NetApp ONTAP S3: Object Store Server and Bucket Setup

Since ONTAP 9.8 your NetApp cluster can speak S3 natively: an object store server runs inside a storage VM and serves S3 buckets out of ordinary FlexVols - no gateway VM and no extra license. That makes an existing FAS/AFF pair a drop-in target for Veeam-style S3 backup repositories and archive workloads. This guide covers the complete ONTAP S3 setup from CLI: creating the object store server with its root and data volumes, provisioning buckets and users, granting access with IAM-style policies, and testing with the AWS CLI.

Architecture in Brief

An object store server belongs to one SVM and binds to the SVM's data LIFs on HTTP (port 80) and HTTPS (port 443). It needs a dedicated root volume for object-store metadata plus one or more data volumes where buckets live. Buckets are not a separate filesystem - each bucket is carved from a FlexVol, so snapshots, QoS and dedupe all apply to object data automatically.

Step 1: Create the Object Store Server

vserver object-store-server create -vserver vs1   -root-volume data_vs1_root   -root-volume-security-style unix   -data-volumes data_vs1_data1,data_vs1_data2   -bucket-endpoint-style path-style   -policy default

Use path-style endpoints (https://host/bucket/key) unless clients specifically need virtual-hosted style, which requires wildcard DNS.

Step 2: Create a Bucket

vserver object-store-server bucket create -vserver vs1   -bucket reports   -volume data_vs1_data1   -size 1TB   -policy default

Bucket names must be 3-63 characters, lowercase letters/digits/hyphens/periods. The size is a hard ceiling - writes fail when the bucket is full even if the volume still has space. Grow it later with vserver object-store-server bucket modify -vserver vs1 -bucket reports -size 2TB.

Step 3: Create Users and Capture the Keys

vserver object-store-server user create -vserver vs1 -user backup-svc   -comment "Veeam service account"

ONTAP prints the access key and secret key exactly once - store them immediately. If the secret is lost, delete and recreate the user. Keys are cluster-wide unique, so the same user can access buckets on any object store server.

Step 4: Grant Access with a Policy

vserver object-store-server policy create -vserver vs1 -policy reports-ro
vserver object-store-server policy statement create -vserver vs1   -policy reports-ro   -effect allow   -principal backup-svc   -action s3:GetObject,s3:ListBucket   -resource arn:aws:s3:::reports/*,arn:aws:s3:::reports

Step 5: Test with AWS CLI

aws --endpoint-url https://10.0.0.5 --no-verify-ssl s3 ls
aws --endpoint-url https://10.0.0.5 --no-verify-ssl s3 mb s3://reports
aws --endpoint-url https://10.0.0.5 --no-verify-ssl s3 cp big-file.tgz s3://reports/

In production install a CA-signed certificate on the SVM and drop --no-verify-ssl. Common failures: AccessDenied on a valid key means the policy ARN is wrong (you usually need both arn:aws:s3:::bucket and arn:aws:s3:::bucket/*), and SignatureDoesNotMatch usually means clock skew - check NTP.

Related Guides on This Site

Before enabling S3 your SVM and LIFs must exist: see ONTAP SVM and LIF creation, protect buckets with snapshot policies, and debug issues via ONTAP EMS event logs.

原文链接：https://docs.netapp.com/us-en/ontap/s3-config/create-bucket-task.html