On this page · 10 sections
Summary. AWS announced FIPS 140-3 validated endpoints over PrivateLink for Storage Gateway on 19 August 2026, covering Tape Gateway and Volume Gateway in 8 Regions and requiring gateway software version 3.2.7 or later. The Tape Gateway release notes date 3.2.7 to 30 June 2026 with the line "Added support for PrivateLink FIPS endpoints" — the capability had been in the appliance for 50 days before the announcement. The detail that decides your migration plan is not in the announcement at all: the endpoint type is encoded in the activation key, so an already-activated gateway cannot be moved onto a FIPS endpoint without being activated again. Interface endpoints bill at $0.01 per VPC endpoint hour and $0.01 per GB processed in US East (N. Virginia), and $0.011 per hour in Canada (Central).
What changed on 19 August 2026
Before this launch, Storage Gateway offered FIPS 140-3 validated endpoints only over the public internet. A regulated workload could have FIPS encryption or private connectivity, not both. As of 19 August 2026 a Tape Gateway or Volume Gateway can reach the Storage Gateway service endpoint through an interface VPC endpoint while using FIPS validated encryption.
AWS names 8 Regions where Storage Gateway offers FIPS endpoints: US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Canada (Central), Canada West (Calgary), AWS GovCloud (US-East) and AWS GovCloud (US-West). There is no European or Asia Pacific Region in that list, which rules the feature out for a team keeping data in Mumbai, Frankfurt or Ireland.
The announcement also scopes the feature to Tape Gateway and Volume Gateway. File Gateway is not named.
The release notes tell a different story from the announcement
The Tape Gateway and Volume Gateway release-note tables both carry the same row:
| Date | Software version | Change |
|---|---|---|
| 30 June 2026 | 3.2.7 | Updated operating system and software elements; added support for PrivateLink FIPS endpoints |
| 28 May 2026 | 3.2.6 | Updated operating system and software elements; improvements for 2.x to 3.x (AL2 to AL2023) migration |
| 4 May 2026 | 3.2.5 | Updated operating system and software elements; addressed default network MTU issue affecting Hyper-V gateways |
That matters in one practical way. The version requirement is not something you satisfy on announcement day by clicking an update: 3.2.7 has been available since 30 June, so a gateway that has taken its maintenance updates on schedule is already eligible, and a gateway that has not is at least two software versions behind. Check the running version before you plan anything else, because the announcement's "3.2.7 or later" is a floor set almost two months in the past.
The endpoint type is chosen at activation and not after
The Storage Gateway activation key is fetched from the appliance over HTTP, and the query string carries the endpoint type. AWS documents four distinct forms:
# standard endpoint
curl "http://{gateway_ip}/?activationRegion={region}&no_redirect"
# public FIPS endpoint
curl "http://{gateway_ip}/?activationRegion&endpointType=FIPS_DUALSTACK&ipVersion=ipv4&no_redirect"
# VPC endpoint
curl "http://{gateway_ip}/?activationRegion={region}&vpcEndpoint={vpc_endpoint}&no_redirect"
# VPC endpoint with FIPS
curl "http://{gateway_ip}/?activationRegion={region}&vpcEndpoint={vpc_endpoint}&endpointType=FIPS&ipVersion=ipv4&no_redirect"
The FIPS-over-PrivateLink form is the last one, and it exists only as an activation-time parameter. AWS's own phrasing in the announcement is "choose the FIPS VPC endpoint option when activating your gateway." There is no documented API, console control or CLI command that changes the endpoint type of a gateway that is already running.
For a Volume Gateway that means re-activating an appliance and re-attaching volumes. For a Tape Gateway it is worse, because virtual tapes belong to the gateway that created them: tapes have to be archived to the tape pool and retrieved onto the new gateway. Budget the retrieval, not the activation.
The same page lists the gateway types the activation call accepts: STORED, CACHED, VTL, FILE_S3 and FILE_FSX_SMB. The two File Gateway types are still in the parameter list even though the announcement scopes FIPS PrivateLink to Tape and Volume Gateway, and no page in the user guide says File Gateway is excluded. The only statement of that exclusion is the What's New post. Treat the announcement as the authority here and test before committing a File Gateway to a FIPS endpoint.
