💙 Cisco ACI FC Domain Terraform Module

Manage a Cisco ACI FC domain — a fabric-scoped access-policy object (class fcDomP, DN uni/fc-{name}) that binds a VSAN pool to a name every Fibre Channel connectivity binding references — as a typed, secure-by-default building block targeting CiscoDevNet/aci ~> 2.20.

This module manages a single ACI FC domain and its pool/attribute bindings as one coherent, secure-by-default unit:

• ⚓ The FC domain (aci_fc_domain.this) — a fabric-scoped access-policy object in the ACI Management Information Tree (MIT), addressed by the Distinguished Name uni/fc-{name}.
• 🏷️ The ACI metadata tail — annotation (preserved as orchestrator:terraform so Terraform-managed objects are identifiable in APIC) and name_alias. The live schema for this resource carries no description, owner_key/owner_tag, or annotations/tags list.
• 🔗 Classic flat pool/attribute relations — the VSAN pool binding that supplies this domain's Fibre Channel namespace and its resolved/definitive counterpart, an optional VSAN attribute policy binding and its resolved/definitive counterpart, an FCoE VLAN pool binding for FCoE deployments and its resolved/definitive counterpart, and the (rarely used outside GOLF/multi-pod) VIP address pool and VXLAN instance pool associations.
• 🔑 Scope, not credentials — the FC domain is a fabric-root object with no parent DN; authentication and the APIC URL are the caller's provider concern and are never module variables.

💡 Why it matters: the FC domain is the pivot between an access-policy VSAN pool and every downstream object that needs Fibre Channel connectivity — an Attachable Access Entity Profile's domain relation, or an application EPG's static/domain binding. A consistent, identifiable, correctly-bound FC domain keeps that storage-network plumbing auditable.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

graph LR
  apic["Cisco APIC fabric (provider auth, out of band)"]:::ext
  vsp["terraform-aci-vsan-pool"]:::sib
  vp["terraform-aci-vlan-pool"]:::sib
  fcd["terraform-aci-fc-domain (this module)"]:::this
  fc["aci_fc_domain - class fcDomP - DN uni/fc-{name}"]:::keystone
  aaep["terraform-aci-attachable-access-entity-profile"]:::sib
  epg["terraform-aci-application-epg"]:::sib

  apic -->|"provider configured by caller"| fcd
  vsp -->|"vsan_pool_dn"| fcd
  vp -->|"vlan_pool_dn (FCoE)"| fcd
  fcd -->|"manages"| fc
  fcd -->|"fc_domain_dn"| aaep
  fcd -->|"fc_domain_dn (domain binding)"| epg

  classDef this fill:#00BCEB,color:#fff,stroke:#00BCEB;
  classDef keystone fill:#0D274D,color:#fff,stroke:#0D274D;
  classDef sib fill:#f5f5f5,color:#333,stroke:#cccccc;
  classDef ext fill:#eeeeff,color:#333,stroke:#9999ff;

The FC domain sits between an access-policy VSAN pool and every object that needs Fibre Channel connectivity. It takes no parent DN, consumes a VSAN pool's DN (and, for FCoE, a VLAN pool's DN) as optional relations, and emits an id (its DN, uni/fc-{name}) that Attachable Access Entity Profiles and application EPGs consume when binding Fibre Channel connectivity.

graph TD
  n["fc_domain.name (required, immutable)"]:::in
  meta["annotation / name_alias"]:::in
  vsp["vsan_pool_dn / vsan_pool_definitive_dn"]:::in
  vsa["vsan_attribute_dn / vsan_attribute_definitive_dn"]:::in
  vp["vlan_pool_dn / vlan_pool_definitive_dn (FCoE)"]:::in
  vip["vip_address_pool_dn / vxlan_pool_definitive_dn"]:::in
  this["aci_fc_domain.this (keystone, fcDomP)"]:::this
  oid["output: id (DN uni/fc-{name})"]:::out
  onm["output: name"]:::out
  orel["outputs: vsan_pool_dn / vsan_pool_definitive_dn / vsan_attribute_dn / vsan_attribute_definitive_dn / vlan_pool_dn / vlan_pool_definitive_dn / vip_address_pool_dn / vxlan_pool_definitive_dn"]:::out

