Deploy FSx under Landing Zone pattern

Hi,

I can't deploy FSx in my application account because it doesn't like AD Connector.

I've tried deploying FSx in my shared services account but, although DNS resolves, mapping a drive results in "resource ... is not responding".

The default security group limits outgoing traffic to itself. Should I add another rule for my application account's VPC?

Thanks,
TL