Using Amazon FSx with Amazon Directory Service for Microsoft Active Directory

Amazon Directory Service for Microsoft Active Directory (Amazon Managed Microsoft AD) provides fully managed, highly available, actual Active Directory directories in the cloud. You can use these Active Directory directories in your workload deployment.

If your organization is using Amazon Managed Microsoft AD to manage identities and devices, we recommend that you integrate your Amazon FSx file system with Amazon Managed Microsoft AD. By doing this, you get a turnkey solution using Amazon FSx with Amazon Managed Microsoft AD. Amazon handles the deployment, operation, high availability, reliability, security, and seamless integration of the two services, enabling you to focus on operating your own workload effectively.

To use Amazon FSx with your Amazon Managed Microsoft AD setup, you can use the Amazon FSx console. When you create a new FSx for Windows File Server file system in the console, choose Amazon Managed Active Directory under the Windows Authentication section. You also choose the specific directory that you want to use. For more information, see Step 5. Create your file system.

Your organization might manage identities and devices on a self-managed Active Directory domain (on-premises or in the cloud). If so, you can join your Amazon FSx file system directly to your existing, self-managed Active Directory domain. For more information, see Using a self-managed Microsoft Active Directory.

Additionally, you can also set up your system to benefit from a resource forest isolation model. In this model, you isolate your resources, including your Amazon FSx file systems, into a separate Active Directory forest from the one where your users are.

Networking prerequisites

Before you create an FSx for Windows File Server file system joined to your Amazon Microsoft Managed Active Directory domain, make sure that you have created and set up the following network configurations:

Use the Amazon FSx Network Validation tool to validate connectivity to your Active Directory domain controllers.

Using a resource forest isolation model

You join your file system to an Amazon Managed Microsoft AD setup. You then establish a one-way forest trust relationship between an Amazon Managed Microsoft AD domain that you create and your existing self-managed Active Directory domain. For Windows authentication in Amazon FSx, you only need a one-way directional forest trust, where the Amazon managed forest trusts the corporate domain forest.

Your corporate domain takes the role of the trusted domain, and the Amazon Directory Service managed domain takes the role of the trusting domain. Validated authentication requests travel between the domains in only one direction—allowing accounts in your corporate domain to authenticate against resources shared in the managed domain. In this case, Amazon FSx interacts only with the Amazon managed domain. In a Kerberos authentication scenario, authentication requests originating from a corporate client get validated by the corporate domain, which then refers it to the Amazon Managed Microsoft AD, and eventually the client presents its service ticket to your FSx for Windows File Server file system. For more information about trusts, see the post Everything you wanted to know about trusts with Amazon Managed Microsoft AD in the Amazon Security Blog.

Test your Active Directory configuration

Before creating your Amazon FSx file system, we recommend that you validate the connectivity to your Active Directory domain controllers using the Amazon FSx Network Validation tool. For more information, see Validating connectivity to your Active Directory domain controllers.

The following related resources can help you as you use Amazon Directory Service for Microsoft Active Directory with FSx for Windows File Server: