Yoshiki Fujiwara(藤原善基)@AWS Community Builder for AWS Community Builders

Posted on Aug 3

Adding a File Portal to FSx for ONTAP S3 Access Points — Choosing Between Amplify Gen2 and Nextcloud (Part 1)

#aws #netapp #serverless #storage

Reach the NAS from a browser and from AI, without stopping existing mounts — choosing between Amplify Gen2 and Nextcloud (part 1 of 3)

A Japanese version of this article is available: 日本語版

Introduction

I've been asked more than a few times how to open files sitting on a NAS in a browser and run AI over them. The data lives on NFS/SMB volumes and runs to hundreds of terabytes — between the sheer volume, the latency, and data-residency rules, copying it out to an external service isn't realistic. Requiring an NFS mount instead puts the data out of reach for anyone who isn't an engineer. Closing that gap felt worth doing, so I built a verification environment for it.

What I used is Amazon FSx for NetApp ONTAP S3 Access Points (hereafter FSx for ONTAP S3 AP, or S3 AP — an access point that exposes NAS volumes for read/write through the S3 API). Because it reaches the data in place, you can add a browser UI and AI processing while leaving existing NFS/SMB workflows exactly as they are. I implemented the portal with two approaches: Amplify Gen2 as an AI-processing dashboard, and Nextcloud as a file-sharing UI.

Here's the conclusion up front:

S3 AP gives you browser access to NAS volumes with no data migration
Amplify Gen2 and Nextcloud aren't mutually exclusive — both can attach to the same volume at the same time
The deciding axis: Nextcloud when file sharing is the center of gravity, Amplify Gen2 when AI processing and ONTAP admin operations are
With DemoMode you can bring the portal up in under 30 minutes without FSx for ONTAP, and try file browsing and AI processing

In this article, I'll walk through the design of the two approaches and how to choose between them, the DemoMode startup steps, and the places where I got stuck during implementation.

Here's the overall picture first.

Light theme shown. A dark theme version is available, and every figure is listed in the architecture diagram index.

Figure 1: Overall architecture — two frontends reaching the same volume through one S3 Access Point

The part worth noticing is that neither frontend moves any data. The S3 Access Point reads the existing NFS/SMB volume in place, so the same files stay available to existing clients at the same time.

Approach	Role it plays
Amplify Gen2	AI processing dashboard (file selection → AI trigger → result display)
Nextcloud	File sharing UI (browsing, sync, sharing links)

Pick based on what you want to do. Both can connect to the same volume simultaneously, so you can start incrementally.

License: MIT License. Commercial use, modification, and redistribution permitted.

Repository: Yoshiki0705/FSx-for-ONTAP-S3AccessPoints-Serverless-Patterns

Prerequisites and Positioning

Audience: Anyone with unstructured data on NAS who wants to protect and leverage that data. On-premises NAS, cloud NAS (FSx for ONTAP, EFS, Azure NetApp Files, etc.) — the platform doesn't matter.

File data on NAS shares several common challenges:

Challenge	Context
Data grows but stays underutilized	Files accumulate year over year — ownership unclear, labels missing, search difficult (CSA study)
Ransomware target	Shared drives are primary targets for encryption attacks. Without detection/stop mechanisms, damage spreads
Want AI but can't move data	Data volume, latency requirements, and data residency regulations make copying to external services impractical
Limited remote access	VPN + mount is required — browser-based access needs additional infrastructure
Audit & compliance overhead	Access logs exist but answering "who accessed what when" in a UI requires a separate analytics layer

This project implements approaches to these challenges using FSx for ONTAP S3 Access Points. FSx for ONTAP was chosen because it combines NFS/SMB/S3 multi-protocol access with integrated data protection: Snapshots, SnapLock (WORM), FlexClone, and ARP/AI (autonomous ransomware detection).

