File Gateway setup requirements

Unless otherwise noted, the following requirements are common to all File Gateway types in AWS Storage Gateway. Your setup must meet the requirements in this section. Review the requirements that apply to your gateway setup before you deploy your gateway.

Prerequisites

Before you set up your Amazon S3 File Gateway (S3 File Gateway), you must meet the following prerequisites:

Hardware and storage requirements

The following sections provide information about the minimum required hardware and storage configurations for your gateway, and the minimum amount of disk space to allocate for the required storage.

For information about best practices for File Gateway performance, see Basic performance guidance for S3 File Gateway.

Hardware requirements for on-premises VMs

When deploying your gateway on-premises, ensure that the underlying hardware on which you deploy the gateway virtual machine (VM) can dedicate the following minimum resources:

For more information, see Optimizing gateway performance. For information about how your hardware affects the performance of the gateway VM, see Quotas for file shares.

Requirements for Amazon EC2 instance types

When deploying your gateway on Amazon Elastic Compute Cloud (Amazon EC2), the instance size must be at least xlarge for your gateway to function. However, for the compute-optimized instance family the size must be at least 2xlarge.

Use one of the following instance types recommended for your gateway type.

Recommended for File Gateway types

Storage requirements

In addition to 80 GiB of disk space for the VM, you also need additional disks for your gateway.

For information about gateway quotas, see Quotas for file shares.

Network and firewall requirements

Your gateway requires access to the internet, local networks, Domain Name Service (DNS) servers, firewalls, routers, and so on.

Network bandwidth requirements vary based on the quantity of data that is uploaded and downloaded by the gateway. A minimum of 100Mbps is required to successfully download, activate, and update the gateway. Your data transfer patterns will determine the bandwidth necessary to support your workload.

Following, you can find information about required ports and how to allow access through firewalls and routers.

Port requirements

S3 File Gateway requires specific ports to be allowed through your network security for successful deployment and operation. Some ports are required for all gateways, while others are required only for specific configurations, such as when connecting to NFS or SMB clients, VPC endpoints, or Microsoft Active Directory.

For S3 File Gateway, you only need to use Microsoft Active Directory when you want to allow domain users to access a Server Message Block (SMB) file share. You can join your File Gateway to any valid Microsoft Windows domain (resolvable by DNS).

You can also use the AWS Directory Service to create an AWS Managed Microsoft AD in the Amazon Web Services Cloud. For most AWS Managed Microsoft AD deployments, you need to configure the Dynamic Host Configuration Protocol (DHCP) service for your VPC. For information about creating a DHCP options set, see Create a DHCP options set in the AWS Directory Service Administration Guide.

The following table lists the necessary ports and describes conditional requirements in the Notes column.

Port requirements for S3 File Gateway

The following illustration shows network traffic flow for a basic S3 File Gateway deployment.

Networking and firewall requirements for the Storage Gateway Hardware Appliance

Each Storage Gateway Hardware Appliance requires the following network services:

There are five physical network ports at the rear of the Dell PowerEdge R640 server. From left to right (facing the back of the server) these ports are as follows:

You can use the iDRAC port for remote server management.

A hardware appliance requires the following ports to operate.

To perform as designed, a hardware appliance requires network and firewall settings as follows:

All IP addresses on the same network interface (NIC), whether for a gateway or a host, must be on the same subnet. The following illustration shows the addressing scheme.

For more information about activating and configuring a hardware appliance, see Using the AWS Storage Gateway Hardware Appliance.

Allowing AWS Storage Gateway access through firewalls and routers

Your gateway requires access to the following service endpoints to communicate with AWS. If you use a firewall or router to filter or limit network traffic, you must configure your firewall and router to allow these service endpoints for outbound communication to AWS.

The following service endpoint is required by all gateways for head-bucket operations.

bucket-name.s3.region.amazonaws.com:443

The following service endpoints are required by all gateways for control path (anon-cp, client-cp, proxy-app) and data path (dp-1) operations.

anon-cp.storagegateway.region.amazonaws.com:443
client-cp.storagegateway.region.amazonaws.com:443
proxy-app.storagegateway.region.amazonaws.com:443
dp-1.storagegateway.region.amazonaws.com:443

The following gateway service endpoint is required to make API calls.

storagegateway.region.amazonaws.com:443

The following example is a gateway service endpoint in the US West (Oregon) Region (us-west-2).

storagegateway.us-west-2.amazonaws.com:443

Amazon S3 service endpoints

Amazon S3 File Gateway requires the following 3 types of endpoints to connect to the Amazon S3 service:

Amazon S3 service endpoint

s3.amazonaws.com

Amazon S3 regional endpoints

s3.region.amazonaws.com

The following example shows an Amazon S3 regional endpoint in the US East (Ohio) Region (us-east-2).

s3.us-east-2.amazonaws.com

The following example shows a FIPS-compliant Amazon S3 regional endpoint in the US West (N. California) Region (us-west-1).

s3-fips.us-west-1.amazonaws.com

The following examples show the Amazon S3 regional endpoints used by AWS GovCloud (US) Regions:

s3-fips.us-gov-west-1.amazonaws.com (AWS GovCloud (US-West) Region (FIPS))
s3-fips.us-gov-east-1.amazonaws.com (AWS GovCloud (US-East) Region (FIPS))
s3.us-gov-west-1.amazonaws.com (AWS GovCloud (US-West) Region (Standard))
s3.us-gov-east-1.amazonaws.com (AWS GovCloud (US-East) Region (Standard))

Amazon S3 bucket endpoints

bucket-name.s3.region.amazonaws.com

The following example shows an Amazon S3 bucket endpoint for a bucket named amzn-s3-demo-bucket in the US East (Ohio) Region (us-east-2).

amzn-s3-demo-bucket.s3.us-east-2.amazonaws.com

The following example shows a FIPS-compliant Amazon S3 bucket endpoint for a bucket named amzn-s3-demo-bucket1 in the AWS GovCloud (US-East) Region (us-gov-east-1).

amzn-s3-demo-bucket1.s3-fips.us-gov-east-1.amazonaws.com

In addition to the Storage Gateway and Amazon S3 service endpoints, Storage Gateway VMs also require network access to the following NTP servers:

0.amazon.pool.ntp.org
1.amazon.pool.ntp.org
2.amazon.pool.ntp.org
3.amazon.pool.ntp.org

Configuring security groups for your Amazon EC2 gateway instance

In AWS Storage Gateway, a security group controls traffic to your Amazon EC2 gateway instance. When you configure a security group, we recommend the following:

For information about the ports to open for your gateway, see Port requirements.

Supported hypervisors and host requirements

You can run Storage Gateway on-premises as either a virtual machine (VM) appliance or a physical hardware appliance, or in AWS as an Amazon EC2 instance.

Storage Gateway supports the following hypervisor versions and hosts:

Supported NFS and SMB clients for File Gateway

File Gateway supports the following Network File System (NFS) clients:

Supported file system operations for File Gateway

Your NFS or SMB client can write, read, delete, and truncate files. When clients send writes to AWS Storage Gateway, it writes to local cache synchronously. Then it writes to Amazon S3 asynchronously through optimized transfers. Reads are first served through the local cache. If data is not available, it's fetched through S3 as a read-through cache.

Writes and reads are optimized in that only the parts that are changed or requested are transferred through your gateway. Deletes remove objects from Amazon S3. Directories are managed as folder objects in S3, using the same syntax as in the Amazon S3 console.

HTTP operations such as GET, PUT, UPDATE, and DELETE can modify files in a file share. These operations conform to the atomic create, read, update, and delete (CRUD) functions.