Amazon FSx

What it is

Amazon FSx runs popular file systems as fully managed services. AWS sets up the file servers and storage, patches the software, replaces failed hardware, handles FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry, and takes backups. You choose the file system that matches what your applications already use:

FSx type	Built on	Protocols	Clients	Choose for
FSx for Windows File Server	Microsoft Windows Server	SMB (Server Message Block)The file-sharing protocol used by Windows. Amazon FSx for Windows File Server and Amazon FSx for NetApp ONTAP provide SMB shares, and Amazon S3 File Gateway can present S3 buckets as SMB shares.Glossary entry (2.0–3.1.1)	Windows, Linux, macOS	Windows file shares, home directories, SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry Server, apps that need Active Directory and NTFS permissions
FSx for Lustre	Lustre, a parallel file system	Lustre client	Linux	HPC (High performance computing)Using many powerful computers together on large problems, such as simulations, genomics, or weather forecasting, often with fast networking between them. On AWS it uses EC2 instances with Elastic Fabric Adapter, AWS Batch, and AWS ParallelCluster.Glossary entry, ML (Machine learning)Software that learns patterns from example data to make predictions or decisions, instead of following rules written by hand. A model is first trained on data, then used to make predictions on new data, which is called inference.Glossary entry, media rendering, financial modeling: very high throughput, often on data in S3
FSx for NetApp ONTAP	NetApp ONTAP	NFS (Network File System)A protocol for sharing files over a network, used mostly by Linux and Unix systems. Amazon EFS, Amazon FSx for OpenZFS, and Amazon FSx for NetApp ONTAP provide NFS file systems.Glossary entry, SMB, iSCSI, NVMe/TCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entry	Windows, Linux, macOS	Moving NetApp or other NAS workloads, multi-protocol access, block storage and file storage from one system
FSx for OpenZFS	OpenZFS	NFS (v3–4.2)	Windows, Linux, macOS	Moving ZFS or other Linux file servers, very low LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry (hundreds of microseconds)

AWS's own rule of thumb: pick the FSx type that matches your current storage technology (Windows Server, Lustre, NetApp ONTAP, or ZFS). For a simple, elastic NFS file system for Linux with no capacity to manage, use Amazon EFS instead.

FSx for Windows File Server

A native Windows file system with SMB, NTFS, and Windows features, joined to Microsoft Active Directory: either AWS Managed Microsoft AD or your self-managed AD (On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry or on EC2).
Deployment types: Single-AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry (1 and 2) keeps data in one Availability Zone; Multi-AZRunning standby or extra copies of a resource in other Availability Zones so that it survives the loss of one. An Amazon RDS Multi-AZ deployment keeps one or two standby copies and fails over to one automatically.Glossary entry runs an active file server and a standby in a second zone, replicates data synchronously between them, and fails over automatically during an AZ outage or maintenance. AWS recommends Multi-AZ for most production workloads, and continuously available (CA (Certificate authority)A trusted organization or service that issues digital certificates, vouching that a public key belongs to a named domain or organization. Browsers trust certificates signed by well-known CAs; AWS Private CA issues certificates for internal use.Glossary entry) shares on Multi-AZ for SQL Server HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry.
Storage: SSD (Solid state drive)Storage on flash memory with no moving parts, fast at small random reads and writes (high IOPS). Amazon EBS gp3, gp2, io2, and io1 volumes are SSD-backed.Glossary entry for low latency and high IOPS (Input/output operations per second)How many read and write operations a storage volume can handle each second. It matters for databases that make many small random reads and writes; throughput, in MB per second, matters for large sequential ones.Glossary entry, or HDD (Hard disk drive)Storage on spinning magnetic disks: cheaper per gigabyte and good at large sequential reads and writes, but slow at small random ones. Amazon EBS st1 and sc1 volumes are HDD-backed.Glossary entry for lower cost (home directories, departmental shares). You set storage capacity, SSD IOPS, and throughput capacity, and can change them later.
Features: shadow copies (users restore previous versions of files themselves), data deduplication, user storage quotas, DFS namespaces to group many file systems under one path, and DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry aliases to keep existing share names during a migration.
Reachable from EC2, WorkSpaces, and on premises over Direct Connect or Site-to-Site VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry.

FSx for Lustre

Lustre is built for the fastest computers: sub-millisecond latency, very high throughput across many clients at once, and POSIX compatibility for Linux applications. EC2 instances, ECS containers, and EKS pods can mount it.
S3 integration: link a file system to an S3 bucket with a data repository association. S3 objects appear as files, new objects can be imported automatically, and changes can be exported back to S3 automatically. SageMaker AI training jobs can read from it without first downloading from S3.
Deployment types:
- Scratch: temporary storage for short, processing-heavy jobs. Data isn't replicated and doesn't survive a file server failure, and backups aren't supported.
- Persistent (Persistent 2 is the latest): for longer-term storage, with automatic replacement of failed servers and replicated data.
Storage classes: SSD (lowest latency), HDD, and Intelligent-Tiering (elastic, cost-optimized; recommended for most workloads that don't need consistent low latency).