How you use the portal depends on your environment:

Your Environment	How to Use This Portal
Considering migration from on-prem NAS	Build FSx for ONTAP + S3 AP for browser access, AI processing, and data protection in one step
Already using FSx for ONTAP	Enable S3 AP on existing volumes — all portal features become available immediately
NAS + SaaS side by side	Keep SaaS as-is. Add AI processing, audit, and protection for NAS data
Using another cloud NAS	Connect via SnapMirror or DataSync to FSx for ONTAP, then add capabilities incrementally

What this portal provides:

Browser access to NAS files (no VPN)
AI analysis, classification, semantic search (Bedrock integration)
ONTAP-specific data protection (Snapshot, SnapLock, FlexClone, ARP/AI)
Audit trail visibility (CloudTrail + Athena)
Sharing links (Presigned URLs), QR code access

How it differs from SaaS file sharing:

No real-time co-authoring (like Google Docs simultaneous editing)
No desktop sync client (NFS/SMB mount serves this purpose)
No native mobile app (responsive web UI as alternative)

Note: Authentication is independent via Cognito (SAML/OIDC federation supported). No impact on existing SaaS contracts or licenses.

Current Setup	What this portal adds
Box for contracts	Tamperproof Snapshot on NAS originals (FISC 7-year retention)
SharePoint for design docs & reports	AI anomaly detection and classification on NAS files (one-click trigger)
Google Drive for team files	"Who accessed what when" audit trail (CloudTrail + Athena)
Dropbox for project file sync	Ransomware detection + automated containment (ARP/AI)
NFS/SMB direct access only	Browser-based file access for non-technical users + AI analysis

Industry-specific examples:

Financial services: "Hundreds of TB of trading logs and risk calculation results on NFS. Daily documents in SharePoint, but we need anomaly detection on logs and 7-year audit trail retention"
Manufacturing: "500TB of CAD files on NFS, daily document sharing via SharePoint. Add only AI quality inspection on CAD files through the portal"
Healthcare: "DICOM images stored on NAS, clinical data in a dedicated system. Need AI diagnostic support access to images with HIPAA-compliant retention management"
Media & entertainment: "Multiple PB of video assets (ProRes/MXF). Daily editing via NFS mount from Avid/Premiere, but need AI auto-tagging of content management metadata"
Legal: "Tens of thousands of contract PDFs accumulated on NAS. Need AI-powered content search, automated classification, and deadline visibility"
Research: "Hundreds of TB of genomics analysis and simulation results. Researchers want to search and preview results from a browser without using CLI"

Adding Web Experiences to NFS/SMB File Servers

NFS/SMB file servers have clear strengths: high throughput, low latency, multi-protocol support, and deep integration with workstation tools. These qualities make them the backbone of many organizations' workflows. Meanwhile, some of the web-based experiences that SaaS file sharing provides — browser access, AI integration, searchable audit trails — require additional tooling when working with file servers.

This portal adds those web experiences to existing file server environments without changing anything about how the servers operate:

Experience Added	Traditional Approach	How This Portal Delivers It
Browser access (no VPN)	VPN + mount configuration	S3 AP + Cognito auth (Internet-origin)
Natural language file search	grep or find on file names/paths	Bedrock Knowledge Base semantic search
Sharing links (expiring, password-protected)	Manual smbclient or email attachment	Presigned URL time-limited links + QR codes
Version history visibility	Snapshots exist but require CLI/API	Snapshot list in UI + FlexClone one-click restore
Audit trail in a UI	Parse auditd or FPolicy logs	CloudTrail + Athena self-service query
AI analysis & classification	Requires building a separate pipeline	Bedrock + Step Functions one-click trigger
Ransomware visibility	ONTAP ARP runs but checking needs System Manager + VPN	ARP/AI dashboard in browser
Mobile / tablet access	Requires dedicated apps or VPN	Responsive web UI + QR code access
Compliance reporting	Run SnapLock CLI commands and compile manually	Lock panel with FISC/SOX/HIPAA presets + status overview

No data movement required. S3 AP reads and writes data directly on the NAS volume. Edit via NFS/SMB → browse via S3 AP in browser → AI results written back to the same volume. All the same data.

