Back to Checks
aws

AWS Storage Gateway gateway is not hosted on EC2

storagegateway_gateway_fault_tolerant
Service: storagegatewaySeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

AWS Storage Gateway hosted on an EC2 instance is flagged by assessing each gateway's hosting environment, distinguishing single-instance EC2 deployments from non-EC2 platforms that can leverage platform-level high availability.

Prowler logoProwlerprowler-provider-aws

Risk

A single EC2-hosted gateway concentrates failure risk. Instance or AZ disruption, reboots, or network faults can halt file access, causing downtime and stalled writes. This degrades availability and can affect integrity via partial operations or cache desynchronization.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks storagegateway_gateway_fault_tolerant

Recommendation

Design for high availability: avoid single-instance gateways for critical workloads. Prefer managed multi-AZ services like EFS or FSx, or use multiple gateways with client failover and resilient naming. Apply defense in depth, validate failover regularly, and monitor health to prevent outages.

Remediation

Other

1In the AWS Console, go to Storage Gateway and click Create gateway
2Choose your gateway type, then under Host platform select VMware ESXi, Microsoft Hyper-V, Linux KVM, or Hardware Appliance (do not select Amazon EC2)
3Download and deploy the VM on your host, power it on, and note its IP
4In the console, connect to and Activate the new gateway
5Recreate equivalent resources (shares/volumes/tapes) on the new gateway and update clients to use the new gateway IP/DNS
6In Storage Gateway > Gateways, delete the old EC2-hosted gateway
7Verify the new gateway's details show Host platform not equal to Amazon EC2

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.storagegateway.storagegateway_client import (
    storagegateway_client,
)


class storagegateway_gateway_fault_tolerant(Check):
    def execute(self):
        findings = []
        for gateway in storagegateway_client.gateways:
            report = Check_Report_AWS(metadata=self.metadata(), resource=gateway)
            report.status = "FAIL"
            report.status_extended = f"StorageGateway Gateway {gateway.name} may not be fault tolerant as it is hosted on {gateway.environment}."
            if gateway.environment != "EC2":
                report.status = "PASS"
                report.status_extended = f"StorageGateway Gateway {gateway.name} may be fault tolerant as it is hosted on {gateway.environment}."

            findings.append(report)

        return findings

References