3

I've got EC2 instance with IIS and mapped FSx file system on AWS. All in one VPC in one subnet.

IIS config works perfectly as long as it's configured with local drive. When I change config to use path from that mapped FSx I've got an error. Even for just a test static page.

error

All current users have full access to those files. Do I need to set up any special users for IIS on Domain Controller? Any special permissions? I would appreciate any ideas...

kkarczewski
  • 331
  • 3
  • 19
  • Mapped drives are not supported, https://blog.lextudio.com/the-most-common-technologies-not-supported-by-microsoft-8675c409bde2 – Lex Li Mar 20 '20 at 12:44
  • Probably I used 'mapped' incorectly. To specify. I've got files on FSx that is attached to multiple EC2 instances as D drive. How can I serve those files with IIS? – kkarczewski Mar 20 '20 at 13:11
  • Beside that after AWS FSx docs: Content management and web serving applications, like Microsoft Internet Information Services (IIS) and WordPress, store and serve files for websites and internal portals. These applications use shared file storage because multiple web or content servers typically need access to the same files. Amazon FSx is ideal for these workloads because it provides a file system that can be accessed across thousands of instances simultaneously. – kkarczewski Mar 20 '20 at 14:19
  • https://learn.microsoft.com/en-us/iis/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis – Lex Li Mar 20 '20 at 14:33

3 Answers3

0

First of all, you need to figure out the substatus code of your IIS server and detailed error message. So please enable IIS detailed error message for your website.

I assume this issue happened just because your identity don't have permission to access configuration file.

1.Please Ensure your IIS site->basic settings->connect as..->set your domain account that have permission to accessyour FSX

2.Please set your application pool identity to your domain account that have access to the FSx.

3.Please grant permission for that application pool account.

4.Please set your authentication user to use application pool identity. For example, if you are using anonymous authentication. Then go to->anonymous authentication->edit..->Application pool identity.

enter image description here

If you don't know how to troubleshooting this issue. Prcoss monitor would help. You only have to create a filter "RESULT=Access denied & Processname="w3wp.exe".

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

Jokies Ding
  • 3,374
  • 1
  • 5
  • 10
0

SOLTUION: you can not use the drive letter must be full DNS name for fsx console \DNS_NAME\share

enter image description here

I am having this exact issue. Drive is available on ec2 instance but authorization in IIS fails. Browse directory from IIS workd but can not get authorization to pass test. I have tried admin on EC2 and admin on active directory as users in IIS virtual drive. enter image description here

LrakWortep
  • 217
  • 1
  • 4
  • 15
0

It seems that you need to configure the IIS application pool identity to use a domain account that has access to the FSx file system. By default, the application pool identity is a local account that does not have any permissions on the network share.

To change the application pool identity, follow these steps:

  • Open IIS Manager and select the application pool that hosts your website.
  • Click on Advanced Settings in the Actions pane.
  • Under Process Model, click on Identity and then on the ellipsis (...) button.
  • Select Custom account and enter the domain user name and password that has access to the FSx file system. Click OK to save the changes.
  • Restart the application pool and the website.

Alternatively, you can use the command line tool appcmd.exe to set the application pool identity. For example, to set the identity to domain\user for the DefaultAppPool, you can run:

appcmd.exe set config /section:applicationPools /[name='DefaultAppPool'].processModel.identityType:SpecificUser /[name='DefaultAppPool'].processModel.userName:domain\user /[name='DefaultAppPool'].processModel.password:password

You can also use PowerShell to set the application pool identity. For example, to set the identity to domain\user for the DefaultAppPool, you can run:

Import-Module WebAdministration
Set-ItemProperty IIS:\AppPools\DefaultAppPool -Name processModel -Value @{identityType="SpecificUser";userName="domain\user";password="password"}

For more information, see this article on how to access FSx file shares from IIS.

PaulvdBoor
  • 296
  • 2
  • 2