  n --> this
  meta --> this
  vsp --> this
  vsa --> this
  vp --> this
  vip --> this
  this --> oid
  this --> onm
  this --> orel

  classDef this fill:#00BCEB,color:#fff,stroke:#00BCEB;
  classDef in fill:#f5f5f5,color:#333,stroke:#cccccc;
  classDef out fill:#eeeeff,color:#333,stroke:#9999ff;

Resource inventory

Schema notes that bite (verified against the live provider schema):

• 🔒 fc_domain.name is immutable. Changing it forces replacement — a brand-new FC domain DN, breaking every binding (AAEP, EPG) that referenced the old one until re-pointed.
• ℹ️ aci_fc_domain is a classic (SDKv2) resource. It has not migrated to the plugin-framework typed relation_to_* shape — its pool/attribute bindings are flat string attributes (relation_fc_rs_vsan_ns, relation_fc_rs_vsan_ns_def, relation_fc_rs_vsan_attr, relation_fc_rs_vsan_attr_def, relation_infra_rs_vlan_ns, relation_infra_rs_vlan_ns_def, relation_infra_rs_vip_addr_ns, relation_infra_rs_dom_vxlan_ns_def), each holding a target DN directly.
• ⚠️ The live schema has no description, owner_key/owner_tag, or annotations/tags list. Unlike migrated resources in this suite, the metadata tail here is limited to annotation and name_alias — nothing else is invented.
• ℹ️ relation_fc_rs_vsan_ns_def, relation_fc_rs_vsan_attr_def, relation_infra_rs_vlan_ns_def, and relation_infra_rs_dom_vxlan_ns_def are optional, computed. The provider typically derives them once the corresponding primary relation is set; this module exposes them as inputs only for advanced migration/import scenarios — leave them null in the common case.
• ℹ️ The FCoE VLAN pool relation (vlan_pool_dn) is only meaningful for FCoE deployments. A pure native Fibre Channel domain typically leaves it null; native FC uses the VSAN pool relation exclusively.
• ℹ️ id is the DN (uni/fc-{name}), computed by APIC at create. It is the value downstream modules consume when binding Fibre Channel connectivity to this domain.
• ⚠️ validate_relation_dn (provider default true) means a vsan_pool_dn (or any other relation DN) pointing at an object that does not yet exist will fail at apply — create the object first, or wire it by reference.

Scope the caller's APIC login to the least privilege this module needs:

• Create / delete an FC domain: the admin role, or a custom role granted write privilege on fabric infrastructure/access-policy configuration (the APIC built-in access-admin role covers this), scoped to the all security domain — FC domains are fabric-wide objects, not tenant-scoped.
• Referenced VSAN pool / VSAN attribute policy / VLAN pool / VIP address pool: read on any object targeted by the relation attributes.

The module never sees a credential — authentication is a provider/caller concern supplied out of band (e.g. ACI_USERNAME / ACI_PASSWORD, or ACI_PRIVATE_KEY / ACI_CERT_NAME for signature-based auth).

• A reachable Cisco APIC (ACI_URL) whose version is compatible with the ~> 2.20 provider, with the provider configured and authenticated by the caller.
• In production, the provider should be configured with insecure = false and proper CA trust — the provider's own default (insecure = true, skip TLS verification) is not a safe steady state.
• If you set vsan_pool_dn, vsan_attribute_dn, vlan_pool_dn, or vip_address_pool_dn, the referenced object must exist (or be created in the same configuration) so the provider's DN validation passes.

