{"resourceId":"aws-fsx-ontap-s3-access-points-four-more-regions-govcloud-not-listed-20261109","versions":[{"version":"external-0a7911c88338ab4adc7d3f9ae7cd09c703e311cbcbeff88050f2399769c40ebf","resource":{"id":"aws-fsx-ontap-s3-access-points-four-more-regions-govcloud-not-listed-20261109","title":"AWS extends S3 Access Points for FSx for NetApp ONTAP to four more Regions; AWS GovCloud (US) still not listed as supported","organization":"Amazon Web Services (Amazon FSx for NetApp ONTAP)","sector":"Cloud data infrastructure (cross-sector; SLED applicability by interpretation)","geography":"Global; U.S. commercial Regions supported, AWS GovCloud (US-East/US-West) not marked supported","publishedAt":"2026-11-09 (AWS What's New 'Posted on: Nov 9, 2026')","publicationDate":"2026-11-09","eventDate":"2026-11-09","sourceName":"AWS What's New","sourceLabel":"Vendor announcement (AWS) with AWS FSx for ONTAP user-guide cross-check","sourceUrl":"https://aws.amazon.com/about-aws/whats-new/2026/11/s3-access-points-fsx-regions/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["infrastructure","data-security","developers-agents"],"finding":"AWS says S3 Access Points can now attach to FSx for NetApp ONTAP file systems in 4 additional Regions, letting S3-based AI/ML and analytics services (its example: Bedrock Knowledge Bases, Athena, Glue) read file data in place without copying. The announcement does not name the four Regions. The FSx for ONTAP user guide's Region table, inspected the same night, marks US East/West commercial Regions and most international Regions supported but leaves AWS GovCloud (US-East) and (US-West) and Asia Pacific (Thailand) unmarked. Why now: posted 9 Nov, after the last NetApp run; not in archive.","sledRelevance":"Interpretation: agencies and universities already running FSx for ONTAP (file shares, research data) could expose that data to retrieval-augmented generation pipelines without a second copy, reducing duplicate-data governance. Applicability is limited for workloads that must stay in AWS GovCloud (for example CJIS-scoped public-safety data or some state HHS systems), because the user guide does not mark GovCloud as supported. No SLED deployment is reported.","evidence":"Vendor documentation only. The announcement states the regional expansion and use cases. The user guide states dual authorization (IAM access-point policy plus an associated UNIX/Windows file-system user), enforced Block Public Access that cannot be disabled, latency 'in the tens of milliseconds range', and throughput bounded by the file system's provisioned throughput. The compatibility page lists unsupported S3 features (object versioning, Object Lock, lifecycle, ACLs other than bucket-owner-full-control, MFA, conditional writes) and a 50 GiB upload limit. No benchmark, customer measurement or independent evaluation was found.","architectureImplications":"Pattern is file-and-object dual access on one ONTAP volume: NFS/SMB users and S3-API consumers see the same data. Throughput via S3 is bounded by provisioned FSx throughput, so AI indexing jobs compete with file users. Multipart-upload parts in progress are excluded from FSx volume backups. Regional placement must be confirmed per Region table before design.","governanceImplications":"In-place access avoids creating ungoverned copies, but permission review now spans IAM policies, VPC endpoint policies and file-system ACLs; data owners must agree which file-system user each access point maps to.","securityPrivacyImplications":"Block Public Access is enforced. Object Lock and versioning are not supported through the access point, so immutability/retention must rely on ONTAP-side features (snapshots, SnapLock where licensed) rather than S3 controls. Checksums are validated on upload but not stored for download verification.","caveats":"Vendor-claim only (AWS). The four new Regions are unnamed in the announcement; the GovCloud status is inferred from an unmarked cell in the user-guide table on retrieval date and may change. Cross-stream: this is an AWS-delivered NetApp ONTAP service; filed under NetApp because it changes how ONTAP-resident data reaches AI services. No performance or cost figures were published.","streamIds":["netapp"],"roles":{"sales":"Sales framing: this is a 'use the ONTAP data you already have' conversation, not a new platform sale. For SLED accounts already on FSx for ONTAP, ask whether RAG or analytics pilots are copying file shares into S3 and who governs those copies. Position in-place access as a governance and duplication-reduction hypothesis, not a cost guarantee. Qualify early whether the workload must sit in GovCloud, where the AWS user guide does not show support, and route those accounts to alternatives instead of overpromising.","engineering":"Engineering framing: validate the access path before endorsing it. Confirm Region support in the FSx user guide table, map each access point to a file-system identity, and test that IAM plus NTFS/UNIX permissions produce the intended least-privilege result. Measure S3-path throughput against provisioned FSx throughput while file users are active. Note unsupported S3 features, especially versioning and Object Lock, and design retention through ONTAP snapshots instead. Treat the tens-of-milliseconds latency as AWS's statement to verify.","delivery":"Delivery framing: run this as a bounded pilot with named data owners. Inventory candidate volumes, classify sensitive content, create one VPC-restricted access point per use case, and connect a single AI consumer such as a knowledge-base index. Track permission drift between IAM and file ACLs, backup coverage, and throughput contention. Set exit criteria up front and document that GovCloud-resident data is out of scope unless AWS documentation changes."