Storage Gateway Appliance/VM + FSx Windows File Server across domains?

1

We are exploring using an AWS FSx Windows File Server that can host a file share that'll be accessible across EC2 instances, AWS Workspace instances, and physical workstations at a client site. We do have AWS Directory Services hooked up to our company's on-prem domain, so the EC2 instances & AWS Workspace instances would all be on our company's domain, but my question is more regarding the physical workstations that we have at a client's site which are not on our domain. We would be able to put a Storage Gateway on the client's network either as a VM or hardware appliance, but my question is, would the Storage Gateway need to be on the client's domain or our domain? If on the client's domain, would it be able to communicate with our FSx Windows File Server over VPN? If on our domain, would the physical workstations on the client's domain be able to access the file share?

Thank you in advance, Joe

feita há 2 anos630 visualizações
2 Respostas
2
Resposta aceita

Greetings,

You can use AWS Storage Gateway to expose your FSx Windows File Server to the physical workstations at the client's site. However, you'll need to ensure proper network connectivity and access permissions.

For the Storage Gateway to work correctly, it should be on the same network as the physical workstations at the client's site. It doesn't necessarily need to be on the client's domain, but being on the same network is crucial.

Here's how you can set up the desired architecture:

Create a VPN connection between your AWS VPC and the client's network, if not already set up. This will allow secure communication between the client's on-premises environment and your AWS resources. More information on AWS VPN can be found here: https://aws.amazon.com/vpn/

Deploy the Storage Gateway as a File Gateway on the client's network. This can be done using a virtual machine or a hardware appliance. Make sure it has proper network access to the client's workstations and the AWS VPN connection. More information on AWS Storage Gateway can be found here: https://aws.amazon.com/storagegateway/

Mount your FSx Windows File Server on the Storage Gateway. The Storage Gateway should be able to communicate with the FSx Windows File Server over the VPN. To accomplish this, you may need to configure appropriate routes and security groups in your AWS VPC and on-premises network.

Configure the Storage Gateway to use your AWS Directory Service for authentication. This way, when physical workstations access the file share, the Storage Gateway will handle the authentication with your AWS Directory Service. More information on joining a Storage Gateway to a domain can be found here: https://docs.aws.amazon.com/storagegateway/latest/userguide/GettingStartedCreateFileShares.html#GettingStartedCreateFileShares-jd

Finally, configure the client's workstations to access the file share exposed by the Storage Gateway. They should be able to access the file share with appropriate credentials, even if they are not on your company's domain.

Keep in mind that this setup may require additional fine-tuning based on the specific requirements of your company's network and the client's network.

Please let me know if I answered your question

profile pictureAWS
ESPECIALISTA
respondido há 2 anos
profile picture
ESPECIALISTA
avaliado há 5 meses
profile picture
ESPECIALISTA
avaliado há 5 meses
1

Hello Joe,

In addition to Zokir response, please consider below as well, as your use-case involves two different AD domains :

  1. To attach FSx Window File Server to FSx File Gateway, FSx Windows File Server and FSx File Gateway both should be joined to same AD domain.
  2. Depending on the access requirements, you may need at minimum one way trust or two way trust (for bidirectional AD user accounts access).
  3. You may access your file shares from both Amazon FSx File Gateway as well as directly from Amazon FSx in AWS; however, you should ensure that files can only be written from a single location at a time. We don't recommend having multiple writers to the same files from two locations as it would lead to InvalidFileState errors.
profile pictureAWS
respondido há 2 anos

Você não está conectado. Fazer login para postar uma resposta.

Uma boa resposta responde claramente à pergunta, dá feedback construtivo e incentiva o crescimento profissional de quem perguntou.

Diretrizes para responder a perguntas