A company is moving Windows Server SMB file shares to AWS and wants to use Amazon FSx for Windows File Server. Access is controlled by a self-managed on‑premises Active Directory, and the company must ensure the existing Active Directory groups continue to restrict access to FSx SMB shares, folders, and files after migration. The FSx for Windows File Server file system has been created. Which solution meets these requirements?

The correct solution is to join the FSx for Windows File Server file system to the existing self-managed Active Directory. Amazon FSx for Windows File Server is designed to integrate seamlessly with Active Directory for authentication and access control. By joining the file system to the domain, existing Active Directory users and groups will automatically be recognized and can be used to manage permissions on SMB shares, folders, and files, just as they did on-premises. Incorrect options: Creating an Active Directory Connector and mapping Active Directory groups to IAM groups is not the correct approach for FSx for Windows File Server. FSx integrates directly with Active Directory for SMB permissions, not via IAM group mapping. Assigning tags is for resource organization and management within AWS, not for controlling access to file shares based on Active Directory groups. Creating an IAM service-linked role is for granting AWS services permissions to perform actions on your behalf, not for managing user and group access to file shares within FSx for Windows File Server.