AWS extends S3 Access Points for FSx for NetApp ONTAP to four more Regions; AWS GovCloud (US) still not listed as supported

Amazon Web Services (Amazon FSx for NetApp ONTAP) · Cloud data infrastructure (cross-sector; SLED applicability by interpretation) · Global; U.S. commercial Regions supported, AWS GovCloud (US-East/US-West) not marked supported

NetApp

Publisher: AWS What's New
Original publication: 2026-11-09 (AWS What's New 'Posted on: Nov 9, 2026')
Source retrieved: 2026-11-10
Event date: 2026-11-09

Read original source

What happened

AWS says S3 Access Points can now attach to FSx for NetApp ONTAP file systems in 4 additional Regions, letting S3-based AI/ML and analytics services (its example: Bedrock Knowledge Bases, Athena, Glue) read file data in place without copying. The announcement does not name the four Regions. The FSx for ONTAP user guide's Region table, inspected the same night, marks US East/West commercial Regions and most international Regions supported but leaves AWS GovCloud (US-East) and (US-West) and Asia Pacific (Thailand) unmarked. Why now: posted 9 Nov, after the last NetApp run; not in archive.

Why it matters

Agencies and universities already running FSx for ONTAP (file shares, research data) could expose that data to retrieval-augmented generation pipelines without a second copy, reducing duplicate-data governance. Applicability is limited for workloads that must stay in AWS GovCloud (for example CJIS-scoped public-safety data or some state HHS systems), because the user guide does not mark GovCloud as supported. No SLED deployment is reported.

Evidence and measured results

Vendor documentation only. The announcement states the regional expansion and use cases. The user guide states dual authorization (IAM access-point policy plus an associated UNIX/Windows file-system user), enforced Block Public Access that cannot be disabled, latency 'in the tens of milliseconds range', and throughput bounded by the file system's provisioned throughput. The compatibility page lists unsupported S3 features (object versioning, Object Lock, lifecycle, ACLs other than bucket-owner-full-control, MFA, conditional writes) and a 50 GiB upload limit. No benchmark, customer measurement or independent evaluation was found.

Limitations and uncertainty

Vendor-claim only (AWS). The four new Regions are unnamed in the announcement; the GovCloud status is inferred from an unmarked cell in the user-guide table on retrieval date and may change. Cross-stream: this is an AWS-delivered NetApp ONTAP service; filed under NetApp because it changes how ONTAP-resident data reaches AI services. No performance or cost figures were published.

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway

Customer problem: SLED teams want AI retrieval over existing file shares but copying data into separate S3 buckets duplicates sensitive records and governance effort.
Stakeholders: Agency or campus CIO/CTO
Data governance or records officer
Cloud platform team running FSx for ONTAP
Information security officer
Research computing lead (higher ed)
Discovery questions: Which FSx for ONTAP volumes hold data AI pilots want to index?
Are any of those workloads required to run in AWS GovCloud?
How are current RAG pilots copying file data today, and who approves those copies?
Do you rely on S3 Object Lock or versioning for retention?
Value hypothesis: In-place S3 access to ONTAP volumes may reduce duplicate data copies and the governance work they create for a bounded AI pilot, subject to Region support and throughput testing.
Potential engagement: A two-to-four-week assessment of one FSx for ONTAP volume and one AI consumer, documenting permissions mapping, throughput impact and retention gaps.
Unsupported claims: Any cost savings or performance figures (none published)
Support in AWS GovCloud (not marked in the user guide)
Equivalence with native S3 buckets (versioning, Object Lock, lifecycle unsupported)
Any SLED customer adoption

Pre-sales engineering

Role takeaway

Fit: Fits accounts already on FSx for ONTAP in a supported commercial Region that want S3-API consumers on file data without copies.
Architecture and integration: S3 access point attaches to an FSx for ONTAP volume; requests are authorized by S3/IAM policies and then by the mapped UNIX or Windows file-system user; NFS/SMB access continues in parallel.
Prerequisites: FSx for ONTAP file system in a Region marked supported
Defined file-system user per access point
VPC-only network configuration where required
Provisioned throughput sized for combined file and S3 load
Constraints: AWS GovCloud (US-East/West) not marked supported in the user guide
50 GiB maximum object upload size
No object versioning, Object Lock, lifecycle or MFA delete via the access point
Only bucket-owner-full-control ACL supported
In-progress multipart parts excluded from FSx volume backups
Security: Block Public Access is enforced and cannot be disabled; authorization is dual-layer (IAM then file system), so least privilege requires reviewing both. Retention controls must come from ONTAP, not S3.
Proof of value: Confirm Region support in the user guide on the deployment date
Test that a restricted file ACL blocks an IAM-permitted S3 GET
Measure S3 read throughput and file-user latency concurrently
Verify backup/snapshot coverage of objects written via S3

Delivery

Role takeaway

Work: Pilot one access point on one classified volume feeding one AI consumer, with permission mapping, monitoring and a documented exit decision.
Dependencies: Supported AWS Region
Data classification of target volume
IAM and file-system administrators
AI consumer (e.g., knowledge-base index) owner
Ownership: Cloud platform team operates the access point; the data owner approves scope; security owns permission review.
Skills and adoption: Storage admins need IAM/S3 policy skills and cloud teams need ONTAP permission skills; plan cross-training before scale-out.
Governance checkpoints: Data-owner approval of exposed volumes
Security review of IAM-to-file-user mapping
Retention review given no Object Lock/versioning
Go/no-go after throughput test
Acceptance criteria: Zero unauthorized reads in a negative-permission test
No more than an agreed latency increase for file users during S3 indexing
100% of pilot data reachable without a second copy
Documented decision on GovCloud-scoped data
Risks: Permission drift between IAM and file ACLs
Throughput contention with production file users
Retention gaps if teams assume S3 Object Lock
Region support assumptions changing

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

Pattern is file-and-object dual access on one ONTAP volume: NFS/SMB users and S3-API consumers see the same data. Throughput via S3 is bounded by provisioned FSx throughput, so AI indexing jobs compete with file users. Multipart-upload parts in progress are excluded from FSx volume backups. Regional placement must be confirmed per Region table before design.

Governance

Who approves, reviews and stays accountable for outcomes?

In-place access avoids creating ungoverned copies, but permission review now spans IAM policies, VPC endpoint policies and file-system ACLs; data owners must agree which file-system user each access point maps to.

Security and privacy

What data, permissions and controls need testing?

Block Public Access is enforced. Object Lock and versioning are not supported through the access point, so immutability/retention must rely on ONTAP-side features (snapshots, SnapLock where licensed) rather than S3 controls. Checksums are validated on upload but not stored for download verification.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Requires cross-skilling between storage and cloud IAM teams; no accessibility content in sources.

Procurement

What should contracts, pricing and exit terms secure?

Feature of existing FSx for ONTAP service; no separate SKU stated. Contract vehicles that restrict workloads to GovCloud would exclude it per the user guide table.

Operating model

Which teams own the service once it runs?

Shared responsibility shifts toward joint storage-cloud operations, with data owners approving each access point.

Publication history

2026-11-09NetApp · Issue 113 resources

Read preserved resource versions (JSON)

Stable resource ID: aws-fsx-ontap-s3-access-points-four-more-regions-govcloud-not-listed-20261109