How do I create a Multi-AZ Amazon FSx for OpenZFS file system in a shared VPC from a participant account?

To create a Multi-AZ FSx for OpenZFS file system in a shared VPC, the VPC owner account must first enable route table updates for participant accounts. Then, the participant account can create the file system in the shared subnet.

Step 1: VPC owner enables Multi-AZ shared VPC support

The VPC owner must grant Amazon FSx permission to modify route tables on behalf of participant accounts. This is required because Multi-AZ file systems update routes during failover events.

Note: This step must be completed by the account that owns the VPC, not the participant account.

Using the console:

1. Open the Amazon FSx console.
2. In the navigation pane, choose Settings.
3. Under Multi-AZ shared VPC settings, choose Enable.

Using the AWS CLI:

# Check current setting
aws fsx describe-shared-vpc-configuration

# Enable Multi-AZ shared VPC support
aws fsx update-shared-vpc-configuration \
    --enable-fsx-route-table-updates-from-participant-accounts true

A successful response shows:

{
    "EnableFsxRouteTableUpdatesFromParticipantAccounts": "true"
}

Step 2: VPC owner shares subnets with participant accounts

If not already done, the VPC owner must share subnets using AWS RAM:

1. Open the AWS RAM console.
2. Choose Create resource share.
3. Select the subnets to share (you need subnets in at least two Availability Zones for Multi-AZ).
4. Specify the participant account IDs or organizational unit (OU).
5. Complete the resource share.

For more information, see Share your VPC with other accounts.

Step 3: Participant account creates the Multi-AZ file system

From the participant account, create the file system specifying subnets from two different Availability Zones:

aws fsx create-file-system \
    --file-system-type OPENZFS \
    --storage-capacity 10000 \
    --storage-type SSD \
    --subnet-ids subnet-aaaa1111 subnet-bbbb2222 \
    --security-group-ids sg-012345aaabbbcdef0 \
    --open-zfs-configuration '{
        "DeploymentType": "MULTI_AZ_1",
        "ThroughputCapacity": 160,
        "RootVolumeConfiguration": {
            "DataCompressionType": "LZ4"
        }
    }'

Important:

• --subnet-ids must include two shared subnets in different AZs (the first is the preferred subnet, the second is the standby).
• Use security groups owned by the participant account — you cannot use the VPC's default security group or security groups from other accounts.
• Ensure the subnets' CIDR ranges don't overlap with the file system's in-VPC CIDR range.

Step 4: Verify the file system is available

aws fsx describe-file-systems \
    --file-system-ids fs-01234aaaaabbef0 \
    --query 'FileSystems[0].{Status:Lifecycle,DeploymentType:OpenZFSConfiguration.DeploymentType,PreferredSubnet:SubnetIds[0],StandbySubnet:SubnetIds[1]}'

Wait for Lifecycle to show AVAILABLE.

Important considerations

• MISCONFIGURED state: If the VPC owner disables route table permissions while participant-created Multi-AZ file systems exist, those file systems enter a MISCONFIGURED state and cannot fail over. They behave like Single-AZ file systems until the setting is re-enabled.
• Unshared subnets: If a subnet is unshared while file systems exist, participants can no longer manage them and Multi-AZ file systems enter MISCONFIGURED state.
• Security groups: Participant accounts must create their own security groups. They cannot use the VPC owner's default security group.
• Availability: This feature is available in all AWS Regions where Amazon FSx for OpenZFS is available.

Related information

• Amazon FSx for OpenZFS documentation — Creating file systems using shared subnets
• VPC sharing
• Improve application resiliency and performance with Multi-AZ Amazon FSx for OpenZFS (AWS Storage Blog)
• Announcement: Amazon FSx for OpenZFS now supports creating Multi-AZ file systems in shared VPCs