Embedding Storage Operations into a File Portal — From ARP/AI Incident Response to Regulatory Retention Management (Part 2)

Run detection through containment from the screen — ARP/AI, SnapLock, audit logs (part 2 of 3)

A Japanese version of this article is available: 日本語版

Introduction

In Part 1, I looked at putting a file portal on top of the S3 Access Point of Amazon FSx for NetApp ONTAP (hereafter FSx for ONTAP S3 AP, or S3 AP), comparing Amplify Gen2 and Nextcloud as two approaches. The portal at that point stopped at "browse the files" — the moment you wanted to know something about the storage layer, you had to go back to ONTAP System Manager or the CLI.

Once people started using it, the first two things that came back were "I want to check whether ARP has detected anything myself" and "is this snapshot actually locked?" Both requests came from team members outside storage administration, and the sticking point was the same: you cannot check any of it without a VPN connection to the management LIF. So I added ONTAP operations features to the Amplify Gen2 portal, up to the point where health checks and incident first response can be done entirely in a browser.

Here's the conclusion up front:

• ONTAP System Manager-equivalent admin operations can be executed from a browser through AppSync + Lambda
• Separating storage-admin from regular users with Cognito Groups gives you a safe split between read-only viewing and change operations
• Managing ransomware response as four states — Detected → Contained → Investigating → Resolved — removes the hesitation from first response
• Turning regulatory retention periods (FISC 7 years / SOX 5 years / HIPAA 6 years) into presets prevents day-count mistakes

In this article, I'll cover the design of the storage operations features embedded in the portal, the ONTAP REST API implementation behind them, and the points I was careful about when handling irreversible operations.

Light theme shown. A dark theme version is available, and every figure is listed in the architecture diagram index.

Relationship to existing tools: This portal makes the same storage management operations previously available only through ONTAP System Manager, ONTAP CLI, or REST API accessible from a browser with Cognito authentication. It is not a replacement for those tools — it's an additional layer that provides browser-based access to the same operations.

The features added are as follows:

• Storage Dashboard: a 4-card health overview
• ARP/AI Incident Lifecycle: managed as four states — Detected → Contained → Investigating → Resolved
• S3 Object Lock Configuration UI: select a bucket, specify a retention mode, apply
• PHI Guardrail: structurally blocks AI processing for paths such as /dicom/
• EMS Events: real-time ONTAP alert display
• Regulatory Retention Presets: FISC 7-year / SOX 5-year / HIPAA 6-year
• Welcome Modal: first-time user onboarding
• Audit Log: file access trail via CloudTrail, viewable in the UI
• FlexClone Restore: one-click recovery from snapshots
• Athena Query: SQL analysis on NAS data

Scope: this article is an implementation record of adding "operations features usable by members outside storage administration" to the file portal built in Part 1. Part 3 covers AI agent integration.

Repository: solutions/amplify-portal/

Why Embed Admin Operations in a Portal

ONTAP System Manager is a powerful Web UI, but accessing it requires a VPN connection to the management LIF. When team members outside storage administration (security staff, compliance officers, data protection teams) want to "check ARP status" or "verify whether a snapshot is locked," they have no self-service path.

Motivation for embedding admin operations:

1. Security staff should be able to instantly check ransomware detection state and execute containment actions
2. Compliance officers should be able to verify retention settings and audit logs themselves
3. Operations teams should be able to check ONTAP alerts without opening another tool

Cognito Groups (storage-admin / authenticated) separate authorization — regular users are read-only, only admins can execute changes.

What You Used to Do vs What You Can Do Now

Storage Dashboard — Admin Landing Page

The first thing admins see after login is a 4-card health dashboard. This follows ONTAP System Manager's "dashboard first" pattern.

┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐
│ 💾 12       │  │ 🛡️ 8         │  │ 🔐 5        │  │ 📊 3.2x 　   │
│ Volumes     │  │ARP Protected│  │ Locked Snaps│  │ Efficiency  │
│ Avg: 62%    │  │✅ No threats│  │ Tamperproof │  │ 69% saved   │
└─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘

The 4 Cards

Implementation

Four APIs fetched in parallel with Promise.allSettled. If one fails (e.g., ARP not configured), remaining cards still render.

const [volResp, arpResp, snapResp, effResp] = await Promise.allSettled([
  adminQuery({ action: "listVolumes", params: JSON.stringify({}) }),
  adminQuery({ action: "listArpVolumes", params: JSON.stringify({}) }),
  protectionQuery({ action: "listSnapshots", params: JSON.stringify({ maxResults: 50 }) }),
  adminQuery({ action: "getEfficiencyStats", params: JSON.stringify({}) }),
]);

Why Promise.allSettled over Promise.all: with Promise.all, one failure rejects everything. On a storage dashboard, "ARP not configured" is a normal state, not an error.

ARP/AI Incident Lifecycle

After ONTAP Autonomous Ransomware Protection (ARP/AI) detects a threat, the response flow is managed across 4 states.

State Transitions

🔴 Detected
  → 🟠 Contained
    → 🟡 Investigating
      → 🟢 Resolved

Light theme shown. A dark theme version is available.

What's Recorded at Each State

Containment Actions

Actions executable directly from the portal:

This implements the equivalent of NetApp DII Storage Workload Security blocking directly via ONTAP REST API.

Implementation

// useIncidentState hook — persists per-volume in localStorage
export type IncidentState = "none" | "detected" | "contained" | "investigating" | "resolved";

export function useIncidentState(volumeName: string) {
  const [incident, setIncident] = useState<IncidentRecord>(() => loadIncident(volumeName));

  const markContained = useCallback((snapshot?: string, users?: string[], ips?: string[]) => {
    transition("contained", { snapshotName: snapshot, blockedUsers: users || [], blockedIps: ips || [] });
  }, [transition]);

  // ...
}

The UI displays a state badge with the next action button changing dynamically:

[🔴 Detected] → [Execute Containment] button
[🟠 Contained] → [Start Investigation] button
[🟡 Investigating] → [Resolve] button
[🟢 Resolved] → (complete)

Current limitation: Incident state is stored in localStorage and not shared across browsers. There is also a risk of losing incident state if the browser crashes. DynamoDB persistence is recommended for production use so that multiple members see the same state.

Incident response note: After executing containment actions, integrate with your existing incident runbooks (PagerDuty, OpsGenie, etc.). Portal containment is a first-response action and should be positioned as part of your full incident management workflow.

Security note: Executing containment actions (SMB block, NFS IP block) requires membership in the storage-admin group. Unblocking requires the same privilege, so even if a regular user's browser session is compromised, the attacker cannot lift a block. Compromise of a storage-admin account itself is guarded by Cognito MFA.

Multi-tenant note: When multiple teams (tenants) share the same portal, ensure tenant A cannot view tenant B's ARP alerts by combining Cognito Groups with volume-level access control. In the current implementation, all storage-admin group members can view ARP status for all volumes. If tenant isolation is required, consider deploying separate portal instances per SVM.

PHI Guardrail — Structurally Blocking AI Processing

Prevents the "accidentally sent PHI data to an external AI" scenario at the UI level in HIPAA environments.

How It Works

Files in paths containing /dicom/, /phi/, /pii/, /hipaa/, or /protected-health/ have their AI processing button automatically disabled.

const isPhiPath = (path: string): boolean => {
  const lower = path.toLowerCase();
  return /\/(dicom|phi|pii|hipaa|protected-health)[\/-]/.test(`/${lower}`) ||
         lower.startsWith("dicom/") || lower.startsWith("phi/") || lower.startsWith("pii/");
};

UI display:

Normal folder: [⚡ Run AI Processing]     ← clickable
PHI folder:    [🚫 PHI — AI Blocked]      ← disabled, not clickable

Design Intent

• Guardrail, not detect-and-respond: rather than "processed it, then discovered it was PHI," this prevents processing from starting at all
• Cannot be bypassed even by admins: the button itself is disabled regardless of permissions
• Depends on folder naming convention: path-pattern based, so it presupposes organizational folder structure rules

Important limitation: This guardrail blocks based on folder path only — it does NOT scan file contents. A file like /contracts/sensitive-patient.pdf placed outside PHI paths will not be blocked. For content-based PHI detection, combine with Bedrock Guardrails (response filtering) described in Part 3. Path guardrail + content filtering gives you ideal 2-layer defense.

