Adding a File Portal to FSx for ONTAP S3 Access Points — Choosing Between Amplify Gen2 and Nextcloud (Part 1)

Reach the NAS from a browser and from AI, without stopping existing mounts — choosing between Amplify Gen2 and Nextcloud (part 1 of 6)

A Japanese version of this article is available: 日本語版

Introduction

I've been asked more than a few times how to open files sitting on a NAS in a browser and run AI over them. The data lives on NFS/SMB volumes and runs to hundreds of terabytes — between the sheer volume, the latency, and data-residency rules, copying it out to an external service isn't realistic. Requiring an NFS mount instead puts the data out of reach for anyone who isn't an engineer. Closing that gap felt worth doing, so I built a verification environment for it.

What I used is Amazon FSx for NetApp ONTAP S3 Access Points (hereafter FSx for ONTAP S3 AP, or S3 AP — an access point that exposes NAS volumes for read/write through the S3 API). Because it reaches the data in place, you can add a browser UI and AI processing while leaving existing NFS/SMB workflows exactly as they are. I implemented the portal with two approaches: Amplify Gen2 as an AI-processing dashboard, and Nextcloud as a file-sharing UI.

Here's the conclusion up front:

• S3 AP gives you browser access to NAS volumes with no data migration
• Amplify Gen2 and Nextcloud aren't mutually exclusive — both can attach to the same volume at the same time
• The deciding axis: Nextcloud when file sharing is the center of gravity, Amplify Gen2 when AI processing and ONTAP admin operations are
• With DemoMode you can bring the portal up in under 30 minutes without FSx for ONTAP, and try file browsing and AI processing

In this article, I'll walk through the design of the two approaches and how to choose between them, the DemoMode startup steps, and the places where I got stuck during implementation.

Who this is for: anyone who wants to reach files on a NAS from a browser and run AI over them, and the frontend or full-stack developer building that screen. Operating the storage itself — volumes, SnapMirror, SnapLock — starts in Part 4.

What this article does not cover: absolute performance figures, production hosting steps (this is an Amplify sandbox), tenant isolation design.

Teardown: a volume that has carried an S3 Access Point can keep a NAS bucket on the ONTAP side after every access point is detached, and ONTAP then refuses to delete the volume. Tear down with aws fsx delete-volume (measured in Part 6).

Here's the overall picture first.

Light theme shown. A dark theme version is available, and every figure is listed in the architecture diagram index.

Figure 1: Overall architecture — two frontends reaching the same volume through one S3 Access Point

The part worth noticing is that neither frontend moves any data. The S3 Access Point reads the existing NFS/SMB volume in place, so the same files stay available to existing clients at the same time.

Pick based on what you want to do. Both can connect to the same volume simultaneously, so you can start incrementally.

License: MIT License. Commercial use, modification, and redistribution permitted.

Repository: Yoshiki0705/FSx-for-ONTAP-S3AccessPoints-Serverless-Patterns

Prerequisites and Positioning

Audience: Anyone with unstructured data on NAS who wants to protect and leverage that data. On-premises NAS, cloud NAS (FSx for ONTAP, EFS, Azure NetApp Files, etc.) — the platform doesn't matter.

File data on NAS shares several common challenges:

This project implements approaches to these challenges using FSx for ONTAP S3 Access Points. FSx for ONTAP was chosen because it combines NFS/SMB/S3 multi-protocol access with integrated data protection: Snapshots, SnapLock (WORM), FlexClone, and ARP/AI (autonomous ransomware detection).

How you use the portal depends on your environment:

What this portal provides:

• Browser access to NAS files (no VPN or mount setup on the user side)
• AI analysis, classification, semantic search (Bedrock integration)
• ONTAP-specific data protection (Snapshot, SnapLock, FlexClone, ARP/AI)
• Audit trail visibility (CloudTrail + Athena)
• Sharing links (Presigned URLs), QR code access

How it differs from a browser-native file sharing service:

• No online simultaneous editing. Co-authoring happens on the SMB/NFS mount side
• No desktop sync client (NFS/SMB mount serves this purpose)
• No native mobile app (responsive web UI as alternative)

Whatever file sharing service you already use, keep it. What this portal adds is browser access, AI processing, an audit trail and data protection for the data that stays on the NAS. Authentication is independent through Cognito (SAML/OIDC federation supported), so existing contracts and licences are unaffected.

