How can I set up a private network connection between a file gateway and Amazon S3?

Last updated: 2021-11-08

I want to set up a private network connection between AWS Storage Gateway's file interface (file gateway) and Amazon Simple Storage Service (Amazon S3). I don't want my gateway to communicate with AWS services over the internet. How can I do that?

Resolution

You can set up a private network connection between a file gateway and Amazon S3 within an Amazon Virtual Private Cloud (Amazon VPC) where the gateway appliance connects with service endpoints over an internal private network. To set up this private connection within a VPC, do the following:

  1. Create either a VPC gateway endpoint or an interface endpoint for Amazon S3.
  2. Create a file gateway using a VPC endpoint.

Amazon S3 File Gateway supports two Amazon S3 endpoints. However, you need to create only one type of endpoint based on your use case.

Create a VPC gateway endpoint for Amazon S3

  1. Open the Amazon VPC console.
  2. In the navigation pane, choose Endpoints.
  3. Choose Create Endpoint.
  4. For Service category, select AWS services.
  5. For Service Name, select the Service Name that ends with s3 and has Type as Gateway.
  6. For VPC, select the VPC that you want to use when accessing Storage Gateway.
  7. For Configure route tables, select the Route Table ID for your configuration.
  8. Choose Create endpoint.

Create a VPC interface endpoint for Amazon S3

  1. Open the Amazon VPC console.
  2. In the navigation pane, choose Endpoints.
  3. Choose Create Endpoint.
  4. For Service category, select AWS services.
  5. For Service Name, select the service name that ends with s3 and has Type as Interface.
  6. For VPC, select the VPC and subnets that you want to use when accessing Storage Gateway.
  7. For Security group, select the security group where port 443 is opened.
  8. Choose Create endpoint.

Create a file gateway using the VPC endpoint

To create a file gateway using a VPC endpoint, you must create a VPC endpoint for Storage Gateway, create and configure a file gateway, and then activate your gateway in the VPC.

Note: If you're using on-premises Storage Gateway using a private connectivity with AWS, then you can use interface endpoint for Amazon S3 that works without an Amazon Elastic Compute Cloud (Amazon EC2) proxy.

Create file share using the VPC interface endpoint for Amazon S3

With Amazon S3 File Gateway, you can create a file share that can be accessed using either the Network File System (NFS) or Server Message Block (SMB) protocol. For more information on creating a file share, see Creating a file share.

Test the network connectivity

Note: Testing the connectivity helps you to check if the Storage Gateway appliance can connect with the service endpoint over the required TCP port.

  1. Connect to the file gateway's Amazon EC2 host instance using SSH.
  2. In the SSH session, enter 3 to select 3: Test Network Connectivity.
  3. The tests return [ PASSED ] for a successful network connection.

Did this article help?


Do you need billing or technical support?