HIPAA note: Using this portal in a HIPAA environment presupposes a Business Associate Agreement (BAA) with AWS. Cognito, Lambda, S3, Step Functions, and Bedrock are all HIPAA eligible services. The PHI guardrail is an additional UI-level defense — both the BAA and technical controls are required.

S3 Object Lock — WORM Protection for Output Buckets

AI processing results and compliance reports are stored in standard S3 buckets outside FSx for ONTAP. The portal provides a UI to configure S3 Object Lock on these output buckets.

3-Tab Lock Panel

S3 Object Lock Configuration Flow

1. Fetch bucket list → select from dropdown
2. Choose mode:
   - Governance: Authorized users can override (recommended for AI output)
   - Compliance: No one, including root, can delete until retention expires (regulatory archives)
3. Specify retention days
4. [Apply] sets Object Lock Configuration

When to Use SnapLock vs S3 Object Lock

Combining both achieves "source data AND processing results both tamper-proof."

Compliance framework note: The AWS services used by this portal (Cognito, Lambda, S3, Step Functions, Bedrock, AppSync) are in scope for ISMAP and SOC 2. FedRAMP environments for US government agencies require deployment in AWS GovCloud regions. Confirm compliance requirements with your legal and compliance teams — this portal is a technical implementation pattern and does not provide compliance judgments.

Regulatory Retention Period Presets

The Tamperproof Snapshot lock form offers retention periods as dropdown selections.

Preset List

Compliance note: FISC/SOX/HIPAA presets are provided for technical convenience. Whether the regulatory mapping and retention periods apply to your organization's specific situation should be validated with your legal and compliance teams. Regulatory interpretation varies by industry, business scope, and jurisdiction.

Why Presets Are Needed

SnapLock retention settings are irreversible. Once a snapshot is locked, the retention period cannot be shortened.

• Prevents "how many days is 5 years?" calculation errors
• Each preset shows a tooltip with regulatory basis
• Minimizes risk of incorrect selection (can extend but never shorten)

<option value={1825} title="SOX/J-SOX: Financial records must be retained for 5 years">
  1,825 days — SOX/J-SOX (5 years)
</option>
<option value={2192} title="HIPAA: Medical records require minimum 6-year retention">
  2,192 days — HIPAA (6 years)
</option>
<option value={2557} title="FISC: Financial institution data requires 7-year retention">
  2,557 days — FISC (7 years)
</option>

EMS Events — ONTAP Alert Viewer

Retrieves events from ONTAP's Event Management System (EMS) with severity alert/error/emergency and displays them in the admin panel.

Backend Implementation

def _get_ems_events(http, headers, event):
    """ONTAP REST: GET /api/support/ems/events"""
    max_records = min(event.get("maxRecords", 20), 50)
    severity_filter = event.get("severity", "alert,error,emergency")

    query = f"/support/ems/events?max_records={max_records}"
    query += f"&severity={severity_filter}"
    query += "&order_by=time desc"
    query += "&fields=time,severity,message.name,message.text,node.name"

    data = _ontap_request(http, headers, "GET", query)
    events = [
        {
            "time": e.get("time", ""),
            "severity": e.get("severity", ""),
            "messageName": e.get("message", {}).get("name", ""),
            "messageText": e.get("message", {}).get("text", ""),
            "node": e.get("node", {}).get("name", ""),
        }
        for e in data.get("records", [])
    ]
    return {"events": events, "count": len(events)}

Example Events

Storage administrators can check recent alerts directly in the portal without accessing ONTAP System Manager or CLI.

Refresh frequency note: EMS events are fetched on demand when the dashboard is displayed (not by periodic polling). If you need real-time alerting, push EMS events via EventBridge + SNS instead (see fsxn-observability-integrations). The portal is for "checking recent events"; for "detecting in real time," consider pairing it with a separate observability stack.

Welcome Modal — First-Time Onboarding

First-time users see a 3-step guided tour.

