TECH **AWS Storage Gateway: Zero-Fluff, Hands-On Study Guide**

AWS Storage Gateway: Zero-Fluff, Hands-On Study Guide

(For AWS Solutions Architect – Associate & Real-World Deployments)

1. What This Is & Why It Matters

AWS Storage Gateway is a hybrid cloud storage service that connects your on-premises environments to AWS storage (S3, EBS, Glacier). It acts like a "bridge" between your local data center and AWS, letting you: - Extend on-prem storage without buying more hardware.
- Back up data to AWS (cheaper than tape libraries).
- Cache frequently accessed files in your data center while storing the rest in S3.
- Migrate legacy apps to AWS without rewriting them.

Why This Matters in Production

• Legacy apps that can’t move to the cloud yet? Storage Gateway lets them use S3/EBS as if it were local storage.
• Tape backups are slow and expensive? Replace them with Tape Gateway (virtual tapes stored in S3/Glacier).
• Need low-latency access to files? File Gateway caches hot data locally while storing the rest in S3.
• Running out of on-prem storage? Volume Gateway lets you store snapshots in AWS while keeping active data local.

Real-World Scenario:
You’re a cloud engineer at a hospital. The radiology department has 50TB of medical images stored on a local NAS. They need to keep 6 months of data accessible (for fast retrieval) but archive older scans to reduce costs. Storage Gateway lets them: - Cache recent scans locally (File Gateway).
- Archive older scans to S3 Glacier (automatically via lifecycle policies).
- Avoid buying more NAS hardware (saving $50K/year).

2. Core Concepts & Components

1. File Gateway (NFS/SMB → S3)

• What it is: A virtual appliance (VM or hardware) that presents an S3 bucket as a network file share (NFS or SMB).
• Production insight:
• Cache mode: Frequently accessed files stay local; the rest live in S3.
• No versioning by default → Enable S3 versioning if you need file recovery.
• Cost trap: S3 request costs add up if you have many small files (e.g., logs).

2. Volume Gateway (iSCSI → EBS/S3)

• What it is: Presents block storage (like a hard drive) to your servers via iSCSI. Data is stored in AWS as EBS snapshots (for cached volumes) or S3 (for stored volumes).
• Two modes:
• Cached Volumes: Primary data in S3; frequently accessed data cached locally.
• Stored Volumes: Primary data local; async backups to S3 as EBS snapshots.
• Production insight:
• Cached volumes = Good for low-latency access to a subset of data.
• Stored volumes = Good for full backups (but require local storage).
• EBS snapshots are incremental → First backup is slow; subsequent backups are faster.

3. Tape Gateway (Virtual Tapes → S3/Glacier)

• What it is: Replaces physical tape libraries with virtual tapes stored in S3 (for active backups) or Glacier (for archives).
• Production insight:
• No more tape hardware → Save on maintenance and physical storage.
• Glacier retrieval times: Expedited (1–5 min), Standard (3–5 hours), Bulk (5–12 hours).
• Cost trap: Glacier retrieval fees can be high if you restore frequently.

4. Gateway Appliance

• What it is: The VM (VMware, Hyper-V, EC2) or hardware (AWS Storage Gateway Hardware Appliance) that runs the gateway software.
• Production insight:
• Minimum specs: 4 vCPUs, 16GB RAM, 80GB disk (for caching).
• Network requirements: Low latency (<100ms) to AWS for good performance.
• High availability: Deploy in a cluster if uptime is critical.

5. Storage Classes (S3/Glacier)

• File/Volume Gateway: Uses S3 Standard, S3 IA, or S3 Glacier (via lifecycle policies).
• Tape Gateway: Uses S3 (for active tapes) or Glacier (for archives).
• Production insight:
• S3 Standard = Frequently accessed data.
• S3 IA = Infrequently accessed (cheaper, but retrieval fees).
• Glacier = Long-term archives (cheapest, but slow retrieval).

6. Data Transfer & Caching

• File Gateway: Caches most recently used (MRU) files locally.
• Volume Gateway (Cached): Caches most frequently used (MFU) blocks.
• Production insight:
• Cache size matters: Too small → frequent S3 fetches (slow, expensive).
• Monitor cache hit ratio (CloudWatch metric: CacheHitPercent).

7. Security & Encryption

• Data in transit: TLS 1.2+ (enforced by default).
• Data at rest: AWS KMS or SSE-S3 (AES-256).
• IAM roles: Gateway needs permissions to access S3/EBS.
• Production insight:
• Enable KMS encryption for sensitive data (e.g., medical records).
• Restrict S3 bucket access with IAM policies (least privilege).

8. Monitoring & Alerts

• CloudWatch metrics:
• CacheHitPercent (File/Volume Gateway).
• UploadBufferFree (Volume Gateway).
• TapeUsage (Tape Gateway).
• Production insight:
• Set alerts for low cache hit ratio (e.g., <80%) → Indicates poor performance.
• Monitor upload buffer usage → If full, backups will fail.

3. Step-by-Step: Deploy a File Gateway (NFS → S3)

Prerequisites

✅ AWS account with admin IAM permissions.
✅ On-prem VM (VMware, Hyper-V, or EC2) with: - 4 vCPUs, 16GB RAM, 80GB disk.
- Network access to AWS (port 443, 80, 2049 for NFS).
✅ S3 bucket (for storing files).

Step 1: Deploy the Gateway Appliance

1. Download the VM image from AWS:
2. AWS Storage Gateway VM Images
3. Import into VMware/Hyper-V (or launch as an EC2 instance).
4. Power on the VM and note its IP address.