Three configuration details that break the endpoint
The PrivateLink page in the Storage Gateway user guide is where the working configuration lives, and it carries three requirements that are easy to miss.
| Requirement | Value | What happens if you miss it |
|---|---|---|
| Service name | com.amazonaws.{region}.storagegateway-fips |
Choosing the plain storagegateway service gives a private endpoint with no FIPS validation |
| Private DNS | Must NOT be enabled | AWS states "Verify that Enable Private DNS Name is not selected" |
| Security group ports | TCP 443, 1026, 1027, 1028, 1031 and 2222 | The gateway cannot complete activation or upload |
| DNS name to use | The first DNS name that does not specify an Availability Zone | An AZ-specific name pins the gateway to one zone |
| Region | Gateway must be activated in the same Region as the endpoint | Activation fails |
The private DNS requirement is the one that catches teams who have standardised on enabling private DNS for every interface endpoint they build. Storage Gateway wants the raw endpoint DNS name passed into the activation call instead, in the form vpce-1234567e1c24a1fe9-62qntt8k.storagegateway-fips.us-east-1.vpce.amazonaws.com.
Six open TCP ports is also more than the single port most interface endpoints need. Ports 1026, 1027, 1028, 1031 and 2222 are Storage Gateway control-channel ports, and a security group written from a generic PrivateLink template will allow 443 and nothing else.
What it costs
| Region | VPC endpoint hour | Data processed per GB (first 1 PB/month) | 730-hour month, one endpoint |
|---|---|---|---|
| US East (N. Virginia) | $0.010 | $0.010 | $7.30 |
| Canada (Central) | $0.011 | $0.010 | $8.03 |
| Asia Pacific (Mumbai), for comparison | $0.013 | $0.010 | $9.49 |
Rates read from the AWS Price List API AmazonVPC offer file on 22 August 2026. Mumbai is in the table only as a reference point — Storage Gateway does not offer FIPS endpoints there, so the comparison is about the general cost of interface endpoints rather than about this feature.
The endpoint hour is the small number. On a Tape Gateway pushing backups, the $0.01 per GB processed dominates: 50 TB a month through the endpoint is $500 in data processing on top of the storage and retrieval charges. Anyone moving from public FIPS endpoints to private ones is adding a per-GB charge that did not exist before, and that is the line item to put in front of finance before the change is approved.
Who this is actually for
The narrow reading is the right one. This launch matters if all of the following are true: you run Tape Gateway or Volume Gateway, you are in one of the 8 listed Regions, a control requires FIPS 140-3 validated cryptography, and a separate control forbids traffic to AWS service endpoints over the public internet. Federal, state and Canadian public-sector workloads are the obvious set — both GovCloud Regions are in the list.
If only one of those two controls applies to you, nothing changed on 19 August. Public FIPS endpoints already existed, and standard PrivateLink endpoints for Storage Gateway already existed.
What is still unknown
AWS has not published a dedicated FIPS PrivateLink page in the Storage Gateway user guide. The only documentation is the FIPS service-name note inside the existing PrivateLink page, the FIPS activation-key variants, and the release-note line. There is no stated position on whether a gateway activated against a standard VPC endpoint can be redirected to the FIPS endpoint through a support case, and no published list of which gateway software versions will remain supported once 3.2.8 ships. Until AWS documents a migration path, plan for re-activation.
FAQ
How eCorpIT can help
Private connectivity changes of this shape fail on the parts that are not in the announcement: the activation-key rewrite, the ports, and the per-GB charge that appears on the next invoice. eCorpIT's senior engineering teams design and run AWS network and storage architectures for regulated workloads, and we are ISO 27001:2022 certified. If your constraint is data residency rather than FIPS, our work on data residency and DPDP cloud architecture is the closer fit, and the Direct Connect prefix limits analysis covers the hybrid networking side. For the cost view, see cloud FinOps for Indian teams. Reach us at /contact-us/.
References
Last updated: 22 August 2026.