Note: Existing NFS/SMB workflows are unaffected. NFS mounts from CAD tools, SMB access from Avid, cron job file processing — all continue working exactly as before. S3 AP is an additional access path to the same volume.

Note: Authentication is independent from existing SaaS (Cognito or LDAP/SAML). No impact on existing SaaS contracts or licenses.

How to Choose

Selection Flow (Q1-Q3)

Q1. Do users need to operate files from a browser?
  → No: EventBridge Scheduler (scheduled batch) is sufficient
  → Yes: Go to Q2

Q2. Primary need: "file sharing & sync"? Or "AI/ML processing launch & result viewing"?
  → File sharing focused: Nextcloud (or Storage Browser for S3)
  → AI processing focused: Amplify Gen2 portal
  → Both: Use together (covered in this article)

Q3. Are users technical? Or non-engineers?
  → Technical: Any of the GUI portals above
  → Non-engineers: Add Amazon Quick (MCP, natural language operation)

Comparison

What you want to do	Suited approach	Trade-off
Trigger AI/ML processing from UI, see results in real time	Amplify Gen2	Custom code required, React knowledge assumed
Browse, upload, sync, and share files via web	Nextcloud	AI integration needs Webhook development
Zero-custom-code file operation UI	Storage Browser for S3	Limited features (browse/DL/UL only)
Natural language file search & analysis	Amazon Quick + AgentCore MCP	Preview stage, region availability limited
No frontend needed, batch is fine	EventBridge Scheduler	No interactive operation

How to choose: Amplify Gen2, Nextcloud, Storage Browser for S3, and Amazon Quick each suit a different context. The trade-offs above are listed symmetrically, including the constraints of the option I reached for, and the article records what actually worked on technical grounds. Read it as material for choosing against your own requirements.

Cost Estimates

Approach	Monthly Cost	Includes
Amplify Gen2 portal	~$18-46	Cognito/AppSync/Lambda (within Free Tier) + AI pay-per-use
Nextcloud (EC2)	~$70-110	EC2 + RDS + ALB. Local Docker = $0
Storage Browser for S3	~$5	Amplify Hosting only
Quick + AgentCore MCP	~$5-15	Lambda execution only
EventBridge direct	~$1-5	Lambda + Step Functions execution only

Cost note: FSx for ONTAP infrastructure (~$194/month, 128 MBps configuration) is common across all approaches. The portal itself adds only tens of dollars per month. At 100 users, Cognito/AppSync/Lambda costs remain within pay-per-use bounds (serverless). At 1000 users, FSx for ONTAP throughput scaling (128→256 MBps, +~$194/month) is the primary scaling cost.

Approach 1: Amplify Gen2 — AI Processing Dashboard

What is Amplify Gen2 (Key Points for NAS Users)

AWS Amplify Gen2 is a full-stack development framework that lets you define both frontend (UI) and backend (auth, API, database, storage) in TypeScript and deploy to AWS.

What this means for NAS/file server users:

Aspect	What Amplify Gen2 Handles
No infrastructure management	No servers to provision, patch, or scale. Everything runs serverless (Lambda, AppSync, Cognito)
Built-in authentication	Cognito provides email login, MFA, and enterprise SSO (SAML/OIDC) out of the box. No custom auth system to build
Direct AWS service integration	Connect to S3 Access Points, Bedrock (AI), Step Functions (workflows), Athena (analytics) with minimal code. No need to design IAM from scratch
Git-based deployment	`git push` triggers automatic build and deploy. No separate CI/CD pipeline required
Per-developer sandboxes	Isolated environments auto-created per developer. Team members work in parallel without conflicts
CDK extensibility	When standard features aren't enough, add any AWS resource (VPC Lambda, DynamoDB, etc.) via AWS CDK

In short: when you want "browser UI + AI processing + authentication on NAS data," Amplify Gen2 delivers this without building or maintaining web servers. You write UI in React; AWS managed services handle the backend.