The shape this fits is an environment where the files live in one place and the processing you want belongs somewhere else. Two of them:

• Healthcare: DICOM images on the NAS, clinical data in a separate system. What gets added is browser access and retention management on the image side only. A deployable implementation of that shape is healthcare-dicom.
• Manufacturing: CAD files on NFS, day-to-day document sharing left where it is, AI quality inspection added on the CAD files alone. The implementation is manufacturing-analytics.

Other sectors — financial document processing, media, legal, research — sit on the same base. The overview is industry workload mapping and the implementations are under solutions/industry/. This article does not cover them.

Adding Web Experiences to NFS/SMB File Servers

NFS/SMB file servers have clear strengths: high throughput, low latency, multi-protocol support, and deep integration with workstation tools. These qualities make them the backbone of many organizations' workflows. Meanwhile, some of the web-based experiences that SaaS file sharing provides — browser access, AI integration, searchable audit trails — require additional tooling when working with file servers.

This portal adds those web experiences to existing file server environments without changing anything about how the servers operate:

No data movement required. S3 AP reads and writes data directly on the NAS volume. Edit via NFS/SMB → browse via S3 AP in browser → AI results written back to the same volume. All the same data.

Note: Existing NFS/SMB workflows are unaffected. NFS mounts from CAD tools, SMB access from Avid, cron job file processing — all continue working exactly as before. S3 AP is an additional access path to the same volume.

Note: Authentication is independent from existing SaaS (Cognito or LDAP/SAML). No impact on existing SaaS contracts or licenses.

How to Choose

Selection Flow (Q1-Q3)

Q1. Do users need to operate files from a browser?
  → No: EventBridge Scheduler (scheduled batch) is sufficient
  → Yes: Go to Q2

Q2. Primary need: "file sharing & sync"? Or "AI/ML processing launch & result viewing"?
  → File sharing focused: Nextcloud (or Storage Browser for S3)
  → AI processing focused: Amplify Gen2 portal
  → Both: Use together (covered in this article)

Q3. Are users technical? Or non-engineers?
  → Technical: Any of the GUI portals above
  → Non-engineers: Add Amazon Quick (MCP, natural language operation)

Comparison

How to choose: Amplify Gen2, Nextcloud, Storage Browser for S3, and Amazon Quick each suit a different context. The trade-offs above are listed symmetrically, including the constraints of the option I reached for, and the article records what actually worked on technical grounds. Read it as material for choosing against your own requirements.

Cost Estimates

Cost note: FSx for ONTAP infrastructure (~$194/month, 128 MBps configuration) is common across all approaches. The portal itself adds only tens of dollars per month. At 100 users, Cognito/AppSync/Lambda costs remain within pay-per-use bounds (serverless). At 1000 users, FSx for ONTAP throughput scaling (128→256 MBps, +~$194/month) is the primary scaling cost.

Figures vary by Region, configuration and exchange rate. Price an actual deployment from the FSx for ONTAP pricing page.

Approach 1: Amplify Gen2 — AI Processing Dashboard

What is Amplify Gen2 (Key Points for NAS Users)

AWS Amplify Gen2 is a full-stack development framework that lets you define both frontend (UI) and backend (auth, API, database, storage) in TypeScript and deploy to AWS.

What this means for NAS/file server users:

In short: when you want "browser UI + AI processing + authentication on NAS data," Amplify Gen2 delivers this without building or maintaining web servers. You write UI in React; AWS managed services handle the backend.

