AWS Storage Gateway, Руководство пользователя

Страница: 336 / 438

AWS Storage Gateway User Guide
SMB File Shares Do Not Allow
Multiple Different Access Methods
2. If the Amazon S3 bucket exists, then verify that AWS Security Token Service is enabled in the region
where you are creating the file share. If a security token is not enabled, you should enable it. For
information about how to enable a token using AWS Security Token Service, see Activating and
Deactivating AWS STS in an AWS Region in the IAM User Guide .
SMB File Shares Do Not Allow Multiple Different
Access Methods
SMB file shares have the following restrictions:
1. When the same client attempts to mount both an Active Directory and Guest access SMB file share
the following error message is displayed:
Multiple connections to a server or shared
resource by the same user, using more than one user name, are not allowed.
Disconnect all previous connections to the server or shared resource and try
again.
2. A Windows user cannot remain connected to two Guest Access SMB file shares, and may be
disconnected when a new Guest Access connection is established.
3. A Windows client can't mount both a Guest Access and an Active Directory SMB file share that is
exported by the same gateway.
Multiple File Shares Can't Write to the Mapped
Amazon S3 Bucket
We don't recommend configuring your Amazon S3 bucket to allow multiple file shares to write to one S3
bucket. This approach can cause unpredictable results.
Instead, we recommend that you allow only one file share to write to each S3 bucket. You create a bucket
policy to allow only the role associated with your file share to write to the bucket. For more information,
see File Share Best Practices (p. 155) .
You Can't Upload Files into Your S3 Bucket
If you can't upload files into your Amazon S3 bucket, do the following:
1. Make sure you have granted the required access for the file gateway to upload files into your S3
bucket. For more information, see Granting Access to an Amazon S3 Bucket (p. 144) .
2. Make sure the role that created the bucket has permission to write to the S3 bucket. For more
information, see File Share Best Practices (p. 155) .
Can't Change the Default Encryption to Use SSE-KMS
to Encrypt Objects Stored in My Amazon S3 Bucket.
If you change the default encryption and make SSE-KMS (server-side encryption with AWS KMS–
managed keys) the default for your S3 bucket, objects that a file gateway stores in the bucket are not
encrypted with SSE-KMS. By default, a file gateway uses server-side encryption managed with Amazon
S3 (SSE-S3) when it writes data to an Amazon S3 bucket. Changing the default won't automatically
change your encryption.
To change the encryption to use SSE-KMS with your own AWS KMS key, you must enable SSE-KMS
encryption. To do so, you provide the Amazon Resource Name (ARN) of the KMS key when you create
API Version 2013-06-30
329