Secure shared storage with CIFS share-level access controls on Amazon FSx for NetApp ONTAP

This article explains how to implement CIFS share-level access controls on Amazon FSx for NetApp ONTAP to restrict user access to shared storage by team.

• Create qtrees as logical subdivisions representing each team within a shared volume
• Map each qtree to a dedicated CIFS share with independent access control boundaries
• Remove default "Everyone: Full Control" entries to eliminate unrestricted access
• Configure share ACLs with AD groups using Full_Control, Change, Read, or No_access permissions
• Use No_access to explicitly deny individual users, overriding group-level permissions
• Enable access-based enumeration to hide files users cannot access
• Share ACLs operate as middle security layer between network policies and file-level NTFS permissions
• Modify ACLs dynamically without disrupting existing user connections

This approach enforces per-team access boundaries, simplifies compliance audits, and reduces onboarding overhead through AD group membership management.