Architecture

┌───────────────────────────────────────────────────┐
│  Amplify Gen2                                     │
│  ┌──────────┐  ┌───────────────────────────────┐  │
│  │ Cognito  │  │ AppSync (Generic Dispatch)    │  │
│  │ + MFA    │  │  fileQuery → ListFiles λ      │  │
│  │ + Groups │  │  adminQuery → ResourceMgmt λ  │  │
│  └──────────┘  │  arpQuery → ArpResponse λ     │  │
│                │  protectionQuery → Snapshot λ │  │
│                └──────────────┬────────────────┘  │
└───────────────────────────────┼───────────────────┘
                                │
          ┌─────────────────────┼────────────────────┐
          │                     │                    │
          ▼                     ▼                    ▼
┌──────────────────┐  ┌─────────────────┐  ┌────────────────┐
│ S3 Access Point  │  │ ONTAP REST API  │  │ Step Functions │
│ (Internet-origin)│  │ (inside VPC)    │  │ (AI/ML jobs)   │
└──────────────────┘  └─────────────────┘  └────────────────┘

Light theme shown. A dark theme version is available.

Figure 2: Amplify Gen2 architecture — Lambda outside the VPC reads and writes the volume through the S3 Access Point

Keeping Lambda outside the VPC and letting it call the S3 Access Point directly is the crux of this design. Here's why.

Key Design Decisions

VPC split architecture:

• Non-VPC Lambda: Reads/writes files via S3 AP (Internet-origin). Fast cold starts.
• VPC Lambda: Calls ONTAP REST API (management LIF). Must be inside VPC.
• Never combine both in one Lambda (Internet-origin S3 AP unreachable via S3 Gateway VPC Endpoint).

Network note: VPC Lambda handles admin operations only. Required VPC Endpoints: Secrets Manager and CloudWatch Logs. S3 AP data access uses non-VPC Lambda, so NAT Gateway is not needed.

Generic Dispatch pattern: 155 operations consolidated into 10 generic endpoints (action + params: AWSJSON) to avoid CloudFormation 1MB limit.

Extensibility note: Adding one operation needs no AppSync schema or CloudFormation change, because the endpoints take an action string and a params payload. It is not only the handler, though: the generated src/lib/dispatchActions.ts has to be regenerated (scripts/portal_action_types.py --emit), and a new UI string has to be added across 8 locales. CI fails until both agree. See the PSTK Action Catalog for the full action list.

UI Layout (Sidebar)

┌───────────────┬─────────────────────────────────────┐
│ Browse        │                                     │
│  📂 All Files │  [Main Content Area]                │
│  ⭐ Favorites │                                     │
│  🕐 Recent    │                                     │
│  🔔 Watch     │                                     │
│  📤 Upload    │                                     │
│               │                                     │
│ AI & Proc.    │                                     │
│  ⚡ AI Proc.  │                                     │
│  🤖 AI Chat   │                                     │
│  🔍 Search    │                                     │
│  📋 History   │                                     │
│  📊 Analytics │                                     │
│  🗂️ Agent Dir │                                     │
│               │                                     │
│ Data Prot.    │  + Right Panel: AI Assistant        │
│  📸 Snapshots │  (appears on file selection)        │
│  🔒 Lock      │                                     │
│  🛡️ ARP/AI    │                                     │
│               │                                     │
│ Admin         │                                     │
│  🔧 Resources │                                     │
│  🔄 Version   │                                     │
│  🔍 Audit     │                                     │
└───────────────┴─────────────────────────────────────┘

4 groups × 17 sections. The sidebar pattern is the one file management screens generally use.

Key Features

• File selection → AI processing trigger → results shown on screen (5-second polling)
• Bedrock Q&A, Rekognition image analysis, Athena SQL, Textract OCR
• FlexClone snapshot restore (selected and run from the UI)
• Job execution history (DynamoDB, per-user tracking)
• 8-language i18n (JA/EN/KO/ZH-CN/ZH-TW/FR/DE/ES)
• Keyboard navigation + ARIA labels + Dark/Light mode
• Responsive (hamburger menu at 768px, tablet-ready)

Audit note: All operations are recorded in CloudTrail. Audit log retention is controlled via CloudTrail settings (default 90 days, extendable to 7 years for compliance). Self-service Athena queries available from the portal's Audit section.

