{"resourceId":"netapp-aide-requirements-online-install-cloud-endpoints-20261029","versions":[{"version":"external-df1c88f67771e20ca5a67a73ec3f1525fe836a7318cc52af04f6d8906bc2a2b7","resource":{"id":"netapp-aide-requirements-online-install-cloud-endpoints-20261029","title":"NetApp AI Data Engine requirements: online installation depends on AWS-hosted registries, NetApp Console SaaS authentication and usage-metrics endpoints","organization":"NetApp","sector":"Strategic partner: AI data services deployment requirements","geography":"Global (endpoints hosted in AWS us-west-2 and us-east-1)","publishedAt":"Page last updated 10/29/2026","publicationDate":"2026-10-29","eventDate":null,"sourceName":"NetApp Docs (AI Data Engine)","sourceLabel":"AI Data Engine requirements","sourceUrl":"https://docs.netapp.com/us-en/ai-data-engine/deploy/aide-requirements.html","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security","governance-procurement"],"finding":"NetApp's AIDE requirements page (updated 10/29/2026) says an online installation must reach a list of outbound endpoints. They include NetApp's container registry and S3 and STS endpoints in AWS us-west-2, NetApp Console registration and authentication (api.bluexp.netapp.com, netapp-cloud-account.auth0.com), a logs and metrics streaming endpoint, and AWS Cognito in us-east-1 for sending product usage metrics to NetApp. Runtime downloads come from GitHub, get.k3s.io and Docker endpoints, and installer scripts from a CloudFront host. login.microsoftonline.com is needed only for governed MCP access. The endpoints are the same through a proxy. The network table requires bidirectional Console agent to AIDE traffic on ports 80, 443, 8080 and 9000, and inbound 443 for AI clients to the MCP server. Active Directory DNS used by AIDE nodes must also resolve external names.","sledRelevance":"Interpretation: this is the practical gate for SLED adoption of AIDE. Agencies with CJIS, HIPAA, FERPA or state data-residency rules, and campuses with segmented research networks, will need security review of outbound connections to SaaS and AWS endpoints and of usage-metrics transmission. Air-gapped public-safety or utility environments may not fit an online installation. This run found no AIDE offline procedure.","evidence":"Vendor requirements documentation listing endpoints, purposes, initiating components and ports. No independent validation. The page describes an online installation and this run did not find an offline or dark-site AIDE procedure in the pages opened. NetApp Console separately documents private-mode releases (latest 4.10.0, 17 September 2026), but this run did not establish whether AIDE supports private mode.","architectureImplications":"Egress allow-lists must use exact host names, since NetApp says IP-based rules for the CloudFront installer host will break. Multi-node clusters make container-runtime connections from every node. AIDE depends on a reachable Console agent, which links its patch posture to the Console agent's own advisories.","governanceImplications":"Security and privacy offices should review what leaves the environment, including product usage metrics and logs/metrics streaming, and document it in system security plans or vendor risk assessments before pilots.","securityPrivacyImplications":"Outbound dependencies on AWS-hosted registries and NetApp SaaS identity create supply-chain and availability dependencies. Usage metrics and logs/metrics streams leave the environment; the requirements page does not say what data they contain.","caveats":"Vendor documentation that may change. Absence of an offline procedure in the pages opened is not proof that none exists. Telemetry content and retention are not described here. First-time source, not in the archive; included now because GA (26 October) makes these requirements the evaluation gate.","streamIds":["netapp"],"roles":{"sales":"Sales framing: before proposing an AIDE pilot, qualify whether the customer can allow its outbound dependencies. These are AWS-hosted registries, NetApp Console SaaS authentication, logs and metrics streaming, and usage metrics sent to NetApp. For CJIS, HIPAA, FERPA or residency-sensitive SLED buyers this is a security-review item, not a footnote. Position the pilot on networks where egress is already permitted, and avoid implying AIDE runs air-gapped; this run found no documentation for that.","engineering":"Engineering framing: build the egress allow-list from NetApp's table using exact host names. Include us-west-2 ECR, S3 and STS, Console endpoints, Cognito us-east-1, GitHub, k3s, Docker and the CloudFront installer host. Open bidirectional ports 80, 443, 8080 and 9000 between the Console agent and AIDE, and inbound 443 for MCP clients. Confirm Active Directory DNS resolves external names. Proxy deployments need HTTPS CONNECT for every listed host.","delivery":"Delivery framing: run network and security approvals before installation day. Deliverables are an endpoint allow-list mapped to purposes, a data-flow description covering telemetry and logs for the security plan, and a DNS check for AD-integrated nodes. Delivery should document who owns the egress rules and how changes to NetApp's endpoint list will be tracked, because the page is updated frequently and a missed endpoint blocks installation or runtime."