Security pillar
The security pillar of the AWS Well-Architected Framework focuses on protecting information and systems. The following recommendations can help you meet the security design principles and architectural best practices for Amazon FSx for Windows File Server.
Key focus areas
Data integrity and confidentiality
Managing user permissions
Establishing controls to detect security events
Implement a strong identity foundation
Grant the least AWS Identity and Access Management (IAM) privileges needed to AWS resources that must integrate with or access Amazon FSx for Windows File Server. For more information, see Resource administration access control with IAM for Amazon FSx in the Amazon FSx documentation.
Use Windows access control lists (ACLs) to manage fine-grained file-level and folder-level access. For more information, see File- and Folder-Level Access Control Using Windows ACLs in the Amazon FSx documentation.
Activate traceability
Enable file access auditing for FSx for Windows File Server file systems. For more information, see File access auditing in the Amazon FSx documentation.
Set audit controls on your files and folders in the FSx for Windows File Server file system to track failed logins. For more information, see the blog post File storage access patterns insights using Amazon FSx for Windows File Server
. Use the Shared Folders tool to monitor connected user sessions and open files on your FSx for Windows File Server file system. For more information, see User sessions and open files in the Amazon FSx documentation.
Activate AWS CloudTrail to log FSx for Windows File Server API calls. For more information, see the Set up central AWS CloudTrail
section of the AWS Multi-Account Security Governance Workshop in AWS Workshop Studio.
Apply security to all layers
Configure your service account with minimum privileges required if you're joining a self-managed Active Directory. For more information, see Delegating privileges to your Amazon FSx service account in the Amazon FSx documentation.
Use security groups and network ACLs to restrict access to your file systems. For more information, see File System Access Control with Amazon VPC in the Amazon FSx documentation.
Automate security best practices and prepare for security events
Automate incident responses to specific security events, such as notifying security teams of unauthorized access attempts.
To automate event notifications and responses you can use one or more of the following AWS services:
Protect data in transit and at rest
To enforce in-transit encryption, limit access to only those clients that support the Server Message Block (SMB) protocol version 3.0 and higher. For more information, see Managing encryption in transit in the Amazon FSx documentation.
