Lesson 118 · AWS Learning Path

AWS 118: AWS Storage Gateway

Anil Jalela · Published Oct 21, 2025 · 11 min read

The real problem

A team recognizes the name AWS Storage Gateway but has not connected the feature to a real requirement, identity boundary, network or data path, failure mode, price dimension, and cleanup owner. A plausible configuration could still fail the workload.

Final outcome

The learner will produce a requirement-led artifact for AWS Storage Gateway, inspect the matching AWS control plane in the Management Console, run a matching CloudShell or AWS CLI query, interpret the output, diagnose one failure, defend one architecture choice, and prove cleanup or approved retained state.

The practical outcome is not a command transcript. It must show what was expected, what happened, what the result proves, what it does not prove, and which evidence would change the decision.

Learning objectives

By the end of this lesson, the learner can:

• explain hybrid appliance;
• explain s3 file gateway;
• explain fsx file gateway;
• explain volume gateway;
• explain tape gateway;
• connect control-plane state to the real data, network, identity, or application behavior;
• identify cost and cleanup ownership before any optional mutation;
• troubleshoot from evidence without opening broad access or adding broad permissions.

Relationship model

Requirement
   |
   v
Identity and policy -> AWS configuration -> network or data path -> workload behavior
        |                    |                      |                    |
        +--------------------+----------------------+--------------------+
                                      |
                                      v
                         monitoring, cost, recovery, cleanup

Use this model to separate an AWS object that exists from a result that actually works. Every arrow is a verification boundary.

Prerequisites, permissions, Region, and safety

• Learning baseline: This sequence assumes practical Linux knowledge but no prior cloud-computing or AWS knowledge. Cloud, networking, security, data, automation, and architecture concepts must come from completed earlier lessons. If a prerequisite checkpoint is incomplete, return to its linked lesson before continuing.
• Confirm a non-root caller with aws sts get-caller-identity and keep the account number private.
• Use ap-south-1 unless this lesson explicitly names a second Region.
• Confirm the intended profile and Region with aws configure list before interpreting an empty result.
• Use read-only List, Get, and Describe permissions for the named services. Design exercises run locally and require no resource-creation permission.
• This is a no-create lesson. Console and CLI work is read-only, and every design artifact is created locally.
• Never publish account IDs, public addresses, ARNs containing private account data, session IDs, presigned URLs, object data, credentials, or KMS material.
• Do not use root, world-open SSH or RDP, disabled TLS verification, unowned resources, or irreversible retention controls in a training exercise.

Core model

How it works

Storage Gateway is not simply a protocol converter. The application still experiences local appliance availability, cache behavior, WAN performance, queued uploads, cloud service authorization, restore timing, and gateway replacement procedures.

The gateway software runs on an approved VM platform, EC2 instance or supported appliance and is activated into an AWS Region. The on-premises client talks to a local data-plane endpoint using NFS/SMB/iSCSI; the gateway talks outbound to AWS service endpoints. Local disks have specific roles - cache, upload buffer or stored-volume data depending on gateway type - and must not be casually resized, reused or snapshotted at the hypervisor as a recovery method. Activation keys and credentials are secrets. NTP, DNS, firewall/proxy, bandwidth and current required endpoint/port lists are prerequisites, not afterthoughts.

Different products, different truth

• S3 File Gateway maps files to S3 objects while presenting NFS or SMB. S3 is the durable cloud destination, but POSIX/SMB metadata, multipart uploads, object ownership, cache refresh and concurrent direct-S3 edits require design. Do not assume arbitrary object writers and file clients have coherent locking or instant cache visibility.
• FSx File Gateway caches access to FSx for Windows File Server for supported hybrid Windows scenarios. AD, DNS, SMB permissions, FSx availability and WAN/cache health all remain dependencies.
• Cached Volume Gateway exposes iSCSI block volumes whose primary durable data is cloud-backed while hot blocks stay local. Stored Volume Gateway keeps the complete primary data set locally and asynchronously creates cloud snapshots. These are opposite data-placement decisions.
• Tape Gateway exposes a virtual tape library to supported backup applications. Virtual tapes move through created, available, in-use and archived/retrieved states; archive retrieval time and storage class must be part of RTO.

Local cache reduces repeated-read latency but does not repeal WAN physics. During WAN loss, behavior depends on gateway type, cached blocks/files, pending writes and protocol timeouts. Queue growth can consume local space; when connectivity returns, recovery can saturate the WAN. Size cache/upload resources from working set, change rate, outage duration and recovery bandwidth. Monitor cache percent used/dirty, upload buffer, queued bytes, throughput/latency, I/O errors, gateway availability and cloud-side job state.

Consistency, security and recovery

Define a single writer/coordination model when the same S3 namespace is accessed through both file and object APIs. A successful local close does not automatically prove that a remote object, volume snapshot or archived tape is already available at the intended recovery point. Record queued-upload evidence and validate from the destination side.

Use private connectivity/VPC endpoints where requirements justify it, TLS to AWS, encryption at rest at the backing service, least-privilege share/bucket/KMS roles, SMB AD authentication or NFS client controls, and segmented management access. Recovery includes redeploying/reconnecting a gateway, reactivating shares/volumes, restoring cloud data and validating an application - not restoring an unsupported VM snapshot.

Read the result in layers:

1. Scope: account, Region, VPC, bucket, AZ, endpoint, principal, object version, or resource ARN.
2. Control plane: the requested configuration exists and reached an expected state.
3. Behavior: the request, connection, health check, replication, restore, or application result meets the requirement.
4. Operations: monitoring, failure owner, cost, retention, rollback, and cleanup are known.

Control-plane success is necessary but not sufficient. A resource can be available while policy, routing, DNS, health, data, or application behavior remains wrong.

