FSxN S3 Access Points as an Amazon Bedrock Data Source

Introduction

In many enterprise environments, critical business documentation and tabular insights reside on traditional NetApp ONTAP - Storage. Historically, building generative AI solutions utilizing Retrieval-Augmented Generation (RAG) required migrating or duplicating this file-based data into native cloud object storage (Amazon S3) - creating complex ETL pipelines and data silos.

With the S3 Access Point feature for Amazon FSx for NetApp ONTAP (FSxN), you can expose data residing on your NetApp volumes - such as department shares or corporate repositories - directly via an S3-compliant interface. This allows AWS services to natively consume NAS data without moving a single byte.

This guide provides a step-by-step walkthrough on how to create an FSxN S3 Access Point, secure it using advanced IAM policy scoping, and attach it to an Amazon Bedrock Knowledge Base to execute semantic queries against tabular CSV datasets using the Amazon Nova Pro model.

---

1. Prerequisites

Before proceeding, ensure the following foundational infrastructure is in place:

• A configured VPC (Virtual Private Cloud) inside the N. Virginia (us-east-1) region.
• An active Amazon FSx for NetApp ONTAP (Gen2) file system deployed within this VPC, including an initialized Storage Virtual Machine (SVM) with S3 configuration enabled.
• An existing Volume on this FSxN filer, accessible via NFS or SMB, populated with sample data. (This guide uses standard AWS Business Intelligence sample CSVs, such as b2b-sales.csv and sales-pipeline.csv) The source data is obtained from AWS Sample Data).
• An existing user (e.g., ec2-user) must be configured as a local user in the ONTAP SVM (FSxN SVM).

• Ensure your FSxN network configurations (Route Tables and Security Groups) allow:
• Inbound HTTPS (Port 443) traffic from your VPC/Bedrock endpoints to your FSxN interfaces.
• Outbound access to AWS S3 endpoints (as AWS internally routes the S3 API calls) and to return the data.

For a detailed, step-by-step walkthrough on configuring this exact FSxN setup, refer to my other article FSx for NetApp ONTAP (FSxN): Multiprotocol access WITHOUT Active Directory integration. Although that post covers a different primary use case, the foundational FSxN setup steps are identical)

⚠️ Cost Considerations: ⚠️ While this architecture eliminates the storage costs of duplicating data into Amazon S3 and the compute overhead of maintaining complex ETL pipelines, standard Amazon Bedrock pricing still applies. When planning your deployment, factor in the following:

• Embedding Model Costs: Charges incurred based on the token count processed during the initial and all subsequent sync operations.
• Vector Database Costs: Ongoing compute and storage costs for the backend vector store (e.g., OpenSearch Serverless OCUs) hosting your index.
• API Requests: Minimal standard AWS S3 API charges (such as s3:GetObject and s3:ListBucket) generated by the Bedrock crawler reading the volume via the S3 Access Point.

---

2. Step-by-Step Configuration

Step 2a: Creating the S3 Access Point on the FSxN Volume

To expose your specific volume data via S3, you map an S3 access point endpoint directly onto your storage volume inside the FSx console.

1. Open the Amazon FSx Console and click on Volumes in the left-hand navigation pane.
2. Select your target volume (e.g., vol1).
3. In the volume details workspace, select the S3 - new tab.
4. Scroll down to the S3 access point attachments section and click Create S3 access point.
5. Provide an access point name (e.g., s3-ap-scope-internet) and explicitly link it to your target junction path containing your business data.

Note: During the creation of the S3 Access Point, you will be prompted to select the Network Origin. While the "VPC" option may initially appear to be the most secure choice, it leads to connectivity errors when integrating with Amazon Bedrock. Because Amazon Bedrock operates as a managed service outside of your own VPC, **policies that restrict access to a specific VPC will block requests originating from the Bedrock service. Therefore, it is necessary to configure the Access Point with "Internet" as the Network Origin.

Important: Since the access is technically established via an internet-facing endpoint interface, this is no longer considered purely private communication. Consequently, it is mandatory to harden the access strictly using the IAM policies described in the following step. This ensures that only your specific Bedrock service role ARN can interact with your data, even if the endpoint is theoretically reachable via the internet.

---

Step 2b: Hardening the Access Point & IAM Policies

Integrating an FSxN S3 Access Point with Amazon Bedrock requires a specific IAM workaround. While standard S3 bucket policies allow direct role assignments in the Principal block, FSxN S3 Access Points require using a wildcard principal (*) combined with a strict Condition that validates the Bedrock execution role ARN.

Important Note on Role Creation: The role AmazonBedrockExecutionRoleForKnowledgeBase is created (often followed by a random suffix) by the Bedrock Knowledge Base setup wizard. However, once the wizard completes, you must manually switch to the IAM console to grant this role access to your new FSxN Access Point.