terraform-aci-fc-domain/
├── providers.tf     # terraform{} + required_providers (aci ~> 2.20); no provider block
├── variables.tf     # the fc_domain object — deeply typed, secure defaults, heredoc schema, validations
├── main.tf          # aci_fc_domain.this (keystone) + metadata tail + classic pool/attribute relations
├── outputs.tf       # id (the DN) first, then name and the resolved relations
├── README.md        # this document
├── SCOPE.md         # cross-module contract (scope, consumes/emits, roles, prerequisites)
├── LICENSE          # MIT
└── .gitignore       # canonical library ignore set

# The caller configures the provider (authentication is out of band).
provider "aci" {
  # username / password, or private_key + cert_name for signature auth;
  # url = "https://apic.example.com"; set insecure = false in production.
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name = "storage-fc"
  }
}

output "fc_domain_dn" {
  value = module.fc_domain.id # pass this to AAEP / application-EPG domain bindings
}

Consumes

Emits

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name = "storage-fc"
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name       = "storage-fc"
    name_alias = "Storage-Fabric-A"
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name       = "storage-fc"
    annotation = "orchestrator:terraform:storage-team"
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name         = "storage-fc"
    vsan_pool_dn = "uni/infra/vsanns-[storage-vsans]-static"
  }
}

module "vsan_pool" {
  source    = "git::https://github.com/microsoftexpert/terraform-aci-vsan-pool.git?ref=v1.0.0"
  vsan_pool = { name = "storage-vsans", alloc_mode = "static" }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name         = "storage-fc"
    vsan_pool_dn = module.vsan_pool.id
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name              = "storage-fc"
    vsan_pool_dn      = "uni/infra/vsanns-[storage-vsans]-static"
    vsan_attribute_dn = "uni/infra/vsanattrp-storage-loadbal"
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name         = "fcoe-storage"
    vsan_pool_dn = "uni/infra/vsanns-[fcoe-vsans]-static"
    vlan_pool_dn = "uni/infra/vlanns-[fcoe-vlans]-static"
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name                = "golf-fc"
    vsan_pool_dn        = "uni/infra/vsanns-[golf-vsans]-static"
    vip_address_pool_dn = "uni/infra/addrinst-[golf-vip-pool]"
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name                    = "migrated-fc"
    vsan_pool_dn            = "uni/infra/vsanns-[storage-vsans]-static"
    vsan_pool_definitive_dn = "uni/infra/vsanns-[storage-vsans]-static"
  }
}

module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name                         = "full-bound-fc"
    vsan_pool_dn                 = "uni/infra/vsanns-[storage-vsans]-static"
    vsan_pool_definitive_dn      = "uni/infra/vsanns-[storage-vsans]-static"
    vsan_attribute_dn            = "uni/infra/vsanattrp-storage-loadbal"
    vsan_attribute_definitive_dn = "uni/infra/vsanattrp-storage-loadbal"
    vlan_pool_dn                 = "uni/infra/vlanns-[fcoe-vlans]-static"
    vlan_pool_definitive_dn      = "uni/infra/vlanns-[fcoe-vlans]-static"
    vip_address_pool_dn          = "uni/infra/addrinst-[golf-vip-pool]"
    vxlan_pool_definitive_dn     = "uni/infra/vxlanns-default"
  }
}

# Configure the provider with a login scoped to access-policy management —
# not a full fabric admin — for day-2 changes to an existing domain.
provider "aci" {
  # username    = "svc-access-admin"    # an access-admin role, write-scoped
  #                                      # to fabric access-policy configuration
  # private_key = var.apic_private_key  # signature auth avoids login-rate limits
  # cert_name   = "terraform-cert"
  # url         = "https://apic.example.com"
  # insecure    = false
}

module "fc_domain" {
  source    = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"
  fc_domain = { name = "storage-fc" }
}