Security note: Blast radius if a Cognito token is compromised — tokens are scoped by Cognito Groups via AppSync resolver authorization; access is limited to resources within the user's group. Default token expiry: 1 hour. MFA-required setting mitigates leakage risk.

Gotchas

• AppSync APPSYNC_JS runtime: new Date() not available → use util.time.nowISO8601()
• Data Source must be in the same CDK stack as AppSync API ("Data source not found" otherwise)
• Bedrock Nova Lite: requires converse() API (invoke_model + inputText is Titan-only)
• Presigned URLs: need explicit SigV4 + regional endpoint

Approach 2: Nextcloud — File Sharing UI

What is Nextcloud (Key Points for NAS Users)

Nextcloud is a self-hosted, open-source file sharing and collaboration platform. It provides browser-based file operations and sharing on infrastructure you control.

What this means for NAS/file server users:

When you configure FSx for ONTAP's S3 AP as Nextcloud's External Storage backend, ONTAP volume files appear in Nextcloud's folder listing. Files saved via NFS/SMB are immediately visible in the browser and syncable to desktop clients.

Architecture

# Nextcloud's External Storage App mounts S3 AP as S3-compatible storage
Nextcloud (Docker) → External Storage App (S3 backend) → S3 AP → FSx for ONTAP

Light theme shown. A dark theme version is available.

Figure 3: Nextcloud architecture — the External Storage App mounts the S3 Access Point as S3-compatible storage

Pass the S3 AP alias as the bucket name, and ONTAP volume contents appear in Nextcloud's file listing.

Setup (~5 minutes)

# Start Nextcloud container
cd solutions/nextcloud-test
make up

# Set your S3 AP alias or bucket name (e.g., "my-volume-ap-s3alias")
export S3_BUCKET=<YOUR_S3AP_ALIAS>

# Configure External Storage to mount ONTAP volume via S3 AP
make configure-s3

# Verify connection (success = file listing returned)
make verify

# Open in browser
open http://localhost:8080  # admin / admin123

What to expect: Nextcloud file listing shows files from your ONTAP volume (or S3 bucket) via S3 AP.

Key Features

• Desktop sync client (Windows/Mac/Linux)
• Sharing links (password-protected, time-limited)
• Comments & annotations
• WebDAV access
• LDAP/SAML authentication

Trade-offs

Gotchas

• use_path_style=true required (S3 AP alias only works with path-style addressing)
• occ files_external:config must be run once per parameter ("Too many arguments" otherwise)
• Empty credentials cause IMDS (169.254.169.254) fallback timeout in Docker

Cost

Local Docker: $0. Production (EC2 + RDS + ALB): ~$70-110/month.

Coexistence Pattern: Amplify + Nextcloud

They are not mutually exclusive — both can access the same FSx for ONTAP volume simultaneously.

Feature Comparison

Expected Usage Flow

1. Team uses Nextcloud daily for file browsing & sharing
   (same data visible as NFS/SMB users)

2. When AI processing is needed on a specific folder,
   launch it from the Amplify portal

3. Result files are written back to the same volume,
   instantly visible from Nextcloud and NFS

Light theme shown. A dark theme version is available.

Figure 4: Running both — AI processing and file management share one S3 Access Point

Authentication is independent (Nextcloud: LDAP/SAML, Amplify: Cognito). For gradual adoption, set up Nextcloud first, then add Amplify when processing needs arise.

Data Consistency

ONTAP keeps multi-protocol access consistent, but when a write becomes visible from the other protocol depends on the client's mount options. These are measured, on one volume reached from both an S3 Access Point and NFS (2026-08-09, ap-northeast-1, SINGLE_AZ_1, 128 MBps, NFSv3, concurrency 1):

If you are writing code that reads through the other protocol straight after a write, match your mount options to the measurement conditions. Every direction and the full conditions are in the verification record. Reproducibility of this measurement is incomplete in one respect: the ONTAP version could not be identified.

Storage operations note: Your existing procedures (volume creation, snapshot management, and so on) remain unchanged. This portal is an end-user-facing AI processing and file access layer; administrators carry on with the AWS Management Console / Amazon FSx API and the ONTAP CLI / REST API. Those three are the management interfaces reachable for FSx for ONTAP — ONTAP System Manager is not among them (management interfaces).

