背景：带有成员服务器的AWS EC2中设置的Windows域。我们使用自己的广告，该广告也在同一VPC中加热。已经创建了FSX共享，该共享安装在所有属于域的Windows服务器上。 FSX共享安装座不错。但是，默认情况下，似乎域上的任何身份验证的用户都读/写入FSX共享。
我们正在努力限制对仅指定用户对共享中某些文件夹的读/写入访问权限。
aws docs at 说以下内容：
每个亚马逊FSX文件系统都带有默认的Windows文件共享
称为共享。配置了此共享文件夹的Windows ACL
允许读/写入域用户。他们还允许
控制您的Active Directory中委派的管理员组
委派在文件上执行管理措施
系统。如果您将文件系统与AWS进行了管理
Microsoft AD，该组为AWS委派FSX管理员。如果
您将文件系统与自我管理的Microsoft集成
广告设置，该组可以是域名。否则可以是自定义
您在创建时指定的委派管理员组
文件系统。要更改ACL，您可以将共享映射为用户
是委派管理员组的成员。
是否可以覆盖此默认行为，如果是，如何？
我们将文件共享安装在V：drive and Winding v：\ user1文件夹中，只有[email protected] an V:\user2 should likewise be limited to [电子邮件＆nbsp;受保护]
从文件夹属性安全性中，它不允许删除所有用户许可，因为它正在从创建FSX期间设置的其他perm继承它。
Background: A Windows domain set up in AWS EC2 with member servers. We use our own AD which is also hoted in the same VPC. An FsX share has been created that is mounted on all Windows servers that are part of the domain. The FsX share mounts fine. However, by default it appears that any authenticated user on the domain has read/write access to the FsX share.
We are struggling with limiting read/write access to certain folders in the share to only designated users.
AWS docs at https://docs.aws.amazon.com/fsx/latest/WindowsGuide/limit-access-file-folder.html say the following:
Every Amazon FSx file system comes with a default Windows file share
called share. The Windows ACLs for this shared folder are configured
to allow read/write access to domain users. They also allow full
control to the delegated administrators group in your Active Directory
that is delegated to perform administrative actions on your file
systems. If you're integrating your file system with AWS Managed
Microsoft AD, this group is AWS Delegated FSx Administrators. If
you're integrating your file system with your self-managed Microsoft
AD setup, this group can be Domain Admins. Or it can be a custom
delegated administrators group that you specified when creating the
file system. To change the ACLs, you can map the share as a user that
is a member of the delegated administrators group.
Is it possible to override this default behavior and if so, how?
We mount the file share on V: drive and want that V:\user1 folder should only have RW for [email protected] an V:\user2 should likewise be limited to [email protected]
From the Folder Properties security it does not permit removal of the All Users permission as it is inheriting it from someother perm that was set up during creation of the FsX.
发布评论
评论（1）
还没有答案。 AWS FSX不支持禁用对主要共享文件夹的继承，因此我们将无法实现以限制特定用户对特定文件夹的访问，因为所有广告用户都是经过身份验证的用户组的一部分，如果我们否认，我们将无法删除，我们无法删除它，我们将无法访问文件夹。
No answer yet. aws FSx doesnt support disabling inheritance on main share folder, so we will not be able to achieve to restrict access to particular folder for particular user, as all AD users are part of Authenticated users group which we cant remove, if we deny it, we will not be able to access the folder.