locals {
  fc_domains = {
    "storage-fc-a" = { name = "storage-fc-a", vsan_pool_dn = "uni/infra/vsanns-[storage-vsans-a]-static" }
    "storage-fc-b" = { name = "storage-fc-b", vsan_pool_dn = "uni/infra/vsanns-[storage-vsans-b]-static" }
    "backup-fc"    = { name = "backup-fc", vsan_pool_dn = "uni/infra/vsanns-[backup-vsans]-static" }
  }
}

module "fc_domains" {
  source   = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"
  for_each = local.fc_domains

  fc_domain = each.value
}

output "fc_domain_dns" {
  value = { for k, m in module.fc_domains : k => m.id }
}

module "fc_domain" {
  source    = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"
  fc_domain = { name = "storage-fc", vsan_pool_dn = "uni/infra/vsanns-[storage-vsans]-static" }
}

output "fc_domain_dn"           { value = module.fc_domain.id }             # uni/fc-storage-fc
output "fc_domain_vsan_pool_dn" { value = module.fc_domain.vsan_pool_dn }

module "fc_domain" {
  source    = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"
  fc_domain = { name = "storage-fc", vsan_pool_dn = "uni/infra/vsanns-[storage-vsans]-static" }
}

module "aaep" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-attachable-access-entity-profile.git?ref=v1.0.0"

  attachable_access_entity_profile = {
    name         = "storage-aaep"
    fc_domain_dn = module.fc_domain.id # <-- the domain's DN becomes the AAEP's relation
  }
}

provider "aci" {
  # configured + authenticated by the caller; insecure = false in production
}

# 1) A VSAN pool supplying the Fibre Channel namespace.
module "vsan_pool" {
  source    = "git::https://github.com/microsoftexpert/terraform-aci-vsan-pool.git?ref=v1.0.0"
  vsan_pool = { name = "storage-vsans", alloc_mode = "static" }
}

# 2) The keystone FC domain, bound to that pool.
module "fc_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-fc-domain.git?ref=v1.0.0"

  fc_domain = {
    name         = "storage-fc"
    vsan_pool_dn = module.vsan_pool.id
  }
}

# 3) An Attachable Access Entity Profile binding the domain to interface policy.
module "aaep" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-attachable-access-entity-profile.git?ref=v1.0.0"

  attachable_access_entity_profile = {
    name         = "storage-aaep"
    fc_domain_dn = module.fc_domain.id
  }
}

# 4) A tenant + application EPG bound to the same FC domain.
module "tenant" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-tenant.git?ref=v1.0.0"
  tenant = { name = "core-prod" }
}

module "ap" {
  source              = "git::https://github.com/microsoftexpert/terraform-aci-application-profile.git?ref=v1.0.0"
  tenant_dn           = module.tenant.id
  application_profile = { name = "storage-apps" }
}

module "epg" {
  source = "git::https://github.com/microsoftexpert/terraform-aci-application-epg.git?ref=v1.0.0"

  application_profile_dn = module.ap.id
  application_epg        = { name = "storage-epg" }
  fc_domain_dn            = module.fc_domain.id
}

output "fc_domain_dn" { value = module.fc_domain.id }

variable "fc_domain" {
  type = object({
    name       = string                                     # REQUIRED, immutable (force-new), 1-64 chars
    annotation = optional(string, "orchestrator:terraform") # ACI annotation marker (kept identifiable)
    name_alias = optional(string, null)                     # GUI display alias

    vsan_pool_dn                 = optional(string, null) # VSAN pool binding (fcRsVsanNs)
    vsan_pool_definitive_dn      = optional(string, null) # resolved/definitive VSAN namespace (fcRsVsanNsDef); provider-computed in the common case
    vsan_attribute_dn            = optional(string, null) # VSAN attribute policy binding (fcRsVsanAttr)
    vsan_attribute_definitive_dn = optional(string, null) # resolved/definitive VSAN attribute policy (fcRsVsanAttrDef); provider-computed in the common case
    vlan_pool_dn                 = optional(string, null) # FCoE VLAN pool binding (infraRsVlanNs); FCoE only
    vlan_pool_definitive_dn      = optional(string, null) # resolved/definitive VLAN namespace (infraRsVlanNsDef); provider-computed in the common case
    vip_address_pool_dn          = optional(string, null) # VIP address pool binding (infraRsVipAddrNs); GOLF / multi-pod
    vxlan_pool_definitive_dn     = optional(string, null) # resolved/definitive VXLAN instance pool (infraRsDomVxlanNsDef); provider-computed in the common case
  })
  # validation: name is 1-64 chars and matches ^[a-zA-Z0-9_.:-]+$ (ACI naming rules);
  # each relation DN, if set, must begin with "uni/"
}