Architecture

┌───────────────────────────────────────────────────┐
│  Amplify Gen2                                     │
│  ┌──────────┐  ┌───────────────────────────────┐  │
│  │ Cognito  │  │ AppSync (Generic Dispatch)    │  │
│  │ + MFA    │  │  fileQuery → ListFiles λ      │  │
│  │ + Groups │  │  adminQuery → ResourceMgmt λ  │  │
│  └──────────┘  │  arpQuery → ArpResponse λ     │  │
│                │  protectionQuery → Snapshot λ │  │
│                └──────────────┬────────────────┘  │
└───────────────────────────────┼───────────────────┘
                                │
          ┌─────────────────────┼────────────────────┐
          │                     │                    │
          ▼                     ▼                    ▼
┌──────────────────┐  ┌─────────────────┐  ┌────────────────┐
│ S3 Access Point  │  │ ONTAP REST API  │  │ Step Functions │
│ (Internet-origin)│  │ (inside VPC)    │  │ (AI/ML jobs)   │
└──────────────────┘  └─────────────────┘  └────────────────┘

Light theme shown. A dark theme version is available.

Figure 2: Amplify Gen2 architecture — Lambda outside the VPC reads and writes the volume through the S3 Access Point

Keeping Lambda outside the VPC and letting it call the S3 Access Point directly is the crux of this design. Here's why.

Key Design Decisions

VPC split architecture:

Non-VPC Lambda: Reads/writes files via S3 AP (Internet-origin). Fast cold starts.
VPC Lambda: Calls ONTAP REST API (management LIF). Must be inside VPC.
Never combine both in one Lambda (Internet-origin S3 AP unreachable via S3 Gateway VPC Endpoint).

Network note: VPC Lambda handles admin operations only. Required VPC Endpoints: Secrets Manager and CloudWatch Logs. S3 AP data access uses non-VPC Lambda, so NAT Gateway is not needed.

Generic Dispatch pattern: 73 operations consolidated into 8 generic endpoints (action + params: AWSJSON) to avoid CloudFormation 1MB limit.

Extensibility note: To add new operations, simply add an action entry to the Lambda handler's dispatch map. No AppSync schema or CloudFormation changes needed. See the PSTK Action Catalog for the full action list.

UI Layout (Sidebar)

┌───────────────┬─────────────────────────────────────┐
│ Browse        │                                     │
│  📂 All Files │  [Main Content Area]                │
│  ⭐ Favorites │                                     │
│  🕐 Recent    │                                     │
│  📤 Upload    │                                     │
│               │                                     │
│ AI & Proc.    │                                     │
│  ⚡ AI Proc.   │                                     │
│  📋 History   │                                     │
│  📊 Analytics │                                     │
│               │                                     │
│ Data Prot.    │  + Right Panel: AI Assistant        │
│  📸 Snapshots │  (appears on file selection)        │
│  🔒 Lock      │                                     │
│  🛡️ ARP/AI    │                                     │
│               │                                     │
│ Admin         │                                     │
│  🔧 Resources │                                     │
│  🔄 Version   │                                     │
│  🔍 Audit     │                                     │
└───────────────┴─────────────────────────────────────┘

4 groups × 13 sections. Same sidebar pattern as Google Drive and Box.

Key Features

File selection → AI processing trigger → real-time result display (5s polling)
Bedrock Q&A, Rekognition image analysis, Athena SQL, Textract OCR
FlexClone snapshot restore (one-click from UI)
Job execution history (DynamoDB, per-user tracking)
8-language i18n (JA/EN/KO/ZH-CN/ZH-TW/FR/DE/ES)
Keyboard navigation + ARIA labels + Dark/Light mode
Responsive (hamburger menu at 768px, tablet-ready)

Audit note: All operations are recorded in CloudTrail. Audit log retention is controlled via CloudTrail settings (default 90 days, extendable to 7 years for compliance). Self-service Athena queries available from the portal's Audit section.