- Apply the Access Point Policy: Select your S3 access point in the FSx console, click Edit policy, and apply the following configuration to allow the Bedrock role to interact with it (Note: Replace 123456789012 with your actual AWS Account ID and ensure you replace us-east-1 with your actual AWS Region if you are deploying outside of N. Virginia.):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowBedrockSync",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:us-east-1:123456789012:accesspoint/s3-ap-scope-internet",
                "arn:aws:s3:us-east-1:123456789012:accesspoint/s3-ap-scope-internet/object/*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:PrincipalArn": "arn:aws:iam::123456789012:role/AmazonBedrockExecutionRoleForKnowledgeBase"
                }
            }
        }
    ]
}

- Update the Bedrock Execution Role Trust Relationship: Navigate to the IAM Console, find your automatically generated Bedrock role, and edit the Trust relationships. To prevent 403 Forbidden errors during data syncs, ensure the role explicitly trusts the internal bedrock service to assume it for your specific Knowledge Base:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "bedrock.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:us-east-1:123456789012:knowledge-base/*"
        }
      }
    }
  ]
}

- Attach the Inline Permissions Policy to the Bedrock Role: Finally, while still in the IAM Console for your Bedrock role, add an Inline Policy to grant the actual read permissions.

Crucial troubleshooting tip: Do not forget to include s3:GetBucketLocation. Even though you are querying an Access Point, Bedrock occasionally calls this action for internal API validation. Without it, your sync might fail silently.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:us-east-1:123456789012:accesspoint/s3-ap-scope-internet",
                "arn:aws:s3:us-east-1:123456789012:accesspoint/s3-ap-scope-internet/object/*"
            ]
        }
    ]
}

---

Step 2c: Setting Up the Amazon Bedrock Knowledge Base

With permissions successfully configured, you can connect your file share directly to your vector index.

1. Open the Amazon Bedrock Console, expand the left navigation pane, and select Knowledge Bases -> Create knowledge base.
2. Name your knowledge base (e.g., ShowCaseFSxNS3AccessPoint). During the creation process, opt to create and use a new service role.
3. In the Data source setup workspace, select Amazon S3.

4. In the S3 URI field, do not enter a standard bucket path. Instead, input the S3 alias of your FSxN S3 Access Point in URI format (e.g., s3://s3-ap-scope-internet-123456789012-s3alias).

Important: Bedrock requires the full S3 Access Point Alias. If you only provide the name of the access point (e.g., s3-ap-scope-internet), the Bedrock validation will fail. You can find the full Access Point Alias in the Access points tab of your FSxN file system details.

5. Under Advanced settings - Parsing strategy, choose Bedrock model parsing.
6. Set the parsing model to Amazon Nova Pro. This ensures that tabular layouts and structural column relationships within your CSV data are interpreted with high accuracy during vector ingestion.

---

3. Syncing and Testing the RAG Pipeline

Step 3a: Executing the Data Sync

Once the Knowledge Base is deployed and the IAM policies are updated, navigate to your data source and click Sync.

The Bedrock crawler will assume your execution role, tap into the live filesystem using the S3 Access Point interface, and begin chunking your documents.

Real-World Note on Sync History: If your source directory contains compressed archives alongside raw data (e.g., sales-pipeline.csv and sales-pipeline.csv.zip), your sync history may show skipped or failed counts for the .zip files. This is normal behavior for standard text/model parsing strategies. The raw .csv targets will still index cleanly into your vector database.

⚠️ Architectural Note: ⚠️ It is important to understand that Amazon Bedrock does not query the FSxN volume ad-hoc during user inference. Instead, the S3 Access Point is utilized strictly during the Knowledge Base synchronization process. The Bedrock crawler reads the files, chunks the text, and processes it through an embedding model to populate a designated vector database (e.g., Amazon OpenSearch Serverless). All subsequent user prompts query this highly optimized vector database, not the live file system. To reflect any file modifications or additions on the FSxN volume, a new sync operation must be triggered.

---

Step 3b: Testing Grounded Responses

Open the Test Knowledge Base window on the right side of the Bedrock console. Click Select model, navigate to Amazon, choose Nova Pro, and apply changes.

Because your data pipeline maps directly onto your active, live FSxN storage volume, your LLM responses are fully grounded in your business metrics. You can now prompt the test environment directly:

• Source Data Reference: Below is a sample output showing the structure of the raw source files stored on the FSxN volume (e.g., via a tail or head command of b2b-sales.csv and sales-pipeline.csv):

• Structure Verification: "What are the column headers (metadata fields) of my CSV files 'b2b-sales.csv' and 'sales-pipeline.csv'?"

• *The model returns a clean 1-to-19 breakdown of your precise file headers, verified directly across your datasets.

• Targeted Value Extractions: "Summarize the sales data from 'sales-pipeline.csv'. What unique values can you identify in the 'Status' column?"

• and Detailed Record Retrieval: "Search for 'Jennifer Weidman' in b2b-sales.csv and list all associated details."

• *Nova Pro accurately reads through the column and parses the distinct values: 'Lead', 'Closed Lost', 'Prospect', 'Qualified', 'Contracting', and 'Closed Won'.
• *The pipeline successfully surfaces every granular transaction row bound to that specific client record.

---

Conclusion

By leveraging S3 Access Point attachments directly on Amazon FSx for NetApp ONTAP volumes, organizations can bypass the need for raw data migration and complex ETL pipelines. This architecture allows you to maintain your primary network file infrastructure as your single source of truth while instantly delivering secure, high-performance RAG pipelines inside Amazon Bedrock.

PS: For those looking for similar documentation and blogs:

• re:Post Article - Managing FSxN S3 Access Points in Centralized VPC Endpoint Architectures
• Create S3 access points for a volume in NetApp Workload Factory
• Amazon FSx for NetApp ONTAP now integrates with Amazon S3 for seamless data access