AWS Storage Gateway: File, Volume, and Tape Gateway for Hybrid Storage

Three gateway types for three use cases

| Type | Protocol | Backed by | Primary use case | |---|---|---|---| | File Gateway | NFS, SMB | Amazon S3 | On-premises apps reading/writing files to S3 | | Volume Gateway (Stored) | iSCSI | S3 snapshots | Block storage with local primary + cloud backup | | Volume Gateway (Cached) | iSCSI | S3 (primary) | Block storage with low-latency local cache | | Tape Gateway | iSCSI VTL | S3 + Glacier | Replace physical tape backup infrastructure |

Storage Gateway runs as a VM (VMware, Hyper-V, KVM) or hardware appliance on-premises, or as an AMI on EC2.

File Gateway: on-premises access to S3

File Gateway presents an S3 bucket as a network file share. Applications write files using NFS or SMB; the gateway translates these into S3 PutObject calls.

# Terraform: create the gateway (requires an activated gateway appliance ARN)
resource "aws_storagegateway_gateway" "file" {
  gateway_name     = "file-gateway-prod"
  gateway_timezone = "GMT"
  gateway_type     = "FILE_S3"

  smb_active_directory_settings {
    domain_name = "corp.example.com"
    username    = "svc-gateway"
    password    = var.ad_password
  }
}

# Create an S3 file share on the gateway
resource "aws_storagegateway_nfs_file_share" "main" {
  gateway_arn  = aws_storagegateway_gateway.file.arn
  location_arn = aws_s3_bucket.data.arn
  role_arn     = aws_iam_role.storage_gateway.arn

  nfs_file_share_defaults {
    directory_mode = "0770"
    file_mode      = "0660"
    group_id       = 65534
    owner_id       = 65534
  }

  cache_stale_timeout_in_seconds = 300   # how long until cached data expires

  # Restrict access to specific on-prem IP ranges
  client_list = ["10.0.0.0/8"]
}

Mount the share on Linux:

mount -t nfs -o nolock,hard,intr \
  gateway-ip:/my-s3-bucket \
  /mnt/s3-share

The RefreshCache problem: if files are written directly to S3 (via Lambda, another service, or the console), the File Gateway doesn't know about them until you trigger a cache refresh. Applications reading from the mount see stale data until the refresh completes.

# Force cache refresh via CLI
aws storagegateway refresh-cache \
  --file-share-arn arn:aws:storagegateway:us-east-1:123456789:share/share-abc123 \
  --folder-list "/" \
  --recursive true

Volume Gateway: iSCSI block storage

Volume Gateway presents iSCSI block devices. On-premises servers attach these volumes like local disks.

Stored mode: primary data lives on-premises. The gateway continuously snapshots to S3 (EBS snapshots). Recovery creates EBS volumes from snapshots.

Cached mode: primary data lives in S3. The gateway caches frequently accessed blocks locally. The local cache only needs to hold hot data, not the full dataset.

resource "aws_storagegateway_gateway" "volume" {
  gateway_name     = "volume-gateway-prod"
  gateway_timezone = "GMT"
  gateway_type     = "STORED"   # or "CACHED"
}

resource "aws_storagegateway_stored_iscsi_volume" "main" {
  gateway_arn            = aws_storagegateway_gateway.volume.arn
  network_interface_id   = "10.0.1.10"   # gateway NIC IP
  target_name            = "prod-volume"
  disk_id                = "disk-abc123"   # local disk on gateway VM
  preserve_existing_data = false
  snapshot_id            = ""   # or start from an existing snapshot
}

resource "aws_storagegateway_gateway" "tape" {
  gateway_name     = "tape-gateway-prod"
  gateway_timezone = "GMT"
  gateway_type     = "VTL"

  tape_drive_type   = "IBM-ULT3580-TD5"   # emulated tape drive model
  medium_changer_type = "AWS-Gateway-VTL"
}

resource "aws_storagegateway_tape_pool" "archive" {
  pool_name     = "glacier-pool"
  storage_class = "GLACIER"   # or "DEEP_ARCHIVE"
  retention_lock_type = "GOVERNANCE"
  retention_lock_time_in_days = 90
}