AWS Storage Gateway

What it is

AWS Storage Gateway gives On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry applications access to cloud storage through standard storage protocols: NFS (Network File System)A protocol for sharing files over a network, used mostly by Linux and Unix systems. Amazon EFS, Amazon FSx for OpenZFS, and Amazon FSx for NetApp ONTAP provide NFS file systems.Glossary entry and SMB (Server Message Block)The file-sharing protocol used by Windows. Amazon FSx for Windows File Server and Amazon FSx for NetApp ONTAP provide SMB shares, and Amazon S3 File Gateway can present S3 buckets as SMB shares.Glossary entry for files, iSCSI for block volumes and virtual tapes. Applications keep working unchanged while the data lands in Amazon S3, EBS snapshots, or the S3 Glacier storage classes. A local cache keeps recently used data close to the applications for low-LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry access.

A gateway is a software appliance that you run:

On premises as a VM (Virtual machine)A software computer that runs its own operating system on shared physical hardware, kept apart from other VMs by a hypervisor. An EC2 instance is a VM, except bare metal instances.Glossary entry on VMware ESXi, Microsoft Hyper-V, Linux KVM, or Nutanix AHV, or as a hardware appliance from a reseller.
In AWS as an EC2 instance (from an AMI (Amazon Machine Image)A template for launching EC2 instances: the operating system, software, and settings to copy onto the new instance's volumes, plus who may launch it. AMIs come from AWS, AWS Marketplace, or the community, or you create your own from an instance.Glossary entry), or in VMware Cloud on AWS, for example for DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry or to give EC2 applications the same interfaces.

Choose Storage Gateway when a question describes an on-premises application that must keep using files, volumes, or tapes while the storage moves to AWS: replacing file servers, extending storage, or replacing physical tape backups.

Gateway types

Gateway	Presents	Data goes to	Choose for
S3 File Gateway	NFS (v3, v4.1) and SMB (v2, v3) file shares	Amazon S3, one object per file	File shares backed by S3; data that cloud applications also read in S3
FSx File Gateway	SMB file shares	FSx for Windows File Server	Existing customers only: no longer available to new customers
Volume Gateway	iSCSI block volumes	S3, with backups as EBS snapshots	Block storage for on-premises servers, with cloud backups
Tape Gateway	iSCSI virtual tape library (VTL)	S3, archived to S3 Glacier Flexible Retrieval or Deep Archive	Replacing physical tapes without changing backup software

S3 File Gateway

Each file becomes an S3 object with the same path as its key, with no deduplication or compression, so applications in AWS (Athena, analytics, Lambda) can read the data directly in S3.
Choose the initial storage class for new objects: S3 Standard, Standard-IA, One Zone-IA, or Intelligent-Tiering (Glacier Instant Retrieval isn't supported). Use S3 Lifecycle to move objects to Glacier classes, and S3 versioning and replication as usual.
SMB shares authenticate users with Microsoft Active Directory (or guest access); NFS shares can limit access by client IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry.
If files change directly in S3 rather than through the gateway, the gateway doesn't see them until you refresh the cache: manually, on a schedule, or with a time-to-live (TTL (Time to live)How long something stays valid before it expires. A DNS record or cached item can be reused until its TTL runs out, then is fetched again; in DynamoDB, a TTL attribute deletes items after a set time.Glossary entry) setting.
The local cache needs at least 150 GiB and can grow to 64 TiB.

Volume Gateway

Mode	Primary data	Local disk holds	Volume size
Cached volumes	In Amazon S3	Frequently accessed data only (cache and upload buffer)	1 GiB to 32 TiB, up to 32 volumes (1 PiB) per gateway
Stored volumes	On premises, the complete dataset	Everything, with asynchronous backups to AWS	1 GiB to 16 TiB, up to 32 volumes (512 TiB) per gateway

Take incremental point-in-time snapshots, stored as EBS snapshots. Restore them to a gateway volume, or create an EBS volume from them (up to 16 TiB) and attach it to an EC2 instance, which makes Volume Gateway useful for disaster recovery and migration to EC2.
AWS Backup can manage backups and retention for both cached and stored volumes.
Choose cached to reduce on-premises storage; choose stored when the application needs low-latency access to the whole dataset.

