Storage Gateway FIPS PrivateLink shipped in software 3.2.7 on 30 June 2026, seven weeks before AWS announced it

Summary. AWS announced FIPS 140-3 validated endpoints over PrivateLink for Storage Gateway on 19 August 2026, covering Tape Gateway and Volume Gateway in 8 Regions and requiring gateway software version 3.2.7 or later. The Tape Gateway release notes date 3.2.7 to 30 June 2026 with the line "Added support for PrivateLink FIPS endpoints" — the capability had been in the appliance for 50 days before the announcement. The detail that decides your migration plan is not in the announcement at all: the endpoint type is encoded in the activation key, so an already-activated gateway cannot be moved onto a FIPS endpoint without being activated again. Interface endpoints bill at $0.01 per VPC endpoint hour and $0.01 per GB processed in US East (N. Virginia), and $0.011 per hour in Canada (Central).

What changed on 19 August 2026

Before this launch, Storage Gateway offered FIPS 140-3 validated endpoints only over the public internet. A regulated workload could have FIPS encryption or private connectivity, not both. As of 19 August 2026 a Tape Gateway or Volume Gateway can reach the Storage Gateway service endpoint through an interface VPC endpoint while using FIPS validated encryption.

AWS names 8 Regions where Storage Gateway offers FIPS endpoints: US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Canada (Central), Canada West (Calgary), AWS GovCloud (US-East) and AWS GovCloud (US-West). There is no European or Asia Pacific Region in that list, which rules the feature out for a team keeping data in Mumbai, Frankfurt or Ireland.

The announcement also scopes the feature to Tape Gateway and Volume Gateway. File Gateway is not named.

The release notes tell a different story from the announcement

The Tape Gateway and Volume Gateway release-note tables both carry the same row:

Date	Software version	Change
30 June 2026	3.2.7	Updated operating system and software elements; added support for PrivateLink FIPS endpoints
28 May 2026	3.2.6	Updated operating system and software elements; improvements for 2.x to 3.x (AL2 to AL2023) migration
4 May 2026	3.2.5	Updated operating system and software elements; addressed default network MTU issue affecting Hyper-V gateways

That matters in one practical way. The version requirement is not something you satisfy on announcement day by clicking an update: 3.2.7 has been available since 30 June, so a gateway that has taken its maintenance updates on schedule is already eligible, and a gateway that has not is at least two software versions behind. Check the running version before you plan anything else, because the announcement's "3.2.7 or later" is a floor set almost two months in the past.

The endpoint type is chosen at activation and not after

The Storage Gateway activation key is fetched from the appliance over HTTP, and the query string carries the endpoint type. AWS documents four distinct forms:

# standard endpoint
curl "http://{gateway_ip}/?activationRegion={region}&no_redirect"

# public FIPS endpoint
curl "http://{gateway_ip}/?activationRegion&endpointType=FIPS_DUALSTACK&ipVersion=ipv4&no_redirect"

# VPC endpoint
curl "http://{gateway_ip}/?activationRegion={region}&vpcEndpoint={vpc_endpoint}&no_redirect"

# VPC endpoint with FIPS
curl "http://{gateway_ip}/?activationRegion={region}&vpcEndpoint={vpc_endpoint}&endpointType=FIPS&ipVersion=ipv4&no_redirect"

The FIPS-over-PrivateLink form is the last one, and it exists only as an activation-time parameter. AWS's own phrasing in the announcement is "choose the FIPS VPC endpoint option when activating your gateway." There is no documented API, console control or CLI command that changes the endpoint type of a gateway that is already running.

For a Volume Gateway that means re-activating an appliance and re-attaching volumes. For a Tape Gateway it is worse, because virtual tapes belong to the gateway that created them: tapes have to be archived to the tape pool and retrieved onto the new gateway. Budget the retrieval, not the activation.

The same page lists the gateway types the activation call accepts: STORED, CACHED, VTL, FILE_S3 and FILE_FSX_SMB. The two File Gateway types are still in the parameter list even though the announcement scopes FIPS PrivateLink to Tape and Volume Gateway, and no page in the user guide says File Gateway is excluded. The only statement of that exclusion is the What's New post. Treat the announcement as the authority here and test before committing a File Gateway to a FIPS endpoint.

Three configuration details that break the endpoint

The PrivateLink page in the Storage Gateway user guide is where the working configuration lives, and it carries three requirements that are easy to miss.

Requirement	Value	What happens if you miss it
Service name	`com.amazonaws.{region}.storagegateway-fips`	Choosing the plain `storagegateway` service gives a private endpoint with no FIPS validation
Private DNS	Must NOT be enabled	AWS states "Verify that Enable Private DNS Name is not selected"
Security group ports	TCP 443, 1026, 1027, 1028, 1031 and 2222	The gateway cannot complete activation or upload
DNS name to use	The first DNS name that does not specify an Availability Zone	An AZ-specific name pins the gateway to one zone
Region	Gateway must be activated in the same Region as the endpoint	Activation fails

The private DNS requirement is the one that catches teams who have standardised on enabling private DNS for every interface endpoint they build. Storage Gateway wants the raw endpoint DNS name passed into the activation call instead, in the form vpce-1234567e1c24a1fe9-62qntt8k.storagegateway-fips.us-east-1.vpce.amazonaws.com.