3 Steps

1. 📂 File Browsing — Browse and search NAS files from your browser
2. ⚡ AI Processing — Select files and trigger AI/ML workflows
3. 🔒 Data Protection — Snapshots, WORM locks, ransomware protection

Implementation

export function WelcomeModal() {
  const [dismissed, setDismissed] = useState(() => {
    try { return localStorage.getItem("portal-welcome-dismissed") === "true"; }
    catch { return false; }
  });

  if (dismissed) return null;

  // 3-step carousel with dot navigation
  // "Don't show again" checkbox → localStorage persistence
}

Design Intent

• Standard onboarding pattern in SaaS products
• Often omitted in internal tools, but highly effective for conveying "what this portal can do" in 10 seconds
• localStorage state management, works without backend changes

Resource Management — 16-Panel Card-Grid Admin

ONTAP admin operations organized into 4 categories × 16 panels.

Category Structure

Each panel displays as a card grid, clicking navigates to the detail view. Follows System Manager's card-based navigation.

New Panel Highlights

Vscan — "Zero to Configured" Setup Guidance

Vscan (antivirus scanning) has the highest setup barrier of any ONTAP feature — it requires external Windows/Linux servers and antivirus vendor licenses. When unconfigured, the Vscan panel displays a 5-step guided wizard:

1. Vendor selection (6-vendor comparison table with license page links)
2. NetApp Antivirus Connector download
3. EC2 deployment (architecture diagram + AWS Blog/GitHub samples)
4. ONTAP CLI commands (scanner-pool / policy / enable)
5. Verification in this panel

Even someone starting from "what is Vscan?" can follow the setup path directly from the portal.

FlexClone — Instant Zero-Copy Clones

Create and split volume clones from the UI for ransomware recovery, forensics, or dev/test. Metadata-only copy completes in seconds with near-zero additional capacity.

SnapMirror — Replication Lifecycle Management

Monitor DR and cross-region replication relationships in the browser and execute actions (sync, break, resync, quiesce, resume, delete). Click a relationship to expand the last 10 transfer records (size, duration, success/failure). Lag times exceeding your RPO target display in red so they are noticed immediately.

DR planning note: SnapMirror Break/Resync operations are executable from the browser, but understand the RPO impact before clicking Break. After a break, the replication relationship is severed and resync requires delta transfer. For production environments, pair the confirmation dialog (implemented) with your team's DR runbook procedures.

FlexCache — Remote Read Cache CRUD

Create FlexCache volumes (async, with prepopulate path support), view the list (origin→cache arrow display), and delete (automated 3-step: unmount→offline→delete). When unconfigured, guidance is displayed with a datalist for selecting origin volumes.

Async polling note: FlexCache creation uses async polling to detect completion. If the user closes the browser during creation, the ONTAP-side operation continues. The created volume appears on the next list refresh — no data loss or inconsistent state results.

Security Model

Only users in the storage-admin group can execute admin operations (volume creation, SnapLock configuration, ARP containment, etc.). Regular users are limited to file browsing and AI processing.

Enterprise SSO note: Cognito User Pool supports SAML 2.0 and OIDC federation. To integrate with an existing IdP such as Okta, Azure AD, or Google Workspace, see Cognito's Adding SAML identity providers. Group mapping lets you map IdP groups to the Cognito storage-admin group.

Infrastructure protection note: Amplify Hosting is served via Amazon CloudFront, so AWS Shield Standard (DDoS protection) is automatically applied. If additional WAF rules are needed, attach AWS WAF to the CloudFront distribution.

Usage Scenarios

Scenario 1: Ransomware Response

1. Storage Dashboard shows 🚨 ARP Threats: 1
2. Navigate to ARP/AI panel → view threat details
3. Click [Contain] → SMB user blocked + snapshot taken
4. State transitions to 🟠 Contained
5. After forensic analysis, [Investigation Complete] → [Resolve]
6. Unblock to resume normal operations

Scenario 2: Compliance Audit

1. Lock panel → SnapLock tab to review Compliance volume list
2. Tamperproof tab to apply FISC 7-year lock to snapshots
3. S3 Object Lock tab to verify output bucket retention settings
4. Audit Trail to review operation history

Scenario 3: Daily Monitoring

1. Storage Dashboard — glance at 4 cards (30 seconds)
2. If any volume exceeds 85% capacity, drill into Volume Manager
3. Check EMS Events for recent alerts
4. No issues → done

Design Trade-offs

Rollback Procedure

Recovery paths if a portal update causes problems:

Because frontend and backend are both under Git management, git revert + git push rolls back immediately. Some ONTAP-side changes (such as enabling SnapLock) are irreversible, so verification before execution matters.

