AWS fsx documentation change
Summary
Expanded credential input options with Secrets Manager integration and restructured UI steps for AD joining
Security assessment
Adds guidance for secure credential storage via Secrets Manager and clarifies password confirmation requirements. While improving security practices documentation, there's no indication this addresses an active exploit or vulnerability.
Diff
diff --git a/fsx/latest/WindowsGuide/creating-joined-ad-file-systems.md b/fsx/latest/WindowsGuide/creating-joined-ad-file-systems.md index 32bf5ee55..2b265510a 100644 --- a//fsx/latest/WindowsGuide/creating-joined-ad-file-systems.md +++ b//fsx/latest/WindowsGuide/creating-joined-ad-file-systems.md @@ -19 +19,9 @@ Amazon FSx currently does not support Single Label Domain (SLD) domains. - * Credentials for a service account in your on-premises Microsoft Active Directory domain. Amazon FSx uses these credentials to join to your self-managed Active Directory. + * Credentials for an Active Directory service account that Amazon FSx uses to join the file system to your domain. You can provide these as either: + + * **Option 1** : AWS Secrets Manager secret ARN - The secret containing the username and password for a service account on your Active Directory domain. For more information, see [Storing Active Directory credentials using AWS Secrets Manager](./self-managed-AD.html#bp-store-ad-creds-using-secret-manager-windows). + + * **Option 2** : Plaintext credentials + + * **Service account username** – The user name of the service account in your existing Microsoft Active Directory. Don't include a domain prefix or suffix. For example, for `EXAMPLE\ADMIN`, use only `ADMIN`. + + * **Service account password** – The password for the service account. @@ -123 +131,11 @@ Ensure that the service account you provided has permissions delegated to the OU - 14. Enter a string value for **Service account username** for the account on your self-managed Active Directory domain, such as `ServiceAcct`. Amazon FSx uses this user name to join to your Microsoft Active Directory domain. + 14. **Service account credentials** – Choose how to provide your service account credentials: + + * **Option 1** : AWS Secrets Manager secret ARN - The secret containing the username and password for a service account on your Active Directory domain. For more information, see [Storing Active Directory credentials using AWS Secrets Manager](./self-managed-AD.html#bp-store-ad-creds-using-secret-manager-windows). + + * **Option 2** : Plaintext credentials + + * **Service account username** – The user name of the service account in your existing Microsoft Active Directory. Don't include a domain prefix or suffix. For example, for `EXAMPLE\ADMIN`, use only `ADMIN`. + + * **Service account password** – The password for the service account. + + * **Confirm password** – The password for the service account. @@ -131,5 +149 @@ DO NOT use the Distinguished Name (DN) when entering the **Service account usern - 15. Enter a value for **Service account password** for the account on your self-managed Active Directory domain. Amazon FSx uses this password to join to your Microsoft Active Directory domain. - - 16. Re-enter the password to confirm it in **Confirm password**. - - 17. For **Delegated file system administrators group** , specify the `Domain Admins` group or a custom delegated file system administrators group (if you've created one). The group you specify should have the delegated authority to perform administrative tasks on your file system. If you don't provide a value, Amazon FSx uses the Builtin `Domain Admins` group. Note that Amazon FSx does not support having a `Delegated file system administrators group` (either the `Domain Admins` group or a custom group you specify) that is located in the Builtin container. + 15. For **Delegated file system administrators group** , specify the `Domain Admins` group or a custom delegated file system administrators group (if you've created one). The group you specify should have the delegated authority to perform administrative tasks on your file system. If you don't provide a value, Amazon FSx uses the Builtin `Domain Admins` group. Note that Amazon FSx does not support having a `Delegated file system administrators group` (either the `Domain Admins` group or a custom group you specify) that is located in the Builtin container.