Security note: Blast radius if a Cognito token is compromised — tokens are scoped by Cognito Groups via AppSync resolver authorization; access is limited to resources within the user's group. Default token expiry: 1 hour. MFA-required setting mitigates leakage risk.

Gotchas

AppSync APPSYNC_JS runtime: new Date() not available → use util.time.nowISO8601()
Data Source must be in the same CDK stack as AppSync API ("Data source not found" otherwise)
Bedrock Nova Lite: requires converse() API (invoke_model + inputText is Titan-only)
Presigned URLs: need explicit SigV4 + regional endpoint

Approach 2: Nextcloud — File Sharing UI

What is Nextcloud (Key Points for NAS Users)

Nextcloud is a self-hosted, open-source file sharing and collaboration platform. It provides Google Drive/Dropbox-like user experience on infrastructure you control.

What this means for NAS/file server users:

Aspect	What Nextcloud Handles
Data sovereignty	File data stays on your servers. No need to entrust data to external SaaS
Direct NAS connection	External Storage feature mounts S3 AP / NFS / SMB / WebDAV as additional folders. No data copy needed
Familiar experience	Desktop sync client (Windows/Mac/Linux), mobile apps, sharing links — SaaS-equivalent UX
No per-user licensing	AGPL-3.0, free to use. No per-seat pricing
Auth integration	Supports LDAP, SAML, OIDC. Connects to existing Active Directory

When you configure FSx for ONTAP's S3 AP as Nextcloud's External Storage backend, ONTAP volume files appear in Nextcloud's folder listing. Files saved via NFS/SMB are immediately visible in the browser and syncable to desktop clients.

Architecture

# Nextcloud's External Storage App mounts S3 AP as S3-compatible storage
Nextcloud (Docker) → External Storage App (S3 backend) → S3 AP → FSx for ONTAP

Light theme shown. A dark theme version is available.

Figure 3: Nextcloud architecture — the External Storage App mounts the S3 Access Point as S3-compatible storage

Pass the S3 AP alias as the bucket name, and ONTAP volume contents appear in Nextcloud's file listing.

Setup (~5 minutes)

# Start Nextcloud container
cd solutions/nextcloud-test
make up

# Set your S3 AP alias or bucket name (e.g., "my-volume-ap-s3alias")
export S3_BUCKET=<YOUR_S3AP_ALIAS>

# Configure External Storage to mount ONTAP volume via S3 AP
make configure-s3

# Verify connection (success = file listing returned)
make verify

# Open in browser
open http://localhost:8080  # admin / admin123

What to expect: Nextcloud file listing shows files from your ONTAP volume (or S3 bucket) via S3 AP.

Key Features

Desktop sync client (Windows/Mac/Linux)
Sharing links (password-protected, time-limited)
Comments & annotations
WebDAV access
LDAP/SAML authentication

Trade-offs

Strengths	Considerations
Mature NAS file sharing tool	AI/ML integration needs Webhook development
Desktop sync + mobile apps	EC2/RDS operational cost (production config)
Free under AGPL-3.0 (Docker as-is)	Source disclosure obligation if server code is modified

Gotchas

use_path_style=true required (S3 AP alias only works with path-style addressing)
occ files_external:config must be run once per parameter ("Too many arguments" otherwise)
Empty credentials cause IMDS (169.254.169.254) fallback timeout in Docker

Cost

Local Docker: $0. Production (EC2 + RDS + ALB): ~$70-110/month.

Coexistence Pattern: Amplify + Nextcloud

They are not mutually exclusive — both can access the same FSx for ONTAP volume simultaneously.