Tape Gateway

Presents a virtual tape library: a media changer and 10 tape drives as iSCSI devices, so existing backup software writes to virtual tapes (100 GiB to 15 TiB each, up to 1,500 tapes or 1 PiB per gateway).
Active tapes live in S3. Archived tapes move to the virtual tape shelf, backed by S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive.
To read an archived tape, retrieve it to the library first: typically within 3–5 hours from Flexible Retrieval or 12 hours from Deep Archive.

Security, resilience, performance, and cost

Security

Data moves between the gateway and AWS over TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry. In AWS it is encrypted with SSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entry-S3 by default, or with SSE-KMS (or DSSE-KMS for file shares) using your keys.
IAM controls who manages gateways and which bucket a file share can use; CloudTrail records API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls.
The gateway can connect to AWS through public endpoints, VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry powered by AWS PrivateLink (over Direct Connect or VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry, charged per hour and per GB), or FIPS (Federal Information Processing Standards)US government standards for computer systems. FIPS 140-3, and the earlier FIPS 140-2, set security requirements for cryptographic modules, such as the hardware security modules behind AWS KMS and AWS CloudHSM.Glossary entry endpoints.

Resilience

Data stored in AWS has the durability of S3, EBS snapshots, and the Glacier classes.
On VMware, Storage Gateway HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry works with vSphere HA to restart a failed gateway VM automatically, at no extra cost.
On EC2, don't rely on instance store for the cache: data not yet uploaded is lost if the instance stops.

Performance

The local cache serves recent data at local latency; size it to hold your working set and data waiting to upload.
The gateway buffers and uploads data in parallel; bandwidth ThrottlingLimiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.Glossary entry schedules how much network it uses (Volume and Tape Gateways).

Cost

File shares: you pay S3 storage and request prices for the objects. Volume and Tape Gateways: pay per GB-month for volume and virtual tape storage (archived tapes at Glacier rates), plus data written to AWS and data transfer out. EBS snapshots are billed as EBS snapshots.
Your on-premises hypervisor and disks for the cache are your own cost; on EC2, you pay for the instance.

Monitoring

CloudWatch metrics such as CacheHitPercent, CachePercentUsed, and CachePercentDirty show how well the cache works. File Gateway audit logs record client operations on files and folders in SMB shares.

Storage Gateway, DataSync, or something else?

If the requirement is	Choose
On-premises apps keep using NFS or SMB, with data in S3	S3 File Gateway
Replace physical tape backups, keep backup software	Tape Gateway
iSCSI volumes on premises with cloud snapshots	Volume Gateway (cached or stored)
One-time or scheduled bulk copy of files to AWS	AWS DataSync
On-premises Linux servers mount a cloud file system directly	Amazon EFS over Direct Connect or VPN
Windows file shares in AWS, reached from on premises	FSx for Windows File Server over Direct Connect or VPN

Reverse mindmap: when the question points here

Is it AWS Storage Gateway?

Yes, when the question says
- On-premises app writes files over NFS or SMB to S3 leads to S3 File Gateway
- Replace a physical tape library leads to Tape Gateway
- On-premises iSCSI block storage backed by AWS leads to Volume Gateway
Choose the mode
- Keep only hot data on premises leads to Cached volumes
- Whole dataset local, backed up to AWS leads to Stored volumes
- Cheapest long-term tape archive leads to Archive tapes to Deep Archive
Operate it
- Files changed directly in S3 not visible leads to Refresh the cache
- Users authenticate to SMB shares leads to Active Directory
- Restore a volume as EC2 storage leads to EBS snapshot to EBS volume
No, when the question says
- Move data once, then stop leads to AWS DataSync
- Shared file system for EC2 in AWS leads to Amazon EFS or FSx

Key takeaways

Storage Gateway connects on-premises applications to AWS storage through NFS, SMB, and iSCSI, with a local cache.
S3 File Gateway stores each file as one S3 object; FSx File Gateway is no longer available to new customers.
Volume Gateway cached volumes keep primary data in S3 (up to 32 TiB each); stored volumes keep it on premises (up to 16 TiB) with snapshots as EBS snapshots.
Tape Gateway replaces physical tapes with a virtual tape library, archiving tapes to Glacier Flexible Retrieval or Deep Archive.
It runs as a VM, a hardware appliance, or an EC2 instance; data is encrypted in transit with TLS and at rest with SSE-S3 or KMS.