AWS storagegateway: Added FIPS endpoints documentation
Summary
Documented FIPS-compliant and dual-stack FIPS endpoints for secure gateway connections
Security assessment
Added cryptographic compliance endpoints (FIPS) for government/regulated workloads, enhancing encryption standards documentation.
Evidence
+ anon-cp.storagegateway-fips.region.amazonaws.com:443
Diff
diff --git a/storagegateway/latest/vgw/Requirements.md b/storagegateway/latest/vgw/Requirements.md index d1ed5390a..ab6ce31ff 100644 --- a//storagegateway/latest/vgw/Requirements.md +++ b//storagegateway/latest/vgw/Requirements.md @@ -58,0 +59,4 @@ The Storage Gateway AMI is only compatible with x86-based instances that use Int +###### Note + +The Storage Gateway AMI requires an Amazon EC2 instance type that supports UEFI boot mode. If you choose an instance type that supports only legacy BIOS boot, the instance cannot start and does not pass its health checks. Before you launch your gateway, confirm that your chosen instance type supports UEFI boot. To check which boot modes an instance type supports, call the [DescribeInstanceTypes](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) Amazon EC2 API operation. Then review the `SupportedBootModes` field in the response. UEFI boot support might also vary by Availability Zone. + @@ -80 +84 @@ Recommended for cached volumes - * Storage-optimized instance family – **i3, i4, or i7** instance types. + * Storage-optimized instance family – **i4 or i7** instance types. @@ -152 +156 @@ Not required for gateways hosted on Amazon EC2. -Storage Gateway | Storage Gateway VM | Support Endpoint | TCP SSH | 22 | ✓ | ✓ | ✓ | Allows Support to access your gateway to help you with troubleshooting gateway issues. You don't need this port open for the normal operation of your gateway, but it is required for troubleshooting. For a list of support endpoints, see [Support endpoints](https://docs.aws.amazon.com//general/latest/gr/awssupport.html). +Storage Gateway | Storage Gateway VM | Support Endpoint | TCP SSH | 22 | ✓ | ✓ | ✓ | Allows Support to access your gateway to help you with troubleshooting gateway issues. You don't need this port open for the normal operation of your gateway, but it is required for troubleshooting. For a list of support endpoints, see [Support endpoints](https://docs.aws.amazon.com/general/latest/gr/awssupport.html). @@ -253,5 +256,0 @@ These endpoints support IPv4 traffic between your gateway appliance and AWS. -The following service endpoint is required by all gateways for head-bucket operations. - - - bucket-name.s3.region.amazonaws.com:443 - @@ -280,5 +278,0 @@ These endpoints support both IPv4 and IPv6 traffic between your gateway applianc -The following dual-stack service endpoint is required by all gateways for head-bucket operations. - - - bucket-name.s3.dualstack.region.amazonaws.com:443 - @@ -302,0 +297,38 @@ The following example is a gateway dual-stack service endpoint in the US West (O +###### FIPS endpoints + +These endpoints support IPv4 traffic between your gateway appliance and AWS, and comply with Federal Information Processing Standards (FIPS). + +FIPS gateways require the following service endpoints for control path (`anon-cp`, `client-cp`, `proxy-app`) and data path (`dp-1`) operations. + + + anon-cp.storagegateway-fips.region.amazonaws.com:443 + client-cp.storagegateway-fips.region.amazonaws.com:443 + proxy-app.storagegateway-fips.region.amazonaws.com:443 + dp-1.storagegateway-fips.region.amazonaws.com:443 + +Use the following gateway service endpoint to make API calls. + + + storagegateway-fips.region.amazonaws.com:443 + +###### Dual-stack FIPS endpoints + +These endpoints support both IPv4 and IPv6 traffic between your gateway appliance and AWS, and comply with FIPS. + +FIPS gateways require the following dual-stack service endpoints for control path (activation, controlplane, proxy) and data path (dataplane) operations. + + + activation-storagegateway-fips.region.api.aws:443 + controlplane-storagegateway-fips.region.api.aws:443 + proxy-storagegateway-fips.region.api.aws:443 + dataplane-storagegateway-fips.region.api.aws:443 + +Use the following gateway dual-stack service endpoint to make API calls. + + + storagegateway-fips.region.api.aws:443 + +###### Note + +FIPS endpoints are available only in some AWS Regions. For more information, see [Storage Gateway endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/sg.html) in the _AWS General Reference_. +