From the NetApp edition of October 31, 2026
NetApp AI Data Engine requirements: online installation depends on AWS-hosted registries, NetApp Console SaaS authentication and usage-metrics endpoints
NetApp · Strategic partner: AI data services deployment requirements · Global (endpoints hosted in AWS us-west-2 and us-east-1)
- Publisher
- NetApp Docs (AI Data Engine)
- Original publication
- Page last updated 10/29/2026
- Source retrieved
- 2026-11-01
What happened
NetApp's AIDE requirements page (updated 10/29/2026) says an online installation must reach a list of outbound endpoints. They include NetApp's container registry and S3 and STS endpoints in AWS us-west-2, NetApp Console registration and authentication (api.bluexp.netapp.com, netapp-cloud-account.auth0.com), a logs and metrics streaming endpoint, and AWS Cognito in us-east-1 for sending product usage metrics to NetApp. Runtime downloads come from GitHub, get.k3s.io and Docker endpoints, and installer scripts from a CloudFront host. login.microsoftonline.com is needed only for governed MCP access. The endpoints are the same through a proxy. The network table requires bidirectional Console agent to AIDE traffic on ports 80, 443, 8080 and 9000, and inbound 443 for AI clients to the MCP server. Active Directory DNS used by AIDE nodes must also resolve external names.
Why it matters
This is the practical gate for SLED adoption of AIDE. Agencies with CJIS, HIPAA, FERPA or state data-residency rules, and campuses with segmented research networks, will need security review of outbound connections to SaaS and AWS endpoints and of usage-metrics transmission. Air-gapped public-safety or utility environments may not fit an online installation. This run found no AIDE offline procedure.
Evidence and measured results
Vendor requirements documentation listing endpoints, purposes, initiating components and ports. No independent validation. The page describes an online installation and this run did not find an offline or dark-site AIDE procedure in the pages opened. NetApp Console separately documents private-mode releases (latest 4.10.0, 17 September 2026), but this run did not establish whether AIDE supports private mode.
Limitations and uncertainty
Vendor documentation that may change. Absence of an offline procedure in the pages opened is not proof that none exists. Telemetry content and retention are not described here. First-time source, not in the archive; included now because GA (26 October) makes these requirements the evaluation gate.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-01; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies and campuses want to evaluate AIDE but must justify outbound SaaS and cloud dependencies to security and compliance reviewers.
- Stakeholders
- CISO or information security officer
- Network and firewall team
- Privacy or compliance officer
- CJIS or HIPAA security contact where applicable
- Discovery questions
- Does policy allow outbound HTTPS to AWS-hosted registries and NetApp SaaS identity?
- Is any target environment air-gapped or CJIS-segmented?
- Must product telemetry be disclosed or approved?
- Is an outbound proxy mandatory, and does it support host-name rules?
- Value hypothesis
- Early qualification of egress requirements avoids stalled pilots and identifies environments where an AIDE evaluation is feasible now.
- Potential engagement
- Short readiness assessment: map NetApp endpoint requirements to the customer firewall and data-flow policies and produce an approval package.
- Unsupported claims
- AIDE runs fully air-gapped
- No data leaves the environment
- Compliance with CJIS, HIPAA or FERPA
Pre-sales engineering
Role takeaway
- Fit
- Fits networks where controlled outbound HTTPS to named SaaS and AWS endpoints is permitted.
- Architecture and integration
- AIDE nodes call AWS us-west-2 registry and S3 endpoints, NetApp Console and auth0, and Cognito; Console agent exchanges traffic with AIDE on 80/443/8080/9000.
- Prerequisites
- Host-name based egress rules or proxy with HTTPS CONNECT
- DNS that resolves external names
- Console agent reachable from AIDE
- Inbound 443 path for approved MCP clients
- Constraints
- Online installation documented; no offline AIDE procedure found
- IP-based allow-lists for the CloudFront installer host break
- Endpoint list can change with page updates
- Security
- Review telemetry and logs streaming, restrict MCP inbound access to the corporate network or VPN, and include NetApp SaaS identity in third-party risk review.
- Proof of value
- Pre-install connectivity test to every listed endpoint
- Confirm installation fails closed and logs clearly when an endpoint is blocked
- Capture and review outbound traffic during a pilot scan
Delivery
Role takeaway
- Work
- Produce allow-list, data-flow documentation and DNS validation; obtain security approval; then schedule installation.
- Dependencies
- Firewall change process
- Security plan owner
- Proxy configuration
- Console agent deployment
- Ownership
- Network team owns egress rules; security office owns data-flow approval; infrastructure team owns the AIDE host.
- Skills and adoption
- Network staff must manage host-name based rules; security reviewers need a briefing on Console, AIDE and telemetry roles.
- Governance checkpoints
- Security approval of outbound data flows
- Privacy sign-off on telemetry
- Periodic re-check of NetApp endpoint list
- Acceptance criteria
- Proposed: every required endpoint reachable from the AIDE host before install
- Proposed: documented approval for telemetry and logs streaming
- Proposed: MCP access limited to approved network ranges
- Risks
- Installation blocked by a missed endpoint
- Policy conflict in CJIS or HHS segments
- Undocumented endpoint changes after page updates
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Egress allow-lists must use exact host names, since NetApp says IP-based rules for the CloudFront installer host will break. Multi-node clusters make container-runtime connections from every node. AIDE depends on a reachable Console agent, which links its patch posture to the Console agent's own advisories.
Governance
Who approves, reviews and stays accountable for outcomes?
Security and privacy offices should review what leaves the environment, including product usage metrics and logs/metrics streaming, and document it in system security plans or vendor risk assessments before pilots.
Security and privacy
What data, permissions and controls need testing?
Outbound dependencies on AWS-hosted registries and NetApp SaaS identity create supply-chain and availability dependencies. Usage metrics and logs/metrics streams leave the environment; the requirements page does not say what data they contain.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Requires network and security staff time for allow-list design and review; no accessibility content in the source.
Procurement
What should contracts, pricing and exit terms secure?
Vendor risk assessments and data processing terms covering telemetry should be part of any AIDE purchase.
Operating model
Which teams own the service once it runs?
AIDE operations depend on continuous SaaS connectivity, so outages or endpoint changes at NetApp or AWS become operational dependencies.
Publication history
- 2026-10-31NetApp · Issue 033 resources
Stable resource ID: netapp-aide-requirements-online-install-cloud-endpoints-20261029