Comparison with Alternatives

Multiple approaches exist for "accessing NAS data from a browser." Each has trade-offs:

The S3 AP characteristic is "access data via S3 API without moving it." No data copy means no consistency issues or double storage costs. However, it's not "sign up and use immediately" like SaaS.

How to choose: DataSync + S3, Transfer Family SFTP, EFS + Lambda, and SaaS file sharing each suit a different context. The table above also carries the constraints on the FSx for ONTAP S3 AP side (custom code required, a few hours to stand up). Read it as material for choosing against your own requirements.

Try It (~30 Minutes)

Prerequisites

FSx for ONTAP is NOT required for DemoMode. You can verify portal behavior with a regular S3 bucket.

Fastest Path (~5 min, copy-paste 4 lines)

If Node.js and AWS credentials are ready:

# Clone repository and navigate to portal directory
git clone https://github.com/Yoshiki0705/FSx-for-ONTAP-S3AccessPoints-Serverless-Patterns.git && cd FSx-for-ONTAP-S3AccessPoints-Serverless-Patterns/solutions/amplify-portal

# Install dependencies (~2 min)
npm install

# Copy config (DemoMode default — no edits needed)
cp amplify/portal-config.example.ts amplify/portal-config.ts

# Start sandbox (first run also creates Cognito users, ~3 min)
npx ampx sandbox

What to expect: Terminal shows ✅ Deployment complete, then http://localhost:5173 opens the portal. You can browse files and access AI processing screens from the sidebar.

portal-config.ts Key Parameters

// portal-config.ts — parameter explanations
export const portalConfig = {
  // S3 AP alias (empty string = DemoMode, uses regular S3 bucket)
  // Production example: "my-ontap-vol-ap-s3alias"
  s3ApAlias: "",

  // VPC ID (empty = no VPC Lambda = DemoMode)
  // Production example: "vpc-0123456789abcdef0"
  vpcId: "",

  // Cognito group-to-S3AP mapping (different access per group)
  // Example: analysts group gets analysis AP only, admins get full access
  groupApMapping: {
    // "analysts": "analysis-vol-ap-s3alias",
    // "admins": "admin-vol-ap-s3alias"
  },
};

CI/CD note: Amplify Gen2 auto-deploys on git push. git push origin main triggers Amplify Hosting build/deploy. No separate CI/CD pipeline needed.

Nextcloud Setup (~5 min)

# Start Nextcloud container
cd solutions/nextcloud-test
make up

# Set your S3 AP alias or S3 bucket name
export S3_BUCKET=<YOUR_BUCKET_OR_AP_ALIAS>

# Configure External Storage
make configure-s3

# Verify connection
make verify

# Open in browser
open http://localhost:8080  # admin / admin123

What to expect: Nextcloud file listing shows files from the ONTAP volume (or S3 bucket) via S3 AP.

About DemoMode

Leave VPC settings empty in portal-config.ts to experience the portal UI and AI processing flow without FSx for ONTAP.

For production connectivity, see PoC → Production Guide.

Role-Based Documentation (8 Languages)

Demo note: Minimum 30-minute demo setup is "4-line fastest path → DemoMode launch → file browsing → AI processing screen." No FSx for ONTAP pre-build required.

Operational Considerations

File-Level Access Control

S3 AP access is governed by ONTAP's UNIX permissions (UID/GID) or Windows ACLs. The File System Identity specified when creating the S3 AP determines "who" the access runs as.

# Example: separate team access with multiple S3 APs
S3 AP "portal-readonly"  → UID 1001 (read-only)
S3 AP "portal-analyst"   → UID 1002 (analysis team, specific dirs only)
S3 AP "portal-admin"     → UID 0    (admin, full access)

Throughput Sharing

S3 AP access shares the same FSx for ONTAP throughput budget as NFS/SMB. Normal portal usage (directory listing + individual reads) is not an issue, but if heavy parallel reads coexist with NFS workloads, monitor CloudWatch ThroughputUtilization.

