Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon FSx File Gateway documentation has been moved to What is Amazon FSx File Gateway?

Volume Gateway documentation has been moved to What is Volume Gateway?

Tape Gateway documentation has been moved to What is Tape Gateway?

File Gateway setup requirements

Unless otherwise noted, the following requirements are common to all File Gateway types in Amazon Storage Gateway. Your setup must meet the requirements in this section. Review the requirements that apply to your gateway setup before you deploy your gateway.

Prerequisites

Before you set up your Amazon S3 File Gateway (S3 File Gateway), you must meet the following prerequisites:

Hardware and storage requirements

The following sections provide information about the minimum required hardware and storage configurations for your gateway, and the minimum amount of disk space to allocate for the required storage.

For information about best practices for File Gateway performance, see Basic performance guidance for S3 File Gateway.

Hardware requirements for on-premises VMs

When deploying your gateway on-premises, ensure that the underlying hardware on which you deploy the gateway virtual machine (VM) can dedicate the following minimum resources:

For more information, see Optimizing Gateway Performance. For information about how your hardware affects the performance of the gateway VM, see Quotas for file shares.

Requirements for Amazon EC2 instance types

When deploying your gateway on Amazon Elastic Compute Cloud (Amazon EC2), the instance size must be at least xlarge for your gateway to function. However, for the compute-optimized instance family the size must be at least 2xlarge. Use one of the following instance types recommended for your gateway type.

Recommended for File Gateway types

Storage requirements

In addition to 80 GiB of disk space for the VM, you also need additional disks for your gateway.

For information about gateway quotas, see Quotas for file shares.

Network and firewall requirements

Your gateway requires access to the internet, local networks, Domain Name Service (DNS) servers, firewalls, routers, and so on.

Network bandwidth requirements vary based on the quantity of data that is uploaded and downloaded by the gateway. A minimum of 100Mbps is required to successfully download, activate, and update the gateway. Your data transfer patterns will determine the bandwidth necessary to support your workload.

Following, you can find information about required ports and how to allow access through firewalls and routers.

Port requirements

Storage Gateway requires certain ports to be allowed for its operation. The following illustrations show the required ports that you must allow for each type of gateway. Some ports are required by all gateway types, and others are required by specific gateway types. For more information about port requirements, see Port Requirements.

Common ports for all gateway types

The following ports are common to all gateway types and are required by all gateway types.

Ports for File Gateways

The following illustration shows the ports to open for an S3 File Gateway.

For S3 File Gateway, you only need to use Microsoft Active Directory when you want to allow domain users to access a Server Message Block (SMB) file share. You can join your File Gateway to any valid Microsoft Windows domain (resolvable by DNS).

You can also use the Amazon Directory Service to create an Amazon Managed Microsoft AD in the Amazon Web Services Cloud. For most Amazon Managed Microsoft AD deployments, you need to configure the Dynamic Host Configuration Protocol (DHCP) service for your VPC. For information about creating a DHCP options set, see Create a DHCP options set in the Amazon Directory Service Administration Guide.

In addition to the common ports, Amazon S3 File Gateway requires the following ports.

Networking and firewall requirements for the Storage Gateway Hardware Appliance

Each Storage Gateway Hardware Appliance requires the following network services:

There are five physical network ports at the rear of the Dell PowerEdge R640 server. From left to right (facing the back of the server) these ports are as follows:

You can use the iDRAC port for remote server management.

A hardware appliance requires the following ports to operate.

To perform as designed, a hardware appliance requires network and firewall settings as follows:

All IP addresses on the same network interface (NIC), whether for a gateway or a host, must be on the same subnet. The following illustration shows the addressing scheme.

For more information about activating and configuring a hardware appliance, see Using the Amazon Storage Gateway Hardware Appliance.

Allowing Amazon Storage Gateway access through firewalls and routers

Your gateway requires access to the following service endpoints to communicate with Amazon. If you use a firewall or router to filter or limit network traffic, you must configure your firewall and router to allow these service endpoints for outbound communication to Amazon.

The following service endpoint is required by all gateways for head-bucket operations.

s3.amazonaws.com.cn:443

The following service endpoints are required by all gateways for control path (anon-cp, client-cp, proxy-app) and data path (dp-1) operations.

anon-cp.storagegateway.region.amazonaws.com.cn:443
client-cp.storagegateway.region.amazonaws.com.cn:443
proxy-app.storagegateway.region.amazonaws.com.cn:443
dp-1.storagegateway.region.amazonaws.com.cn:443

The following gateway service endpoint is required to make API calls.

storagegateway.region.amazonaws.com.cn:443

The following example is a gateway service endpoint in the US West (Oregon) Region (us-west-2).

storagegateway.us-west-2.amazonaws.com.cn:443

The Amazon S3 service endpoint, shown following, is used by File Gateways only. A File Gateway requires this endpoint to access the Amazon S3 bucket that a file share maps to.

s3.region.amazonaws.com.cn

The following example is an S3 service endpoint in the China (Beijing) Region (cn-north-1).

s3.cn-north-1.amazonaws.com.cn

A Storage Gateway VM is configured to use the following NTP servers.

0.amazon.pool.ntp.org
1.amazon.pool.ntp.org
2.amazon.pool.ntp.org
3.amazon.pool.ntp.org

Configuring security groups for your Amazon EC2 gateway instance

In Amazon Storage Gateway, a security group controls traffic to your Amazon EC2 gateway instance. When you configure a security group, we recommend the following:

For information about the ports to open for your gateway, see Port Requirements.

Supported hypervisors and host requirements

You can run Storage Gateway on-premises as either a virtual machine (VM) appliance or a physical hardware appliance, or in Amazon as an Amazon EC2 instance.

Storage Gateway supports the following hypervisor versions and hosts:

Supported NFS clients for File Gateway

File Gateway supports the following Network File System (NFS) clients:

Supported SMB clients for File Gateway

File Gateway supports the following Service Message Block (SMB) clients:

Supported file system operations for File Gateway

Your NFS or SMB client can write, read, delete, and truncate files. When clients send writes to Amazon Storage Gateway, it writes to local cache synchronously. Then it writes to Amazon S3 asynchronously through optimized transfers. Reads are first served through the local cache. If data is not available, it's fetched through S3 as a read-through cache.

Writes and reads are optimized in that only the parts that are changed or requested are transferred through your gateway. Deletes remove objects from Amazon S3. Directories are managed as folder objects in S3, using the same syntax as in the Amazon S3 console.

HTTP operations such as GET, PUT, UPDATE, and DELETE can modify files in a file share. These operations conform to the atomic create, read, update, and delete (CRUD) functions.