Security overview
Last Updated: 2026-08-24
Roadrunner SMB™ 1.3 uses a two-tier Admin model. The Admin UI always sits behind AWS® WAF and an Application Load Balancer. SMB file traffic stays on a private Network Load Balancer. For operational identity detail, see FAQ and Known Limitations.
Deployment model and data residency
- Roadrunner SMB deploys as a CloudFormation® stack in your AWS account and VPC.
- Customer file data remains on customer-owned Amazon EFS® in your account and Region.
- ACL metadata and cluster coordination state are stored in Amazon DynamoDB® in your account.
- RRSMB does not move SMB file contents to Roadrunner SMB-operated storage outside your account.
Two delivery paths
| Eval Kit | Dual-AZ (production) | |
|---|---|---|
| Purpose | Technical evaluation and POC only | Only supported production configuration |
| AZ | Single-AZ appliance (Admin ALB still spans two AZs) | Two Availability Zones |
| Admin UI | Internet via CloudFront + WAF + public ALB | Private network only (ALB + WAF). Reach it from a customer/MSP jump box, VPN, Direct Connect, or equivalent |
| SMB (TCP/445) | Private NLB | Private NLB |
| Why Admin is public on Eval | So evaluators can try the product without designing a VPC security path first | - |
| Why Admin is private on Dual-AZ | - | RRSMB must fit the security model your VPC already uses. We provide the Admin endpoint on ALB/WAF in the private network. You provide the secure access path |
Do not publish or bookmark the Eval Admin ALB DNS. Use AdminUIUrl (CloudFront). The ALB rejects requests that omit the CloudFront origin-verify header.
Encryption
| Layer | Protection |
|---|---|
| EFS at rest | AWS-managed encryption at rest on customer EFS file systems |
| Appliance ↔ EFS | TLS via stunnel (amazon-efs-utils) on NFS paths |
| Eval Admin UI | HTTPS at CloudFront (*.cloudfront.net) |
| Dual-AZ Admin UI | HTTPS on the private ALB (stack-scoped certificate, or your AdminCertificateArn) |
| SMB clients | SMB3 signing/encryption per client and Samba negotiation (see Known Limitations) |
| Secrets | Domain join and bootstrap credentials in AWS Secrets Manager |
Network access
| Path | Eval Kit | Dual-AZ |
|---|---|---|
| Admin | CloudFront (WAF: CRS, Known Bad Inputs, login rate limit) → public ALB (origin-verify header required) → tasks | Private ALB + WAF. No internet-facing Admin listener |
| SMB | Internal NLB :445, limited by SmbClientCidr |
Internal NLB :445, limited by SmbClientCidr |
| Nodes | Private subnets | Private subnets |
SMB is not marketed or configured for anonymous public internet access.
Production (Dual-AZ): connect to Admin the same way you already reach private applications in that VPC - VPN, Direct Connect, a jump box, or another path you own. Roadrunner SMB does not require a public Admin CIDR allow-list.
Identity and access
- SMB: Active Directory® only (Kerberos/NTLM). No guest/anonymous access.
- Admin UI: Domain administrators (when enabled) and break-glass Appliance Owner (
rrsmb-admin) from First-Time Setup. - AWS API calls: Instance and task IAM roles scoped to required services in your account - separate from the human deployer principal used at install.
Planning guide: Identity and permissions · Deployer permission matrix · AD domain join delegation
Audit and logging
- Security-relevant Admin actions emit immutable audit events to CloudWatch Logs (login, share changes, AD join, support mode, configuration changes).
- Support Reports offer redaction levels before download; reports are not uploaded automatically.
Billing metering and EFS scope
Marketplace ManagedStorageGBHours reflects the entire EFS filesystem size attached to a billable share, not just the share folder path. Mounting a large existing filesystem for a small share can produce significant metering. Plan before share creation - see Known Limitations — billing.
Compliance posture
| Topic | Status |
|---|---|
| SOC 2 / ISO / HIPAA attestation by Roadrunner SMB LLC | Not offered as a vendor attestation package; customers inherit AWS shared responsibility and their own compliance programs |
| Data residency | Customer-selected AWS Region; data stays in customer account |
| Marketplace security review | Product submitted through AWS Marketplace container-product process |
For procurement questionnaires, start with this page, the AWS Marketplace deployment summary, and the Architecture Whitepaper.