Step 2: Activate the Gateway in AWS

1. Go to AWS Storage Gateway console → Create gateway.
2. Choose "File gateway" → Next.
3. Select "VMware ESXi" or "Hyper-V" (or "Amazon EC2" if running in AWS).
4. Enter the VM’s IP address → Connect to gateway.
5. Configure:
6. Gateway name: prod-file-gateway
7. Time zone: Match your on-prem servers.
8. Gateway type: File gateway.
9. Click "Activate gateway".

Step 3: Create a File Share (NFS → S3)

1. Go to "File shares" → Create file share.
2. Configure:
3. Gateway: prod-file-gateway
4. S3 bucket name: my-company-files (must exist).
5. File share settings:
   • Protocol: NFS (or SMB if Windows).
   • Allowed clients: 192.168.1.0/24 (your on-prem subnet).
   • Squash: Root squash (security best practice).
6. Click "Create file share".

Step 4: Mount the NFS Share On-Prem

1. On a Linux server, run:
   bash
sudo mkdir /mnt/aws-files
sudo mount -t nfs <GATEWAY_IP>:/my-company-files /mnt/aws-files
2. Verify it works:
   bash
touch /mnt/aws-files/test.txt
aws s3 ls s3://my-company-files/ # Should show "test.txt"

Step 5: Enable S3 Lifecycle Policy (Optional)

1. Go to S3 console → Bucket: my-company-files → Management.
2. Create lifecycle rule:
3. Rule name: archive-old-files
4. Transition to IA after 30 days.
5. Transition to Glacier after 90 days.
6. Save.

Verification Checklist

✅ Files written to /mnt/aws-files appear in S3.
✅ S3 lifecycle policy moves old files to Glacier.
✅ CloudWatch shows CacheHitPercent > 80%.

4. ? Production-Ready Best Practices

Security

• IAM roles: Use least privilege (e.g., s3:PutObject, s3:GetObject only).
• KMS encryption: Enable for sensitive data (e.g., medical records).
• VPC endpoints: Use private connectivity to AWS (avoid public internet).
• NFS/SMB security:
• Restrict client IPs (Allowed clients in file share settings).
• Enable root squash (prevents privilege escalation).

Cost Optimization

• S3 lifecycle policies: Move old data to S3 IA/Glacier.
• Cache sizing: Monitor CacheHitPercent and adjust cache size.
• Tape Gateway: Use Glacier Deep Archive for long-term backups (cheapest).
• Volume Gateway: Use cached volumes if you only need a subset of data locally.

Reliability & Maintainability

• High availability: Deploy two gateways in a cluster (active/passive).
• Tagging: Tag gateways with Environment=prod, Owner=team-x.
• Naming conventions:
• prod-file-gateway-01
• dev-volume-gateway-cached
• Backup gateway config: Export CloudFormation template for disaster recovery.

Observability

• CloudWatch alarms:
• CacheHitPercent < 80% → Increase cache size.
• UploadBufferFree < 20% → Backups failing.
• S3 access logs: Enable for audit trails.
• Gateway logs: Forward to CloudWatch Logs.

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus (AWS SAA-C03)

Typical Question Patterns

1. "Which Storage Gateway type for replacing tape backups?"
2. ✅ Tape Gateway (virtual tapes in S3/Glacier).

3. ❌ File Gateway (for file shares, not backups).

4. "Need low-latency access to a subset of data, but store the rest in AWS?"

5. ✅ Volume Gateway (Cached Mode).

6. ❌ Stored Mode (keeps all data local).

7. "How to reduce S3 costs for old files?"

8. ✅ S3 lifecycle policy → S3 IA/Glacier.

9. ❌ Delete old files (loses data).

10. "Which protocol does File Gateway use for Windows?"

11. ✅ SMB.
12. ❌ NFS (Linux only).

Key ⚠️ Trap Distinctions

Common Scenario Question

"You need to back up 10TB of on-prem data to AWS with minimal cost. The data is rarely accessed but must be retained for 7 years. Which solution?"
- ✅ Tape Gateway → Glacier Deep Archive (cheapest long-term storage).
- ❌ S3 Standard (expensive for 7 years).
- ❌ Volume Gateway (not cost-effective for archives).

7. ? Hands-On Challenge (With Solution)

Challenge

You’re migrating a legacy app that writes logs to a local NFS share. The logs are rarely accessed after 30 days but must be kept for 5 years. How do you set this up with Storage Gateway?

Solution

1. Deploy File Gateway (NFS → S3).
2. Create an S3 bucket (app-logs-bucket).
3. Set S3 lifecycle policy:
4. Transition to S3 IA after 30 days.
5. Transition to Glacier Deep Archive after 1 year.
6. Mount the NFS share on the app server.

Why it works:
- File Gateway lets the app write logs as if they’re local.
- S3 lifecycle automatically moves old logs to cheaper storage.
- Glacier Deep Archive is the cheapest option for 5-year retention.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

1. AWS Storage Gateway Documentation
2. S3 Lifecycle Policies Guide
3. Storage Gateway Pricing (Cost optimization tips)
4. AWS Storage Gateway Deep Dive (YouTube) (Search for "AWS Storage Gateway Deep Dive")

Final Tip

Storage Gateway is your "hybrid cloud Swiss Army knife." Use it when: - You can’t move apps to the cloud yet (File/Volume Gateway).
- You need to replace tape backups (Tape Gateway).
- You want to extend on-prem storage without buying hardware.

Next time you see a legacy app struggling with storage, ask: "Could Storage Gateway help?" ?