FSX SMB Message signing enabled but not required

Take this:

You need to configure SMB encryption and signing using FSx’s built-in settings, not GPO or PowerShell. Step-by-Step:

1. Use the AWS CLI or PowerShell for FSx to check and modify SMB settings.
2. Focus on these two properties: o EncryptData: Enables SMB encryption (which includes signing). o RejectUnencryptedAccess: Forces clients to use encryption (and signing).

Sample

aws fsx update-file-system \
  --file-system-id fs-SAMPLE \
  --windows-configuration AuditLogDestination=NONE,ThroughputCapacity=32,WeeklyMaintenanceStartTime=1:00:00 \
  --cli-input-json '{
    "WindowsConfiguration": {
      "AuditLogDestination": "NONE",
      "ThroughputCapacity": 32,
      "WeeklyMaintenanceStartTime": "1:00:00",
      "SelfManagedActiveDirectoryConfiguration": {
        ...
      },
      "PreferredSubnetId": "subnet",
      "DeploymentType": "MULTI_AZ_1",
      "ThroughputCapacity": 32,
      "DailyAutomaticBackupStartTime": "01:00",
      "AutomaticBackupRetentionDays": 7,
      "CopyTagsToBackups": true,
      "Aliases": [],
      "MaintenanceOperationsInProgress": [],
      "DiskIopsConfiguration": {
        "Mode": "AUTOMATIC"
      },
      "RootVolumeConfiguration": {
        "EncryptData": true,
        "RejectUnencryptedAccess": true
      }
    }
  }'

You can also do this via the AWS Console under FSx → File System Settings → Encryption in Transit https://docs.aws.amazon.com/fsx/latest/WindowsGuide/encryption-in-transit.html

Hey,

Hope you're keeping well.

Amazon FSx for Windows File Server doesn’t process Windows Group Policy directly for SMB settings, so you’ll need to enforce SMB signing or encryption via FSx’s own configuration. In the AWS CLI, you can use update-file-system with the WindowsConfiguration parameters to enable EncryptData=true and RejectUnencryptedAccess=true, which forces all SMB traffic to be signed and encrypted. This change applies at the file system level and will meet most security scan requirements. You can check the current settings with describe-file-systems to confirm they’re applied.

Thanks and regards,
Taz