"Amazon FSx is unable to communicate with your Microsoft Active Directory domain controller"

Question

Hello!
I am trying to set up FSx for use with my AWS-managed Active Directory, but I receive the following error: 
> File system creation failed. Amazon FSx is unable to communicate with your Microsoft Active Directory domain controller(s).

I am struggling to figure out why this is happening. The ACLs allow for **all** inbound and outbound traffic ([I have also tried restricting them to just the ports mentioned in the documentation, but had no luck](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/fsx-aws-managed-ad.html)) and [Amazon's AD validation tool](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/validate-ad-config.html) doesn't report any issues.

I am not sure how relevant the following is, but oddly enough when I attempt to create an FSx drive in its own security group and different subnets, the FSx creation takes 20 minutes before it fails. If I use our AD's details, it takes about 6 hours before failing (and this time has been persisting through multiple attempts for a week now).

Is there anything else I could try or check?

Answer

Hi,

In order to successfully create Amazon FSx for Windows File Server, Amazon FSx requires that every single domain controller in the Active Directory domain is reachable. This is because during validation, Amazon FSx uses a DC locator algorithm that can select any of the domain controllers.  If you have multiple domain controllers, ensure that all of them meet the requirements listed in the below link, and ensure that any changes to your service account are propagated to all domain controllers. 
https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-manage-prereqs.html

As a best practice, we recommend that customer uses Active Directory Sites & Services to ensure that FSx connects to a single domain controller site. This is important so as to avoid AD object replication delays as well as network connectivity issues across AD sites.

"Amazon FSx is unable to communicate with your Microsoft Active Directory domain controller"

Relevant content