FSx for NetApp ONTAP

Full ONTAP features, managed by AWS: NFS, SMB, iSCSI, and NVMe/TCP from one file system, so Linux, Windows, and macOS clients, and block-storage users, share it.
Two tiers: a provisioned SSD tier for active data and an elastic capacity pool tier for infrequently accessed data. A volume's tiering policy moves cold data to the capacity pool automatically, so you pay SSD prices for only a fraction of the data.
Data management: snapshots, FlexClone writable clones, compression, deduplication, and compaction, SnapMirror replication (in-AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry or cross-Region, and from on-premises NetApp systems to AWS, as often as every 5 minutes), FlexCache, and SnapLock WORM (Write once, read many)A storage model in which data can be written once and then cannot be changed or deleted for a set period, often to meet record-keeping rules. Amazon S3 Object Lock and AWS Backup Vault Lock provide it.Glossary entry retention.
Deployment types: Single-AZ (active-standby file server pairs in one zone) and Multi-AZ (a standby file server in a second zone, with writes replicated synchronously).

FSx for OpenZFS

OpenZFS over NFS v3 to v4.2, for moving ZFS or Linux file servers without changing applications.
Performance: up to 2 million IOPS with latencies of hundreds of microseconds for cached data.
Data management: near-instant snapshots, clones (writable copies from snapshots), and compression.
Deployment types: Multi-AZ (HA), Single-AZ (HA), and Single-AZ (non-HA). Storage classes: SSD and Intelligent-Tiering.

Security, resilience, performance, and cost

Security

File systems run in your VPC; control network access with Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry.
All four types encrypt data and backups at rest with AWS KMS keys, and encrypt in transit from supported instances (plus SMB encryption and Kerberos where the protocol supports it).
Windows and ONTAP integrate with Active Directory for user authentication and file permissions.
IAM controls who can create and manage file systems; CloudTrail records FSx API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls.

Resilience

Choose Multi-AZ (Windows, ONTAP, OpenZFS) to survive the loss of an Availability Zone; Single-AZ keeps data in one zone.
Backups are incremental and stored in S3 with 11 nines of durability. Windows takes automatic daily backups by default (30-day retention when created in the console), backups can be copied to another Region for DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry, and AWS Backup can apply backup plans across the accounts in an organization. Lustre backups work only on persistent file systems not linked to S3.

Performance

You provision throughput capacity (and SSD IOPS where offered); SSD gives sub-millisecond latency, HDD single-digit milliseconds.
Lustre gives the highest aggregate throughput, for HPC and ML; OpenZFS gives the lowest latency.

Cost

Pay for provisioned storage, throughput capacity, SSD IOPS above the included amount, and backups. ONTAP also charges for capacity pool storage and requests.
Save with HDD (Windows, Lustre), data deduplication and compression, ONTAP capacity pool tiering, Intelligent-Tiering (Lustre, OpenZFS), and Lustre scratch file systems for short jobs.

Monitoring

CloudWatch metrics for throughput, IOPS, storage, and capacity; Windows supports file access auditing to CloudWatch Logs or Data Firehose.

FSx type or EFS?

If the requirement is	Choose
Windows SMB shares with Active Directory and NTFS permissions	FSx for Windows File Server
HPC or ML with very high throughput, linked to S3	FSx for Lustre
Temporary high-speed storage for a short job	FSx for Lustre scratch
NFS, SMB, and iSCSI from one system, or moving NetApp	FSx for NetApp ONTAP
Moving ZFS file servers, lowest latency over NFS	FSx for OpenZFS
Simple, elastic NFS for Linux with nothing to provision	Amazon EFS

Reverse mindmap: when the question points here

Which Amazon FSx?

FSx for Windows File Server
- Windows file shares over SMB leads to FSx for Windows
- Integrate file shares with Active Directory leads to FSx for Windows
- Survive an AZ failure for Windows shares leads to Multi-AZ deployment
- Users restore previous versions of files leads to Shadow copies
FSx for Lustre
- HPC or ML needing very high throughput leads to FSx for Lustre
- Process S3 data as a file system leads to Data repository association
- Short job, cheapest temporary storage leads to Scratch deployment
FSx for NetApp ONTAP
- Migrate NetApp NAS to AWS leads to FSx for ONTAP
- NFS, SMB, and iSCSI on one system leads to FSx for ONTAP
- Replicate on-premises NetApp data to AWS leads to SnapMirror
FSx for OpenZFS
- Migrate ZFS file servers leads to FSx for OpenZFS
- Sub-millisecond NFS with snapshots and clones leads to FSx for OpenZFS
Not FSx
- Elastic NFS for Linux, nothing to provision leads to Amazon EFS

Key takeaways

FSx gives four managed file systems: Windows File Server (SMB, Active Directory), Lustre (HPC and ML, linked to S3), NetApp ONTAP (multi-protocol, tiering), and OpenZFS (NFS, very low latency).
Choose the type that matches the storage technology the workload already uses.
Windows, ONTAP, and OpenZFS offer Multi-AZ deployments with automatic failover; Lustre offers scratch (temporary, not replicated) and persistent deployments.
All types encrypt at rest with KMS; backups are incremental, stored in S3, and can be managed by AWS Backup.
For simple elastic NFS storage for Linux, choose EFS instead.