8-Language Support (i18n)

All admin features included, the entire portal supports 8 languages:

Technical terms (ONTAP, SnapLock, FlexClone, S3 AP, ARP/AI, WORM, FISC, SOX, HIPAA) are not translated. Browser navigator.language auto-detection with instant switching via the header language picker.

Audit Log — Checking "Who Accessed What and When" in the UI

The most frequent request from compliance officers was "I want to check the file access trail myself." Grepping CloudTrail logs from the CLI is not realistic for anyone outside the security team.

The portal's Audit tab runs filtered queries:

Architecture

AppSync Query → Lambda → Athena SQL → CloudTrail S3 Data Event logs

Light theme shown. A dark theme version is available.

CloudTrail S3 data events are registered as a Glue table and queried with Athena. Results display in table form, and access denials (AccessDenied) are highlighted in red.

Prerequisites

• Enable data events for the S3 AP ARN on a CloudTrail Trail
• Create the Athena table via Glue Crawler or a manual CREATE TABLE
• Set ATHENA_AUDIT_DATABASE, ATHENA_AUDIT_TABLE, and ATHENA_AUDIT_OUTPUT as Lambda environment variables

If these are unconfigured, the UI displays "configuration required" guidance with the setup steps. The design treats this as onboarding rather than an error.

Data Retention

Query results are stored in the Athena workgroup output location (S3). Retention of the original CloudTrail logs is controlled by the S3 bucket lifecycle policy on the Trail's bucket. Set retention periods such as FISC 7 years or HIPAA 6 years according to your audit requirements.

Cost note: If you store audit trails in DynamoDB, storage costs grow in large environments. Set a retention policy (TTL) and archive old records to S3 Glacier. CloudTrail log retention is controlled separately via the Trail's lifecycle policy.

FlexClone Restore — Instant Recovery from Snapshots

When recovering from ransomware damage or accidental deletion, the requirement is "I want to go back to the snapshot from before the infection." Previously this meant creating a FlexClone from the CLI and attaching an S3 AP as a sequence of manual operations.

In the portal, from the 📸 button on the Files tab:

1. Enter the snapshot name (e.g., daily.2026-07-18_0010)
2. Click [Clone & Attach]
3. Step Functions automatically runs FlexClone creation → S3 AP attach
4. FlexClone information appears on the Results tab

FlexClone Status Display

🔄 FlexClone Volume
  Volume:  clone-uc6-20260718-abc123
  Parent:  vol_data
  Status:  🟢 online
  Created: 2026-07-18 15:00:00
  Size:    128 MB
  S3 AP:   clone-uc6-abc123-s3alias

Use Cases

FlexClone is a metadata-only copy, so it completes in seconds with near-zero additional capacity. Differential capacity is consumed only as writes occur.

Accessibility note: Confirmation dialogs for FlexCache deletion and volume deletion are displayed inline. For screen reader users, confirmation messages are announced via role="alertdialog" and aria-describedby. Keyboard navigation (Tab/Enter/Escape) is fully supported.

Throughput note: A FlexClone volume shares the throughput budget with its parent volume. If clones are used actively in parallel in production, account for the performance impact on the parent volume. For read-oriented uses such as forensics this is typically not a concern.

Athena Query — SQL Analytics on NAS Data

When files on FSx for ONTAP are cataloged via Glue Crawler, you can run SQL queries using Athena. The portal's "Analytics" tab lets you enter a database name and SQL, and execute directly.

There is no need to open the AWS Athena console separately — everything completes inside the portal.

