Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon S3 File Gateway documentation has been moved to What is Amazon S3 File Gateway?

Amazon FSx File Gateway documentation has been moved to What is Amazon FSx File Gateway?

Volume Gateway documentation has been moved to What is Volume Gateway?

Requirements

Unless otherwise noted, the following requirements are common to all gateway configurations.

Hardware and storage requirements

This section describes the minimum hardware and settings for your gateway and the minimum amount of disk space to allocate for the required storage.

Hardware requirements for VMs

When deploying your gateway, you must make sure that the underlying hardware on which you deploy the gateway VM can dedicate the following minimum resources:

For more information, see Optimizing Gateway Performance. For information about how your hardware affects the performance of the gateway VM, see Amazon Storage Gateway quotas.

Requirements for Amazon EC2 instance types

When deploying your gateway on Amazon Elastic Compute Cloud (Amazon EC2), the instance size must be at least xlarge for your gateway to function. However, for the compute-optimized instance family the size must be at least 2xlarge.

For Tape Gateway, your Amazon EC2 instance should dedicate the following amounts of RAM depending on the cache size you plan to use for your gateway:

Use one of the following instance types recommended for your gateway type.

Recommended for cached volumes and Tape Gateway types

Storage requirements

In addition to 80 GiB disk space for the VM, you also need additional disks for your gateway.

The following table recommends sizes for local disk storage for your deployed gateway.

For information about gateway quotas, see Amazon Storage Gateway quotas.

Network and firewall requirements

Your gateway requires access to the internet, local networks, Domain Name Service (DNS) servers, firewalls, routers, and so on. Following, you can find information about required ports and how to allow access through firewalls and routers.

Port requirements

Storage Gateway requires certain ports to be allowed for its operation. The following illustrations show the required ports that you must allow for each type of gateway. Some ports are required by all gateway types, and others are required by specific gateway types. For more information about port requirements, see Port Requirements.

Common ports for all gateway types

The following ports are common to all gateway types and are required by all gateway types.

Ports for volume and Tape Gateways

The following illustration shows the ports to open for Tape Gateway.

In addition to the common ports, Tape Gateway requires the following port.

For detailed information about port requirements, see Port Requirements in the Additional Storage Gateway resources section.

Networking and firewall requirements for the Storage Gateway Hardware Appliance

Each Storage Gateway Hardware Appliance requires the following network services:

There are five physical network ports at the rear of the Dell PowerEdge R640 server. From left to right (facing the back of the server) these ports are as follows:

You can use the iDRAC port for remote server management.

A hardware appliance requires the following ports to operate.

To perform as designed, a hardware appliance requires network and firewall settings as follows:

All IP addresses on the same network interface (NIC), whether for a gateway or a host, must be on the same subnet. The following illustration shows the addressing scheme.

For more information on activating and configuring a hardware appliance, see Using the Storage Gateway Hardware Appliance.

Allowing Amazon Storage Gateway access through firewalls and routers

Your gateway requires access to the following service endpoints to communicate with Amazon. If you use a firewall or router to filter or limit network traffic, you must configure your firewall and router to allow these service endpoints for outbound communication to Amazon.

The following service endpoint is required by all gateways for head-bucket operations.

s3.amazonaws.com.cn:443

The following service endpoints are required by all gateways for control path (anon-cp, client-cp, proxy-app) and data path (dp-1) operations.

anon-cp.storagegateway.region.amazonaws.com.cn:443
client-cp.storagegateway.region.amazonaws.com.cn:443
proxy-app.storagegateway.region.amazonaws.com.cn:443
dp-1.storagegateway.region.amazonaws.com.cn:443

The following gateway service endpoint is required to make API calls.

storagegateway.region.amazonaws.com.cn:443

The following example is a gateway service endpoint in the US West (Oregon) Region (us-west-2).

storagegateway.us-west-2.amazonaws.com.cn:443

The Amazon S3 service endpoint, shown following, is used by File Gateways only. A File Gateway requires this endpoint to access the S3 bucket that a file share maps to.

bucketname.s3.region.amazonaws.com.cn

The following example is an S3 service endpoint in the China (Beijing) Region (cn-north-1).

s3.cn-north-1.amazonaws.com.cn

A Storage Gateway VM is configured to use the following NTP servers.

0.amazon.pool.ntp.org
1.amazon.pool.ntp.org
2.amazon.pool.ntp.org
3.amazon.pool.ntp.org

Configuring security groups for your Amazon EC2 gateway instance

A security group controls traffic to your Amazon EC2 gateway instance. When you configure a security group, we recommend the following:

In some cases, you might use an Amazon EC2 instance as an initiator (that is, to connect to iSCSI targets on a gateway that you deployed on Amazon EC2. In such a case, we recommend a two-step approach:

For information about the ports to open for your gateway, see Port Requirements.

Supported hypervisors and host requirements

You can run Storage Gateway on-premises as either a virtual machine (VM) appliance, or a physical hardware appliance, or in Amazon as an Amazon EC2 instance.

Storage Gateway supports the following hypervisor versions and hosts:

Supported iSCSI initiators

When you deploy a Tape Gateway, the gateway is preconfigured with one media changer and 10 tape drives. These tape drives and the media changer are available to your existing client backup applications as iSCSI devices.

To connect to these iSCSI devices, Storage Gateway supports the following iSCSI initiators:

Supported third-party backup applications for a Tape Gateway

You use a backup application to read, write, and manage tapes with a Tape Gateway. The following third-party backup applications are supported to work with Tape Gateways.

The type of medium changer you choose depends on the backup application you plan to use. The following table lists third-party backup applications that have been tested and found to be compatible with Tape Gateways. This table includes the medium changer type recommended for each backup application.