Security overview

Last Updated: 2026-06-15

Consolidated security, compliance, and data-handling summary for Roadrunner SMB™ on AWS® Marketplace. For operational detail, see the FAQ — Security and permissions and Known Limitations.

Deployment model and data residency

• Roadrunner SMB deploys as a CloudFormation® stack in your AWS account and VPC.
• Customer file data remains on customer-owned Amazon EFS® in your account and Region.
• ACL metadata and cluster coordination state are stored in Amazon DynamoDB® in your account.
• RRSMB does not move SMB file contents to Roadrunner SMB–operated storage outside your account.

Encryption

Network access controls

RRSMB nodes run in private subnets. Public subnets host the NLB for Admin HTTPS (and SMB listener with CIDR restrictions).

Production recommendation: After deploy, update the nested stack and set AdminIngressCidr to trusted administrator networks. See Quick Start — Harden for production and Restricting Admin UI access below.

Restricting Admin UI access

The Admin UI is served on HTTPS port 443 on the stack Network Load Balancer. Access is controlled by AdminIngressCidr, which sets the inbound TCP/443 rule on the NLB security group.

Do not use AdminCidr for Admin UI. Admin traffic path: client → NLB:443 (TLS termination) → task 8888 (allowed from the NLB security group only, not from arbitrary internet CIDRs on nodes).

Recommended: CloudFormation (keeps stack as source of truth)

1. Open CloudFormation → nested appliance stack (…-InnerStack-…) → Update.
2. Set AdminIngressCidr to trusted source CIDRs, for example:
   • Single admin IP: 203.0.113.10/32
   • Corporate VPN egress: 198.51.100.0/24
   • Private admin network (site-to-site VPN): 10.20.0.0/16
3. Complete the stack update. CloudFormation updates the NLB security group inbound rule on port 443.

Avoid hand-editing security group rules unless you accept drift from the stack.

Find in the AWS Console: EC2 → Security Groups → filter rrsmb- → select rrsmb-<EnvironmentName>-nlb → Inbound rules → 443.

Access patterns

Jump box example: deploy or use a bastion in the VPC → set AdminIngressCidr to the bastion public /32 → SSH to the bastion → open AdminUIUrl in a browser on the bastion (or ssh -L 8443:<nlb-dns>:443 user@bastion and browse https://localhost:8443).

If the Admin UI is unreachable after hardening, confirm your current source IP is inside AdminIngressCidr, verify inbound 443 on rrsmb-…-nlb, and use AdminUIUrl from the parent stack Outputs (HTTPS, not task port 8888). See Support & Troubleshooting — Admin UI unreachable.

Identity and access

• SMB: Active Directory® only (Kerberos/NTLM). No guest/anonymous access.
• Admin UI: Domain administrators (when enabled) and break-glass Appliance Owner (rrsmb-admin) from First-Time Setup.
• AWS API calls: Instance and task IAM roles scoped to required services in your account — separate from the human deployer principal used at install.

Planning guide: Identity and permissions · Deployer permission matrix · AD domain join delegation

Audit and logging

• Security-relevant Admin actions emit immutable audit events to CloudWatch Logs (login, share changes, AD join, support mode, configuration changes).
• Support Reports offer redaction levels before download; reports are not uploaded automatically.

Billing metering and EFS scope

Marketplace ManagedStorageGBHours reflects the entire EFS filesystem size attached to a billable share, not just the share folder path. Mounting a large existing filesystem for a small share can produce significant metering. Plan before share creation — see Known Limitations — billing.

Compliance posture (GA)

For procurement questionnaires, start with this page, the AWS Marketplace deployment summary, and architecture diagrams in the Architecture Whitepaper.

Related documentation

• FAQ
• Identity and permissions
• Deployment Guide — networking
• Support & Troubleshooting