JA EN
shiichan

Storage Gateway's FIPS traffic can now stay entirely within the private AWS network!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi everyone, it's Shii! AWS dropped a security-focused update today, so let's dive in!

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Storage Gateway's Tape Gateway and Volume Gateway can now use FIPS 140-3 validated endpoints over AWS PrivateLink. Until now, FIPS-compliant endpoints were only reachable over the public internet, but with this update, FIPS-compliant traffic can stay entirely within AWS's private network. The goal is to make Storage Gateway easier to use for regulated workloads.

The story so far

Previously, using a FIPS validated endpoint meant your traffic had to travel over the public internet. For industries with strict security requirements, having "FIPS-compliant encryption but a public network path" was probably a point of concern.

What changes

With this update, Tape Gateway and Volume Gateway can privately reach the Storage Gateway service endpoints through an interface VPC endpoint in your VPC. You keep FIPS validated encryption while keeping the entire connection inside AWS's private network, which is great news for teams handling workloads in regulated industries like finance, healthcare, or government.

Dive Deep

The original article also spelled out the requirements and setup steps.

  • Your gateway must be running software version 3.2.7 or later
  • To use it, create a FIPS interface endpoint for Storage Gateway in your VPC, then choose the "FIPS VPC endpoint" option when activating your gateway
  • Once activated, the gateway automatically connects through the FIPS validated endpoint on the private AWS network

It's available in these 8 regions:

  • US East (N. Virginia)
  • US East (Ohio)
  • US West (N. California)
  • US West (Oregon)
  • Canada (Central)
  • Canada West (Calgary)
  • AWS GovCloud (US-East)
  • AWS GovCloud (US-West)

The original article didn't mention pricing — it pointed to the AWS Storage Gateway User Guide and product page for more details.

Wrap-up

  • Tape Gateway and Volume Gateway can now keep FIPS traffic private over AWS PrivateLink
  • Requires gateway software version 3.2.7 or later
  • Available in 8 regions across the US, Canada, and GovCloud

If you're running Storage Gateway in a regulated industry, this is a quiet but welcome security upgrade!

Related posts