Roadrunner SMB — Deployment Guide

Last Updated: 2026-04-20

Who this is for

This guide is for AWS administrators and DevOps engineers deploying Roadrunner SMB from the AWS Marketplace into an existing VPC. It assumes familiarity with CloudFormation, VPC networking, and Active Directory.

Not a fit for this guide: customers who want to evaluate RRSMB before having an AD domain ready. See Quick Start for the end-to-end first-deployment flow.

Architecture Overview

Roadrunner SMB deploys a fixed-size, active-active SMB cluster into your AWS VPC. All nodes serve SMB traffic simultaneously; the Network Load Balancer distributes connections across them.

Your VPC
│
├── AZ-1 (private subnet)         AZ-2 (private subnet)
│   └── RRSMB Node 1              └── RRSMB Node 2
│                                 └── RRSMB Node 3
│
├── Network Load Balancer (NLB)
│   └── Port 445  → all RRSMB nodes (SMB)
│
├── Application Load Balancer (ALB)
│   └── Port 443  → all RRSMB nodes port 8888 (Admin UI, HTTPS)
│
├── Amazon EFS (shared storage — all nodes mount it)
│   ├── Share data (one EFS access point per share)
│   └── CTDB cluster coordination files
│
└── Amazon DynamoDB (regional, no AZ boundary)
    ├── NT ACL store
    └── CTDB cluster mutex

Key components

AWS Prerequisites

Account quotas

Verify your account has sufficient quota for:

• EC2: 3 instances (m5.large by default)
• EFS: 1 file system, 2+ mount targets
• DynamoDB: 2 tables
• ECS: 1 cluster, 1 service, 3 tasks
• NLB: 1 load balancer, 2 listeners, 2 target groups
• Secrets Manager: 2 secrets (bootstrap secret created by stack + optional AD join secret for re-join reference)
• CloudWatch Logs: 1 log group

Networking requirements

VPC endpoints (optional but recommended)

To avoid NAT Gateway costs for AWS API traffic, create VPC interface endpoints for:

• com.amazonaws.<region>.ecr.api
• com.amazonaws.<region>.ecr.dkr
• com.amazonaws.<region>.ecs
• com.amazonaws.<region>.ecs-agent
• com.amazonaws.<region>.secretsmanager
• com.amazonaws.<region>.logs
• com.amazonaws.<region>.dynamodb (gateway endpoint, no cost)
• com.amazonaws.<region>.elasticfilesystem

CloudFormation Parameters

All parameters are set during the Marketplace launch flow. Required parameters:

Note: Active Directory join credentials are entered interactively in the First-Time Setup wizard — no pre-created secret is required as a deployment parameter.

Optional parameters (have defaults):

Stack Outputs

After deployment, the following outputs are available in the CloudFormation console under the Outputs tab:

Multi-AZ Topology

The stack distributes nodes across the provided subnets. AWS attempts to balance instances across AZs automatically.

Minimum resilience: with 2 AZs and 3 nodes, at least 2 nodes survive an AZ failure. CTDB maintains quorum and the cluster remains fully operational.

AZ placement rules:

• Provide subnets in at least 2 AZs
• The stack creates one EFS mount target per subnet
• CTDB tolerates the loss of any single node; SMB traffic continues on surviving nodes

Scaling

Scaling is controlled exclusively by AWS infrastructure, not the Admin UI.

To adjust cluster size:

1. Update the CloudFormation stack with a new ClusterSize parameter value
2. The ASG and ECS service update automatically via rolling replacement

Validated range: 1–4 nodes. Deployments outside this range are not validated and not supported.

The Admin UI shows the current node count but does not provide scaling controls.

Admin UI Access

In Marketplace (multi-AZ) deployments, the Admin UI is accessed via the ALB on port 443 (HTTPS). The ALB terminates TLS and forwards traffic internally to RRSMB nodes on port 8888. The AdminUIUrl CloudFormation output contains the ALB DNS name.

Access is restricted to the AdminCidr security group on the ALB.

Single-node / EasyButton mode: In non-Marketplace single-node deployments, the NLB handles both SMB (port 445) and Admin UI traffic directly on port 8888 without ALB TLS termination.

Updating the Software

Updates are delivered as new container image tags via the AWS Marketplace or your ECR registry.

Update procedure:

1. A new RRSMB image version is released
2. In the CloudFormation console, click your stack → Update
3. Change BackendImageUri to the new image URI
4. Submit the stack update

The ASG performs a rolling node replacement maintaining at least 2 of 3 nodes healthy throughout the update. No downtime for SMB clients during a rolling update under normal conditions.

Post-Deployment Checklist

After the stack reaches CREATE_COMPLETE:

• Admin UI is accessible at AdminUIUrl
• Bootstrap secret retrieved from BootstrapSecretConsoleUrl
• First-Time Setup wizard completes successfully
• Domain join succeeds (Setup page shows domain joined)
• Cluster page shows all nodes as healthy (green)
• Create a test share and mount from a Windows machine
• Verify file read and write in the mounted share

References

• Quick Start Guide
• Admin Guide
• Known Limitations
• Support & Troubleshooting