+  description = "Terraform acc test %d"
+}
+
+resource "aws_efs_file_system" "foo-with-kms" {
+  encrypted = true
+  kms_key_id = "${aws_kms_key.foo.arn}"
+}
+`, rInt)
+}
+
+func testAccAWSEFSFileSystemConfigWithKmsKeyNoEncryption(rInt int) string {
+	return fmt.Sprintf(`
+resource "aws_kms_key" "foo" {
+  description = "Terraform acc test %d"
+}
+
+resource "aws_efs_file_system" "foo-with-kms" {
+  encrypted = false
+  kms_key_id = "${aws_kms_key.foo.arn}"
+}
+`, rInt)
+}

website/docs/d/efs_file_system.html.markdown

@@ -28,12 +28,13 @@ data "aws_efs_file_system" "by_id" {
 The following arguments are supported:
 
 * `file_system_id` - (Optional) The ID that identifies the file system (e.g. fs-ccfc0d65).
-* `creation_token` - (Optional) Restricts the list to the file system with this creation token
+* `creation_token` - (Optional) Restricts the list to the file system with this creation token.
 
 ## Attributes Reference
 
 The following attributes are exported:
 
 * `performance_mode` - The PerformanceMode of the file system.
 * `tags` - The list of tags assigned to the file system.
-
+* `encrypted` - Whether EFS is encrypted.
+* `kms_key_id` - The ARN for the KMS encryption key.

website/docs/r/efs_file_system.html.markdown

@@ -39,12 +39,15 @@ default generated by Terraform.
 * `performance_mode` - (Optional) The file system performance mode. Can be either
 `"generalPurpose"` or `"maxIO"` (Default: `"generalPurpose"`).
 * `tags` - (Optional) A mapping of tags to assign to the file system.
+* `encrypted` - (Optional) If true, the disk will be encrypted.
+* `kms_key_id` - (Optional) The ARN for the KMS encryption key. When specifying kms_key_id, encrypted needs to be set to true.
 
 ## Attributes Reference
 
 The following attributes are exported:
 
 * `id` - The ID that identifies the file system (e.g. fs-ccfc0d65).
+* `kms_key_id` - The ARN for the KMS encryption key.
 
 ## Import