UI Layout

┌──────────────────────────────────────────────────┐
│ SQL Query (Athena)      [default        ]        │
├──────────────────────────────────────────────────┤
│ 💡 How to use: catalog files on FSx for ONTAP    │
│ with Glue Crawler, then analyze them here with   │
│ SQL.                                             │
│ ▸ 📝 View query examples (collapsible)           │
├──────────────────────────────────────────────────┤
│ SHOW TABLES IN default                           │
│                                                  │
│ [Run query]                                      │
└──────────────────────────────────────────────────┘

Usage Flow

1. First time: run SHOW TABLES IN default to discover available tables
2. Once you know table names: execute specific SELECT queries
3. Results: displayed in table form

Practical Query Examples

-- Find large files (capacity planning)
SELECT key, size FROM default.s3_objects
WHERE size > 1000000000
ORDER BY size DESC LIMIT 20

-- Total size of a specific folder (project sizing)
SELECT SUM(size) as total_bytes
FROM default.s3_objects
WHERE key LIKE 'engineering/%'

-- Files modified in last 7 days (change tracking)
SELECT key, last_modified
FROM default.s3_objects
WHERE last_modified > current_date - interval '7' day

The portal UI includes an expandable "View query examples" section, so even users unfamiliar with SQL can get started by copy-pasting.

Not just "browse the files" but "ask questions of the data" — directly from the portal.

File Formats Glue Crawler Recognizes

CAD/EDA binary files cannot be cataloged by Glue Crawler, but file metadata (size, last modified, path) is still retrievable.

Athena Cost Optimization Tips

Athena bills on the volume of data scanned ($5/TB). Ways to keep costs down:

• Date partitions (year=/month=/day=) reduce scan volume when a WHERE clause narrows the time range
• With columnar formats such as Parquet/ORC, specifying only the columns you need instead of SELECT * reduces cost
• Make it a habit to always add a LIMIT clause to exploratory queries
• Setting a query limit on the Athena workgroup (for example 10 GB/day) caps unexpected scan volume

Cost Awareness

Rough additional cost if every feature in this article is enabled:

The cost of FSx for ONTAP itself (~$194/month at 128 MBps) was covered in Part 1. The portal's incremental cost depends on usage frequency, but evaluating in DemoMode adds nothing.

Deployment Time Estimates

What to Expect After Deployment

• Once the DemoMode deploy completes, the portal is reachable at https://<branch>.amplifyapp.com. Cognito sign-up → log in → the file list shows test data from the S3 bucket
• Once VPC connectivity is added, the Storage Dashboard shows actual volume counts and utilization, and protected volumes appear in the ARP panel
• Once all features are deployed, the Audit Log tab can run CloudTrail queries and the Lock panel shows SnapLock/Object Lock settings

Environment Variables and Configuration Parameters

PoC → Production Checklist

After evaluating in DemoMode, use this checklist when moving to production connectivity:

Role-Based Documentation (8 Languages × 3 Guides)

Alongside the feature additions, role-specific documentation was built. Based on usability principles (visibility of system status, task-oriented structure, ease of error recovery), 3 guides are provided in 8 languages:

Supported languages: 日本語, English, 한국어, 简体中文, 繁體中文, Français, Deutsch, Español

Design choices for the compliance officer guide:

• All tasks executable without storage-admin privileges (read-only access is sufficient)
• Each task includes "Evidence for auditors" instructions
• Explicit "What you cannot do" escalation table showing who to contact

FlexCache / SnapMirror Management

Direct ONTAP REST API Operations from the Browser

FlexCache and SnapMirror CRUD management is now available through the browser UI. A VPC-deployed Lambda connects to the FSx for ONTAP management endpoint via HTTPS, calling ONTAP REST API with credentials from Secrets Manager.

Browser → AppSync (Cognito auth) → Lambda (in VPC) → ONTAP REST API
                                                       ↓
                                                Secrets Manager
                                                (fsxadmin credentials)

Light theme shown. A dark theme version is available.

FlexCache Create UI

Select the origin volume from a dropdown (datalist), specify cache name, size, and prepopulate paths, then create. The experience mirrors ONTAP System Manager — accessible from any browser with Cognito authentication.

SnapMirror Lifecycle Management

The replication relationship list shows state badges (✅ Snapmirrored / 🔴 Broken-off / 🔄 Transferring / ⏸️ Paused) with context-sensitive action buttons. DR failover (Break → Resync) is fully accessible from the browser. Lag times exceeding your RPO target display in red with a ⚠️ RPO warning.

Lessons Learned

Async Operations with return_timeout=0

FlexCache creation is an asynchronous ONTAP job taking 30-120 seconds. By specifying return_timeout=0, ONTAP returns immediately with 202 Accepted + job UUID, preventing Lambda timeout. The UI auto-refreshes the list at 10s/30s/60s intervals.