},"roleDetails":{"sales":{"customerProblem":"Agencies and campuses want to evaluate AIDE but must justify outbound SaaS and cloud dependencies to security and compliance reviewers.","stakeholders":["CISO or information security officer","Network and firewall team","Privacy or compliance officer","CJIS or HIPAA security contact where applicable"],"discoveryQuestions":["Does policy allow outbound HTTPS to AWS-hosted registries and NetApp SaaS identity?","Is any target environment air-gapped or CJIS-segmented?","Must product telemetry be disclosed or approved?","Is an outbound proxy mandatory, and does it support host-name rules?"],"valueHypothesis":"Early qualification of egress requirements avoids stalled pilots and identifies environments where an AIDE evaluation is feasible now.","potentialEngagement":"Short readiness assessment: map NetApp endpoint requirements to the customer firewall and data-flow policies and produce an approval package.","unsupportedClaims":["AIDE runs fully air-gapped","No data leaves the environment","Compliance with CJIS, HIPAA or FERPA"]},"engineering":{"fit":"Fits networks where controlled outbound HTTPS to named SaaS and AWS endpoints is permitted.","architectureIntegration":"AIDE nodes call AWS us-west-2 registry and S3 endpoints, NetApp Console and auth0, and Cognito; Console agent exchanges traffic with AIDE on 80/443/8080/9000.","prerequisites":["Host-name based egress rules or proxy with HTTPS CONNECT","DNS that resolves external names","Console agent reachable from AIDE","Inbound 443 path for approved MCP clients"],"constraints":["Online installation documented; no offline AIDE procedure found","IP-based allow-lists for the CloudFront installer host break","Endpoint list can change with page updates"],"security":"Review telemetry and logs streaming, restrict MCP inbound access to the corporate network or VPN, and include NetApp SaaS identity in third-party risk review.","proofOfValue":["Pre-install connectivity test to every listed endpoint","Confirm installation fails closed and logs clearly when an endpoint is blocked","Capture and review outbound traffic during a pilot scan"]},"delivery":{"work":"Produce allow-list, data-flow documentation and DNS validation; obtain security approval; then schedule installation.","dependencies":["Firewall change process","Security plan owner","Proxy configuration","Console agent deployment"],"ownership":"Network team owns egress rules; security office owns data-flow approval; infrastructure team owns the AIDE host.","skillsAdoption":"Network staff must manage host-name based rules; security reviewers need a briefing on Console, AIDE and telemetry roles.","governanceCheckpoints":["Security approval of outbound data flows","Privacy sign-off on telemetry","Periodic re-check of NetApp endpoint list"],"acceptanceCriteria":["Proposed: every required endpoint reachable from the AIDE host before install","Proposed: documented approval for telemetry and logs streaming","Proposed: MCP access limited to approved network ranges"],"risks":["Installation blocked by a missed endpoint","Policy conflict in CJIS or HHS segments","Undocumented endpoint changes after page updates"]}},"retrievedAt":"2026-11-01T03:07:23Z","enrichedAt":"2026-11-01T03:12:11Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Interpretation: requires network and security staff time for allow-list design and review; no accessibility content in the source.","procurementImplications":"Interpretation: vendor risk assessments and data processing terms covering telemetry should be part of any AIDE purchase.","operatingModelImplications":"Interpretation: AIDE operations depend on continuous SaaS connectivity, so outages or endpoint changes at NetApp or AWS become operational dependencies.","sourceVerification":{"openedUrl":"https://docs.netapp.com/us-en/ai-data-engine/deploy/aide-requirements.html","referenceExcerpt":"For an online installation, the following endpoints must be reachable.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}