Amazon S3 File Gateway
Amazon S3 File Gateway presents an NFS or SMB file share to on-premises applications and stores what is written to it as objects in Amazon S3. A file written through the gateway becomes an S3 object with the same name, readable by any AWS service or application that can read the bucket. See the Storage Gateway overview for how it compares with the other three gateway types.
Where the data lives
Section titled “Where the data lives”Amazon S3 is authoritative. Every file is stored in S3, and S3 holds the only complete copy.
The local cache is a subset. The gateway keeps frequently accessed data on local disk for low-latency reads. How much it keeps depends on the storage allocated to the appliance, and which data it keeps depends on access patterns. The cache can be refreshed or invalidated — which is the mechanism to know about, because objects written to the bucket by something other than the gateway do not appear on the share until the cache is refreshed.
Capabilities
Section titled “Capabilities”- Protocols. NFS versions 3 and 4.1, and SMB versions 2 and 3.
- File locking for SMB, so multi-user access stays consistent.
- Lifecycle management. Because the objects are ordinary S3 objects, S3 lifecycle policies can move cold data to cheaper storage classes without the applications knowing.
- Encryption. Data is encrypted in transit with TLS and at rest in S3, with keys managed through AWS KMS.
- Access control through IAM for the AWS side, and through the share’s own permissions on the on-premises side.
- Monitoring through Amazon CloudWatch, and API auditing through CloudTrail.
Where it earns its place
Section titled “Where it earns its place”Two situations justify a gateway rather than a straight migration. The first is an application that cannot be changed to call the S3 API and must see a file system. The second is a hybrid architecture that is the end state rather than a step: local reads stay fast, capacity becomes S3’s problem, and the on-premises storage array does not need replacing.
It also serves as a backup and disaster-recovery target, since the data is already durable in S3 the moment it is written.
Deployment
Section titled “Deployment”The appliance runs on customer infrastructure: a VM on VMware ESXi, Microsoft Hyper-V or KVM, a hardware appliance from a reseller, or an AMI on Amazon EC2. AWS supplies the image and operates the service side; the host, its disks and its capacity are the customer’s to provide.