Feature Comparison

Feature	Nextcloud	Amplify Gen2
File browsing	✅	✅
File DL/UL	✅	✅ (Presigned URL, 50GB object limit)
Desktop sync	✅	△ (Use NFS/SMB instead)
Sharing links (time-limited)	✅	✅ (Presigned URL)
AI/ML processing workflows	⚠️ Webhook needed	✅
File Q&A (Bedrock)	❌	✅
FlexClone restore	❌	✅
ONTAP admin operations	❌	✅

Expected Usage Flow

1. Team uses Nextcloud daily for file browsing & sharing
   (same data visible as NFS/SMB users)

2. When AI processing is needed on a specific folder,
   launch it from the Amplify portal

3. Result files are written back to the same volume,
   instantly visible from Nextcloud and NFS

Light theme shown. A dark theme version is available.

Figure 4: Running both — AI processing and file management share one S3 Access Point

Authentication is independent (Nextcloud: LDAP/SAML, Amplify: Cognito). For gradual adoption, set up Nextcloud first, then add Amplify when processing needs arise.

Data Consistency

ONTAP guarantees strong consistency across multi-protocol access. A PutObject via S3 AP is immediately visible from NFS/SMB after write completion. The reverse is also true. Whichever portal writes, all see consistent data.

Storage operations note: Your existing ONTAP System Manager workflows (volume creation, snapshot management, etc.) remain unchanged. This portal does not replace System Manager — it's an end-user-facing AI processing and file access layer. Administrators continue using System Manager or ONTAP CLI/REST API for operations.

Comparison with Alternatives

Multiple approaches exist for "accessing NAS data from a browser." Each has trade-offs:

Approach	Suited for	Trade-off
This portal (S3 AP + Amplify/Nextcloud)	AI processing + admin ops without data movement	Custom code required, hours of initial setup
DataSync + S3 + any portal	Leveraging S3-native ecosystem	Data copy, sync lag, storage cost duplication
Transfer Family SFTP	Existing SFTP client compatibility	No web UI, AI integration needs extra development
EFS + Lambda	Serverless simplicity	No ONTAP-specific features (SnapLock, FlexClone, ARP)
Full SaaS (Box/SharePoint etc.)	Zero infrastructure, immediate availability	NAS data copy required, limited data protection features

The S3 AP characteristic is "access data via S3 API without moving it." No data copy means no consistency issues or double storage costs. However, it's not "sign up and use immediately" like SaaS.

How to choose: DataSync + S3, Transfer Family SFTP, EFS + Lambda, and SaaS file sharing each suit a different context. The table above also carries the constraints on the FSx for ONTAP S3 AP side (custom code required, a few hours to stand up). Read it as material for choosing against your own requirements.

Try It (~30 Minutes)

Prerequisites

Tool	Version	Check Command	Time
Node.js	20.x or later	`node --version`	0 min if installed
npm	10.x or later	`npm --version`	Bundled with Node.js
AWS CLI	2.x	`aws --version`	~2 min
AWS Account	—	`aws sts get-caller-identity`	0 min if authenticated
Docker	24.x or later	`docker --version`	Nextcloud only

FSx for ONTAP is NOT required for DemoMode. You can verify portal behavior with a regular S3 bucket.

Fastest Path (~5 min, copy-paste 4 lines)

If Node.js and AWS credentials are ready:

# Clone repository and navigate to portal directory
git clone https://github.com/Yoshiki0705/FSx-for-ONTAP-S3AccessPoints-Serverless-Patterns.git && cd FSx-for-ONTAP-S3AccessPoints-Serverless-Patterns/solutions/amplify-portal

# Install dependencies (~2 min)
npm install

# Copy config (DemoMode default — no edits needed)
cp amplify/portal-config.example.ts amplify/portal-config.ts

# Start sandbox (first run also creates Cognito users, ~3 min)
npx ampx sandbox

What to expect: Terminal shows ✅ Deployment complete, then http://localhost:5173 opens the portal. You can browse files and access AI processing screens from the sidebar.