• One keystone, no children. aci_fc_domain.this is the single resource. The domain is a fabric-scoped binding point; the objects that reference it (AAEPs, application EPGs) are owned by their own modules and consume this domain by DN — keeping this module small and composable.
• Classic (SDKv2) shape. Unlike this suite's migrated modules, the pool/attribute relations here are flat string attributes, not typed relation_to_* nested objects. The module surfaces each as a plain optional(string, null) DN input and wires it directly to the matching provider attribute.
• Minimal metadata tail. The live schema exposes only annotation and name_alias — no description, owner_key/owner_tag, or annotations/tags list exists on this resource, so none are modeled.
• Computed relations left alone by default. vsan_pool_definitive_dn, vsan_attribute_definitive_dn, vlan_pool_definitive_dn, and vxlan_pool_definitive_dn are optional, computed in the schema; this module exposes them as inputs but defaults each to null so the provider resolves them from the primary relation rather than fighting computed state.
• FCoE is opt-in. The FCoE VLAN pool relation (vlan_pool_dn) is only wired when set; a native Fibre Channel domain is fully described by the VSAN pool relation alone.
• Immutable identity. fc_domain.name is force-new: a rename destroys and recreates the domain, breaking every DN-based binding that referenced it until re-pointed. The two validation blocks reject names that violate the ACI length/character rules at plan time.
• Secure by omission. The minimal call preserves the orchestrator:terraform annotation and binds no pool — nothing is wired by default.

# From the module directory (offline, no credentials, no backend):
terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the module by immutable tag: ?ref=v1.0.0 — never a branch.
• This module is plan-only from the library's perspective. A human runs terraform plan / apply against a sub-production APIC from their own pipeline, with a login scoped to the permissions above. No cloud apply happens here.

The offline proof gate for this module:

• ✅ terraform validate — parses the module, resolves the fc_domain object type, runs the name and relation-DN validations, and confirms every argument exists in the provider schema.
• ✅ terraform fmt -check — canonical formatting.
• ⛔ Not exercised offline (only a real plan / apply against an APIC covers these): DN validation of the pool/attribute relations (server-side validate_relation_dn), APIC-side name-collision checks, resolution of the _def computed relations, and the computed DN returned as id.

$ terraform output
id                            = "uni/fc-storage-fc"
name                          = "storage-fc"
vsan_pool_dn                  = "uni/infra/vsanns-[storage-vsans]-static"
vsan_pool_definitive_dn       = "uni/infra/vsanns-[storage-vsans]-static"
vsan_attribute_dn             = null
vsan_attribute_definitive_dn  = null
vlan_pool_dn                  = null
vlan_pool_definitive_dn       = null
vip_address_pool_dn           = null
vxlan_pool_definitive_dn      = null

• Cisco ACI provider — aci_fc_domain
• Cisco ACI provider — provider configuration & authentication
• Cisco APIC object model — class fcDomP (the FC domain access-policy object).
• Sibling modules: terraform-aci-vsan-pool, terraform-aci-vlan-pool, terraform-aci-attachable-access-entity-profile, terraform-aci-application-epg, terraform-aci-physical-domain, terraform-aci-l2-domain, terraform-aci-l3-domain.
• This module's SCOPE.md — the cross-module contract.

💙 "Infrastructure as Code should be standardized, consistent, and secure."