Options if throughput is insufficient:

• Scale up throughput capacity (first-generation file systems offer 128 / 256 / 512 / 1,024 / 2,048 MBps, and 4,096 MBps in some Regions; second-generation uses a separate series from 384 MBps up)
• Set QoS policy to cap portal volume throughput

Multi-Account Environments

This portal is designed for single-account use. AWS Organizations considerations:

• S3 AP: Cross-account access requires AP resource policy
• Cognito: Multi-account user consolidation recommended via SAML federation
• Tenant isolation: groupApMapping assigns different S3 APs per group

About Presigned URLs

AWS documentation lists Presign as "Not supported," but they work in practice (confirmed with AWS Support). Presigning is client-side SigV4 signature calculation, and since GetObject is Supported, there's no structural way to block it. However, production reliance is at your own risk since documentation says "Not supported." Set short expiry (5 minutes or less recommended).

Scaling Characteristics

Portal components are all serverless — the only scaling bottleneck is FSx for ONTAP throughput.

Data engineering note: File metadata is available via CloudTrail + S3 AP access logs. Queryable with Athena, but building a dedicated metadata catalog (Glue Data Catalog etc.) requires separate design.

Series Structure (6 Parts)

FAQ

Q: I'm not using FSx for ONTAP yet. Can I try this?
Yes. DemoMode uses a regular S3 bucket to demonstrate the portal's UI and AI processing flow. FSx for ONTAP can be added later.

Q: Do I need to replace the file sharing service we already use?
No. This portal is an additional layer for AI processing, data protection, and audit on NAS data.

Q: How much does it cost?
DemoMode is free (within AWS Free Tier). Production portal add-on: ~$5–50/month. Main cost is FSx for ONTAP infrastructure (~$194/month minimum).

Q: What about security?
Cognito MFA + Groups role separation, HTTPS, Secrets Manager. Enterprise SSO (SAML/OIDC) supported via Cognito federation. Part 2 covers the security model in detail.

Q: Can it handle large files (multiple GB)?
S3 AP upload has a 50GB object size limit (a single PutObject is capped at 5GB, so Storage Browser switches to multipart above that). For files larger than 50GB, place them on the volume via NFS/SMB and use the portal for browsing/processing only.

Q: Does this affect my existing operational procedures?
No. This portal is an end-user-facing additional layer. Operating through the ONTAP CLI / REST API and the AWS Management Console continues exactly as before.

Verified Environment

Resources

• GitHub: FSx for ONTAP S3 AP Serverless Patterns — This repository (MIT License)
• User Guide (8 languages) — End-user daily operations guide
• Compliance Guide (8 languages) — ARP/WORM/audit trail verification procedures
• PoC → Production Guide — DemoMode to production connectivity migration
• Scaling Guide — Capacity planning and throughput design
• Nextcloud External Storage Setup — Nextcloud + S3 AP detailed configuration
• S3 AP Compatibility Notes — API support status and known constraints
• DemoMode Guide — Running without FSx for ONTAP
• AWS: FSx for ONTAP S3 Access Points — Official documentation

Summary and Next Steps

For next steps, start with the 4-line fastest path in DemoMode and spend a few minutes in the sidebar UI and the AI processing screen. Once you can see which approach fits, the PoC → Production Guide covers moving to a production connection.

Part 2 covers storage operations (ARP/AI incident response, Tamperproof Snapshot, regulatory retention, Audit Log, FlexClone Restore), and Part 3 covers AI agent integration (AgentChat, semantic search, multi-agent teams, HITL). Parts 4 to 6 continue into delegating operations, what the running cluster stopped, and what was left off the screen.

• Part 2: Embedding Storage Operations into a File Portal
• Part 3: Embedding AI Agents into a File Portal
• Part 4: Putting FSx for ONTAP operations on a file portal on AWS
• Part 5: What I learned driving FSx for ONTAP from a file portal on AWS
• Part 6: What I left off the file portal on AWS

I hope this post helps someone out there.

See you next time.