Six open TCP ports is also more than the single port most interface endpoints need. Ports 1026, 1027, 1028, 1031 and 2222 are Storage Gateway control-channel ports, and a security group written from a generic PrivateLink template will allow 443 and nothing else.

What it costs

Region	VPC endpoint hour	Data processed per GB (first 1 PB/month)	730-hour month, one endpoint
US East (N. Virginia)	$0.010	$0.010	$7.30
Canada (Central)	$0.011	$0.010	$8.03
Asia Pacific (Mumbai), for comparison	$0.013	$0.010	$9.49

Rates read from the AWS Price List API AmazonVPC offer file on 22 August 2026. Mumbai is in the table only as a reference point — Storage Gateway does not offer FIPS endpoints there, so the comparison is about the general cost of interface endpoints rather than about this feature.

The endpoint hour is the small number. On a Tape Gateway pushing backups, the $0.01 per GB processed dominates: 50 TB a month through the endpoint is $500 in data processing on top of the storage and retrieval charges. Anyone moving from public FIPS endpoints to private ones is adding a per-GB charge that did not exist before, and that is the line item to put in front of finance before the change is approved.

Who this is actually for

The narrow reading is the right one. This launch matters if all of the following are true: you run Tape Gateway or Volume Gateway, you are in one of the 8 listed Regions, a control requires FIPS 140-3 validated cryptography, and a separate control forbids traffic to AWS service endpoints over the public internet. Federal, state and Canadian public-sector workloads are the obvious set — both GovCloud Regions are in the list.

If only one of those two controls applies to you, nothing changed on 19 August. Public FIPS endpoints already existed, and standard PrivateLink endpoints for Storage Gateway already existed.

What is still unknown

AWS has not published a dedicated FIPS PrivateLink page in the Storage Gateway user guide. The only documentation is the FIPS service-name note inside the existing PrivateLink page, the FIPS activation-key variants, and the release-note line. There is no stated position on whether a gateway activated against a standard VPC endpoint can be redirected to the FIPS endpoint through a support case, and no published list of which gateway software versions will remain supported once 3.2.8 ships. Until AWS documents a migration path, plan for re-activation.

FAQ

Can I switch an existing Storage Gateway to a FIPS PrivateLink endpoint?

Not through any documented control. The endpoint type is a parameter of the activation-key request made against the appliance, and AWS says to choose the FIPS VPC endpoint option when activating the gateway. There is no console option, API or CLI command that changes the endpoint type of a gateway already in service.

Which gateway software version do I need?

Version 3.2.7 or later. The Tape Gateway and Volume Gateway release notes both date 3.2.7 to 30 June 2026 and describe it as adding support for PrivateLink FIPS endpoints. Because that release is nearly two months old, a gateway on its normal maintenance schedule is likely already eligible without any action.

Which Regions support this?

Eight: US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Canada (Central), Canada West (Calgary), AWS GovCloud (US-East) and AWS GovCloud (US-West). No European or Asia Pacific Region is included, so teams keeping data in Mumbai, Frankfurt, Ireland or Singapore cannot use FIPS endpoints for Storage Gateway today.

Does File Gateway work with FIPS PrivateLink?

The announcement scopes the feature to Tape Gateway and Volume Gateway and does not name File Gateway. The activation-key documentation still lists FILE_S3 and FILE_FSX_SMB among accepted gateway types, and no user guide page states an exclusion, so the announcement is the only authority on scope.

What VPC endpoint service name should I choose?

For FIPS, choose com.amazonaws.{region}.storagegateway-fips rather than the plain com.amazonaws.{region}.storagegateway service name. Selecting the plain name produces a working private endpoint with no FIPS validation, a configuration that satisfies the network control while quietly failing the cryptography control. AWS also notes that FIPS endpoints exist in only some Regions.

Why must private DNS stay disabled?

The Storage Gateway user guide instructs you to verify that Enable Private DNS Name is not selected when creating the endpoint. The gateway is given the raw VPC endpoint DNS name in the activation request instead, using the first DNS name listed that does not specify an Availability Zone.

Which ports does the security group need?

TCP 443, 1026, 1027, 1028, 1031 and 2222 must all be allowed. A security group copied from a generic interface-endpoint template usually opens 443 only, which lets the endpoint reach a healthy state while the gateway still fails to activate or upload over the control channel.

What does the interface endpoint cost?

The AWS Price List API lists $0.01 per VPC endpoint hour and $0.01 per GB processed for the first petabyte a month in US East (N. Virginia), and $0.011 per hour in Canada (Central). One endpoint left running for a 730-hour month is $7.30 before data processing, and 50 TB of traffic adds $500.

How eCorpIT can help

Private connectivity changes of this shape fail on the parts that are not in the announcement: the activation-key rewrite, the ports, and the per-GB charge that appears on the next invoice. eCorpIT's senior engineering teams design and run AWS network and storage architectures for regulated workloads, and we are ISO 27001:2022 certified. If your constraint is data residency rather than FIPS, our work on data residency and DPDP cloud architecture is the closer fit, and the Direct Connect prefix limits analysis covers the hybrid networking side. For the cost view, see cloud FinOps for Indian teams. Reach us at /contact-us/.