portal-config.ts Key Parameters

// portal-config.ts — parameter explanations
export const portalConfig = {
  // S3 AP alias (empty string = DemoMode, uses regular S3 bucket)
  // Production example: "my-ontap-vol-ap-s3alias"
  s3ApAlias: "",

  // VPC ID (empty = no VPC Lambda = DemoMode)
  // Production example: "vpc-0123456789abcdef0"
  vpcId: "",

  // Cognito group-to-S3AP mapping (different access per group)
  // Example: analysts group gets analysis AP only, admins get full access
  groupApMapping: {
    // "analysts": "analysis-vol-ap-s3alias",
    // "admins": "admin-vol-ap-s3alias"
  },
};

CI/CD note: Amplify Gen2 auto-deploys on git push. git push origin main triggers Amplify Hosting build/deploy. No separate CI/CD pipeline needed.

Nextcloud Setup (~5 min)

# Start Nextcloud container
cd solutions/nextcloud-test
make up

# Set your S3 AP alias or S3 bucket name
export S3_BUCKET=<YOUR_BUCKET_OR_AP_ALIAS>

# Configure External Storage
make configure-s3

# Verify connection
make verify

# Open in browser
open http://localhost:8080  # admin / admin123

What to expect: Nextcloud file listing shows files from the ONTAP volume (or S3 bucket) via S3 AP.

About DemoMode

Leave VPC settings empty in portal-config.ts to experience the portal UI and AI processing flow without FSx for ONTAP.

Feature	DemoMode	Production
Sidebar UI / navigation	✅	✅
File browsing	⚠️ (S3 bucket)	✅ (S3 AP)
AI processing	⚠️ (needs Step Functions)	✅
ONTAP admin panels	⚠️ (shows "connection required")	✅

For production connectivity, see PoC → Production Guide.

Role-Based Documentation (8 Languages)

Guide	Audience	Content
User Guide	End users	Sign in → file ops → AI → FAQ
Compliance Guide	Security/Compliance officers	ARP verification → WORM checks → audit trail
Quick Reference	All roles	1-page operations cheat sheet

Demo note: Minimum 30-minute demo setup is "4-line fastest path → DemoMode launch → file browsing → AI processing screen." No FSx for ONTAP pre-build required.

Operational Considerations

File-Level Access Control

S3 AP access is governed by ONTAP's UNIX permissions (UID/GID) or Windows ACLs. The File System Identity specified when creating the S3 AP determines "who" the access runs as.

# Example: separate team access with multiple S3 APs
S3 AP "portal-readonly"  → UID 1001 (read-only)
S3 AP "portal-analyst"   → UID 1002 (analysis team, specific dirs only)
S3 AP "portal-admin"     → UID 0    (admin, full access)

Throughput Sharing

S3 AP access shares the same FSx for ONTAP throughput budget as NFS/SMB. Normal portal usage (directory listing + individual reads) is not an issue, but if heavy parallel reads coexist with NFS workloads, monitor CloudWatch ThroughputUtilization.

Options if throughput is insufficient:

Scale up throughput capacity (128→256/512/1024/2048 MBps)
Set QoS policy to cap portal volume throughput

Multi-Account Environments

This portal is designed for single-account use. AWS Organizations considerations:

S3 AP: Cross-account access requires AP resource policy
Cognito: Multi-account user consolidation recommended via SAML federation
Tenant isolation: groupApMapping assigns different S3 APs per group

About Presigned URLs

AWS documentation lists Presign as "Not supported," but they work in practice (confirmed with AWS Support). Presigning is client-side SigV4 signature calculation, and since GetObject is Supported, there's no structural way to block it. However, production reliance is at your own risk since documentation says "Not supported." Set short expiry (5 minutes or less recommended).