Automated 3-Step FlexCache Deletion

Mounted FlexCache volumes cannot be deleted directly. The portal automates:

1. Remove junction path (unmount)
2. Set volume offline
3. Delete FlexCache (async)

Credential Synchronization

When changing the fsxadmin password, update both the FSx for ONTAP API and Secrets Manager simultaneously. Updating only one side causes authentication failures that can trigger ONTAP's account lockout mechanism. Recovery: aws fsx update-file-system password reset → Secrets Manager sync.

FSx for ONTAP Specifics

Coexistence with Existing Tools

This portal is not a replacement for ONTAP System Manager, ONTAP CLI, or REST API. It makes a subset of those operations accessible from a browser UI with Cognito authentication — an additional management layer, not a substitute.

The portal provides a management layer for NAS-specific capabilities (Snapshot, FlexClone, FlexCache, SnapMirror, ARP/AI) accessible from the browser. Adoption can be incremental — management operations only, AI processing only, or the full suite — depending on existing workflows.

PoC → Production Migration Flow

After evaluating in DemoMode (no FSx for ONTAP required), migrate to production connectivity in three phases:

┌────────────────┐     ┌────────────────┐     ┌────────────────┐
│ Phase 1: PoC   │     │ Phase 2: VPC   │     │ Phase 3: Prod  │
│ (~15 min)      │     │   Connectivity │     │   Hardening    │
│                │     │ (~30 min)      │     │ (~60 min)      │
│ DemoMode=true  │ ──→ │ ONTAP mgmt LIF │ ──→ │ Least-privilege│
│ S3 bucket      │     │ Secrets Mgr    │     │ MFA required   │
│ Auth: Cognito  │     │ VPC Endpoint   │     │ WAF added      │
│                │     │                │     │ Audit enabled  │
└────────────────┘     └────────────────┘     └────────────────┘

Light theme shown. A dark theme version is available.

Post-Deployment Verification

Expected state after each phase completes:

• After Phase 1: you can log in to the portal, and DemoMode file listing and AI processing tests work. The Storage Dashboard still shows "not connected"
• After Phase 2: the Storage Dashboard shows actual volume information, and ONTAP data appears in the ARP panel and EMS Events
• After Phase 3: login is impossible without MFA, CloudTrail records all operations, and WAF applies rate limiting

Irreversible operations warning: The following operations cannot be undone once executed. Verify your organization's policies before enabling them in Phase 2+:

• SnapLock Compliance enablement: Volume SnapLock type cannot be changed after creation
• Tamperproof Snapshot retention period: Once set, the period cannot be shortened (only extended)
• S3 Object Lock Compliance mode: No one, including root, can delete objects until retention expires

For detailed migration steps, see the PoC → Production Guide.

Authorization Model (PoC → Production)

In Amplify Gen2 with multiple auth providers, generateClient() must explicitly specify authMode: "userPool" to ensure the Cognito token is sent to AppSync. This is a recommended pattern per official documentation.

Resources

• GitHub: solutions/amplify-portal/
• User Guide (8 languages)
• Compliance Guide (8 languages)
• Quick Reference (8 languages)
• Implementation Guide
• Getting Started Guide
• Admin Demo Guide
• AI Agent Demo Guide
• Security Review
• PoC → Production Guide
• Scaling Guide
• Accessibility Statement
• AWS: ONTAP ARP/AI
• AWS: S3 Object Lock
• Part 1: Adding a File Portal to FSx for ONTAP S3 AP
• Part 3: Embedding AI Agents into a File Portal

Summary and Next Steps

Building on the file portal from Part 1, ONTAP management operations and data protection features were embedded:

From a portal that "just browses files" to one that "completes storage operations from the web." Daily monitoring and incident first response now finish in the browser without accessing ONTAP System Manager or CLI.

All code is available in the GitHub repository.

As a next step, after running DemoMode using the instructions in Part 1, try adding the VPC configuration to enable ONTAP connectivity. That gets you to a state where every feature in this article is usable. Migration details are collected in the PoC → Production Guide.

In Part 3, I'll write about embedding AI agents into this portal — completing file operations, analysis, and admin operations in natural language.

I hope this post helps someone out there.

See you next time.