Architecture decision table

Professional questions normally contain several valid services. State the requirement that selects one option, why the nearest alternative fails it, and what changed requirement would reverse the choice.

AWS Management Console guided practice

Before opening a service page, write the expected account, Region, starting state, and evidence. Do not choose Create, Save, Purchase, Lock, or Delete unless the lesson explicitly authorizes the live track.

1. Open Storage Gateway, Gateways and inspect supplied gateway type, state, host platform, local disks, software version, alarms, and tags.
2. Open File shares, Volumes, or Tapes for the supplied scenario and map local protocol, cache or buffer, cloud destination, encryption, access, and recovery.
3. Use current pricing and the WAN evidence to compare bandwidth, cache capacity, request, storage, retrieval, snapshot, and operational cost.

For each step, capture the field name and value in text. A screenshot may support the record but does not replace the explanation. Console labels can evolve, so use the service search and current documentation if a navigation label differs.

CloudShell and AWS CLI practice

CloudShell is the default browser-based command environment taught in AWS 028. AWS 029 and AWS 030 cover local CLI installation and authentication. This lesson therefore does not assume that an unconfigured local shell is ready.

Start every session with:

export AWS_DEFAULT_REGION="ap-south-1"
aws sts get-caller-identity --query Arn --output text
aws configure list

Redact the account portion of the ARN before sharing. Then perform the topic query:

Inventory gateway type, state, platform, host environment, timezone, software version, and associated resources.

aws storagegateway list-gateways --query 'Gateways[].{Arn:GatewayARN,Name:GatewayName,Type:GatewayType,State:GatewayOperationalState,Platform:HostEnvironment,Version:SoftwareVersion}' --output table
aws storagegateway list-file-shares --output table

Expected interpretation:

A running gateway state does not prove WAN health, cache capacity, file-share authorization, pending uploads, backup application behavior, or restore success.

Replace every replace-with-... sample value before running its command, and use only an explicitly owned resource. Explain each option first. These queries are read-only; a successful response does not authorize a later create or delete operation.

Practical work

Create p06-storage-gateway-decision.md for four branches: branch-office NFS to S3, Windows cached access to FSx, block workload with local cache, and tape archive. For each define gateway type, appliance placement, cache and buffer, protocol, ports, authentication, bandwidth, encryption, monitoring, offline behavior, recovery, test, and deletion. Do not deploy an appliance.

For each branch calculate daily change bytes, peak Mbps, 24-hour outage queue, catch-up time at 60% of WAN capacity and cache working set. Draw client-to-gateway and gateway-to-AWS flows. Run tabletop tests for WAN loss, full cache/upload disk, expired/denied cloud credentials, failed gateway VM, direct S3 object change and tape retrieval. State which I/O can continue, what may block, evidence that data reached AWS, operator action and rollback. Include the current hardware-appliance end-of-availability/support timeline if an existing appliance is proposed; new architecture must use a currently offered deployment option.

The evidence package must contain:

• the problem and final requirement in the learner's own words;
• caller type and Region with private identifiers redacted;
• exact planned values, ownership, and cost class;
• one Console observation and matching CLI or API evidence;
• one behavior result or supplied data-plane record;
• one denied, failed, or counterexample result and evidence-led diagnosis;
• one architecture choice plus the rejected alternative;
• cleanup proof or explicit retained-state owner, expiry, and next lesson.

Verification standard

Use expected state before observed state. Record timestamps in UTC and preserve the original failure before changing anything. A passing submission answers all four questions:

1. What exact requirement was tested?
2. Which evidence proves the AWS configuration?
3. Which evidence proves the workload behavior?
4. What remains unproven or requires later monitoring?

If AWS returns no rows, verify account, Region, permission, filters, pagination, resource type, and deletion state before concluding that nothing exists.

Common failures and troubleshooting

Do not troubleshoot by attaching administrator access, opening administration ports to the internet, disabling encryption, retrying uncontrolled creation, deleting unknown resources, or weakening retention.

Cost, cleanup, and retained state

No AWS resource is created. Close CloudShell and remove or redact downloaded evidence.

Cleanup evidence requires terminal state and an after-inventory. Search related ENIs, public IPv4 addresses, EBS volumes and snapshots, load balancers, target groups, Auto Scaling instances, endpoints, logs, S3 versions and delete markers, backup recovery points, and global IAM roles when they apply. Billing data can lag, so schedule a later review.

Architecture and certification decisions

• Certification coverage: SAA-C03; SOA-C03; SAP-C02; DOP-C02.
• Exam mapping: SAA D1-D4.
• Explain service scope, failure boundary, consistency, recovery, security, operations, and price rather than matching a keyword.
• Treat availability and durability, encryption and authorization, routing and filtering, health and lifecycle, backup and replication, and discount and capacity as separate concepts.
• Do not reproduce protected certification questions.

Knowledge check

1. Which gateway presents file shares backed by S3?

Expected direction: S3 File Gateway.

1. Where is primary data for cached volumes?

Expected direction: In AWS, with frequently accessed data cached locally.

1. What does Tape Gateway replace logically?

Expected direction: A virtual tape library and cloud archive workflow.

1. Does an operational state prove all data is uploaded?

Expected direction: No. Inspect cache, upload, errors, and application evidence.

Completion gate and assessment

Pass at 80 out of 100 with no critical safety failure. A missing practical artifact, unexplained output, unsafe access, destructive action outside the owned scope, unplanned billed resource, or false cleanup claim requires remediation and a changed retest.

Official sources

• AWS Storage Gateway overview
• S3 File Gateway
• Volume Gateway
• Tape Gateway
• Storage Gateway network requirements