},"roleDetails":{"sales":{"customerProblem":"SLED teams want AI retrieval over existing file shares but copying data into separate S3 buckets duplicates sensitive records and governance effort.","stakeholders":["Agency or campus CIO/CTO","Data governance or records officer","Cloud platform team running FSx for ONTAP","Information security officer","Research computing lead (higher ed)"],"discoveryQuestions":["Which FSx for ONTAP volumes hold data AI pilots want to index?","Are any of those workloads required to run in AWS GovCloud?","How are current RAG pilots copying file data today, and who approves those copies?","Do you rely on S3 Object Lock or versioning for retention?"],"valueHypothesis":"In-place S3 access to ONTAP volumes may reduce duplicate data copies and the governance work they create for a bounded AI pilot, subject to Region support and throughput testing.","potentialEngagement":"A two-to-four-week assessment of one FSx for ONTAP volume and one AI consumer, documenting permissions mapping, throughput impact and retention gaps.","unsupportedClaims":["Any cost savings or performance figures (none published)","Support in AWS GovCloud (not marked in the user guide)","Equivalence with native S3 buckets (versioning, Object Lock, lifecycle unsupported)","Any SLED customer adoption"]},"engineering":{"fit":"Fits accounts already on FSx for ONTAP in a supported commercial Region that want S3-API consumers on file data without copies.","architectureIntegration":"S3 access point attaches to an FSx for ONTAP volume; requests are authorized by S3/IAM policies and then by the mapped UNIX or Windows file-system user; NFS/SMB access continues in parallel.","prerequisites":["FSx for ONTAP file system in a Region marked supported","Defined file-system user per access point","VPC-only network configuration where required","Provisioned throughput sized for combined file and S3 load"],"constraints":["AWS GovCloud (US-East/West) not marked supported in the user guide","50 GiB maximum object upload size","No object versioning, Object Lock, lifecycle or MFA delete via the access point","Only bucket-owner-full-control ACL supported","In-progress multipart parts excluded from FSx volume backups"],"security":"Block Public Access is enforced and cannot be disabled; authorization is dual-layer (IAM then file system), so least privilege requires reviewing both. Retention controls must come from ONTAP, not S3.","proofOfValue":["Confirm Region support in the user guide on the deployment date","Test that a restricted file ACL blocks an IAM-permitted S3 GET","Measure S3 read throughput and file-user latency concurrently","Verify backup/snapshot coverage of objects written via S3"]},"delivery":{"work":"Pilot one access point on one classified volume feeding one AI consumer, with permission mapping, monitoring and a documented exit decision.","dependencies":["Supported AWS Region","Data classification of target volume","IAM and file-system administrators","AI consumer (e.g., knowledge-base index) owner"],"ownership":"Cloud platform team operates the access point; the data owner approves scope; security owns permission review.","skillsAdoption":"Storage admins need IAM/S3 policy skills and cloud teams need ONTAP permission skills; plan cross-training before scale-out.","governanceCheckpoints":["Data-owner approval of exposed volumes","Security review of IAM-to-file-user mapping","Retention review given no Object Lock/versioning","Go/no-go after throughput test"],"acceptanceCriteria":["Zero unauthorized reads in a negative-permission test","No more than an agreed latency increase for file users during S3 indexing","100% of pilot data reachable without a second copy","Documented decision on GovCloud-scoped data"],"risks":["Permission drift between IAM and file ACLs","Throughput contention with production file users","Retention gaps if teams assume S3 Object Lock","Region support assumptions changing"]}},"retrievedAt":"2026-11-10T04:10:45Z","enrichedAt":"2026-11-10T04:15:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires cross-skilling between storage and cloud IAM teams; no accessibility content in sources.","procurementImplications":"Feature of existing FSx for ONTAP service; no separate SKU stated. Contract vehicles that restrict workloads to GovCloud would exclude it per the user guide table.","operatingModelImplications":"Shared responsibility shifts toward joint storage-cloud operations, with data owners approving each access point.","sourceVerification":{"openedUrl":"https://aws.amazon.com/about-aws/whats-new/2026/11/s3-access-points-fsx-regions/","referenceExcerpt":"attach Amazon S3 Access Points to your Amazon FSx for NetApp ONTAP file systems in 4 additional AWS Regions","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}