Scaling Characteristics

Component	Scaling	Downtime
Lambda / AppSync / Cognito / DynamoDB	Automatic (serverless)	None
FSx for ONTAP	Manual throughput/storage expansion	Minutes during throughput change

Portal components are all serverless — the only scaling bottleneck is FSx for ONTAP throughput.

Data engineering note: File metadata is available via CloudTrail + S3 AP access logs. Queryable with Athena, but building a dedicated metadata catalog (Glue Data Catalog etc.) requires separate design.

Series Structure (3 Parts)

Part	Theme	Key Content
Part 1 (this article)	Portal foundation	Amplify Gen2 vs Nextcloud, coexistence patterns, DemoMode
Part 2	Storage operations	ARP/AI incident response, Tamperproof Snapshot, regulatory retention, Audit Log, FlexClone Restore
Part 3	AI agent integration	AgentChat, semantic search, multi-agent teams, HITL

FAQ

Q: I'm not using FSx for ONTAP yet. Can I try this?
Yes. DemoMode uses a regular S3 bucket to demonstrate the portal's UI and AI processing flow. FSx for ONTAP can be added later.

Q: Do I need to replace my existing Box/SharePoint?
No. This portal is an additional layer for AI processing, data protection, and audit on NAS data.

Q: How much does it cost?
DemoMode is free (within AWS Free Tier). Production portal add-on: ~$5–50/month. Main cost is FSx for ONTAP infrastructure (~$194/month minimum).

Q: What about security?
Cognito MFA + Groups role separation, HTTPS, Secrets Manager. Enterprise SSO (SAML/OIDC) supported via Cognito federation. Part 2 covers the security model in detail.

Q: Can it handle large files (multiple GB)?
S3 AP upload has a 50GB object size limit (a single PutObject is capped at 5GB, so Storage Browser switches to multipart above that). For files larger than 50GB, place them on the volume via NFS/SMB and use the portal for browsing/processing only.

Q: Does this affect my existing ONTAP System Manager workflows?
No. This portal is an end-user-facing additional layer. System Manager admin operations continue working as before.

Verified Environment

Component	Version
Node.js	20.18.x
React	18.3.x
Amplify Gen2	1.x (as of 2026-07)
Python (Lambda)	3.12 (ARM64)
FSx for ONTAP	ONTAP 9.17.1
Region	ap-northeast-1
Verified	2026-07

Resources

GitHub: FSx for ONTAP S3 AP Serverless Patterns — This repository (MIT License)
User Guide (8 languages) — End-user daily operations guide
Compliance Guide (8 languages) — ARP/WORM/audit trail verification procedures
PoC → Production Guide — DemoMode to production connectivity migration
Scaling Guide — Capacity planning and throughput design
Nextcloud External Storage Setup — Nextcloud + S3 AP detailed configuration
S3 AP Compatibility Notes — API support status and known constraints
DemoMode Guide — Running without FSx for ONTAP
AWS: FSx for ONTAP S3 Access Points — Official documentation

Summary and Next Steps

Point	Conclusion
Data migration	Not needed — S3 AP reads the same volume NFS/SMB already uses
Portal choice	Nextcloud when file sharing is the center of gravity, Amplify Gen2 when AI processing and ONTAP admin operations are
Running both	Both can attach to the same volume at once. Authentication stays independent
How to try it	DemoMode takes about 30 minutes and needs no FSx for ONTAP
Existing workflows	NFS/SMB mounts and System Manager operations continue unchanged

For next steps, start with the 4-line fastest path in DemoMode and spend a few minutes in the sidebar UI and the AI processing screen. Once you can see which approach fits, the PoC → Production Guide covers moving to a production connection.

Part 2 covers storage operations (ARP/AI incident response, Tamperproof Snapshot, regulatory retention, Audit Log, FlexClone Restore), and Part 3 covers AI agent integration (AgentChat, semantic search, multi-agent teams, HITL).

I hope this post helps someone out there.

See you next time.