You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Configure object REST API in Azure NetApp Files (preview)
12
+
# Configure object REST API for Azure NetApp Files (preview)
13
13
14
-
Azure NetApp Files supports access to S3 objects with the [object REST API](object-rest-api-introduction.md) feature. With the object REST API feature, you can connect to services including Azure AI Search, Microsoft Foundry, Azure Databricks, OneLake, and others.
14
+
Azure NetApp Files supports access to S3 objects with the [object REST API](object-rest-api-introduction.md) feature. With the object REST API, you can connect to services such as Azure AI Search, Microsoft Fabric, Microsoft Foundry, Azure Databricks, OneLake, and other S3‑compatible clients.
15
+
16
+
This article describes how to configure object REST API access and walks you through the two supported certificate workflows. Choose the workflow that best matches your security and operational requirements.
15
17
16
18
## Register the feature
17
19
18
-
The object REST API feature in Azure NetApp Files is currently in preview. You must submit a [waitlist request](https://aka.ms/ANF-object-REST-API-signup) to use the object REST API feature. Activation takes approximately one week. An email notification is sent to confirm your enrollment in the preview.
20
+
The object REST API feature in Azure NetApp Files is currently in preview. You must submit a [waitlist request](https://aka.ms/ANF-object-REST-API-signup) to use this feature. Activation takes approximately one week, and you receive an email notification once the enrollment is complete.
19
21
20
22
## Create the self-signed certificate
21
23
22
-
You must generate a PEM-formatted SSL certificate. You can create the SSL certificate in the Azure portal or with a script.
24
+
Azure NetApp Files supports two certificate options for object REST API access:
23
25
24
-
<!-- DNS? -->
26
+
1.**Azure Key Vault–based certificates (recommended)**: Certificates are created and stored in Azure Key Vault and the certificate is retrieved directly from Azure Key Vault during bucket creation.
25
27
26
-
### [Portal](#tab/portal)
28
+
1.**Direct certificate upload**: PEM certificates are generated and uploaded manually during bucket creation.
27
29
28
-
See the [Azure Key Vault documentation for adding a certificate to Key Vault](/azure//key-vault/certificates/quick-create-portal#add-a-certificate-to-key-vault).
30
+
> [!IMPORTANT]
31
+
> The options you select determines the certificate format you must generate (PKCS#12 vs PEM), and how the certificate is supplied during bucket creation.
Use this option if you want Azure NetApp Files to read the certificate directly from Azure Key Vault during bucket creation.
31
38
32
-
* the **Content Type** is set to PEM
33
-
* the **Subject** field is set to the IP address or fully qualified domain name (FQDN) of your Azure NetApp Files endpoint using the format `"CN=<IP or FQDN>"`
34
-
* the **DNS Names** entry specifies the IP address or FQDN
39
+
See the [Azure Key Vault documentation for adding a certificate to Key Vault](/azure//key-vault/certificates/quick-create-portal#add-a-certificate-to-key-vault).
40
+
41
+
When creating the certificate in Azure Key Vault, ensure:
42
+
43
+
***Content Type**: PKCS#12
44
+
***Subject**: IP address or fully qualified domain name (FQDN) of your Azure NetApp Files endpoint using the format `"CN=<IP or FQDN>"`
45
+
***DNS Names**: IP address or FQDN
35
46
36
47
:::image type="content" source="./media/object-rest-api-access-configure/create-certificate.png" alt-text="Screenshot of create certificate options." lightbox="./media/object-rest-api-access-configure/create-certificate.png":::
37
48
38
-
### [Script](#tab/script)
49
+
Once the certificate is successfully created, click on the certificate from the list and review the properties.
50
+
51
+
* In the Certificate identifier field, note the URI of the vault “https://<vault_name>.azure.net”
52
+
* Note the name of the certificate
53
+
54
+
### Required Azure Key Vault permissions
39
55
40
-
This script creates a certificate locally. Set the computer name `CN=` to the IP address or fully qualified domain name (FQDN) of your object REST API-enabled endpoint. This script creates a folder that includes the necessary PEM file and private keys.
56
+
To avoid bucket creation failures, ensure that the Azure NetApp Files service has permission to read the certificate from Azure Key Vault.
57
+
58
+
At a minimum, the following permissions must be granted:
59
+
60
+
* Certificates: Get, List, Update, Create, Import, Manage Certificate Authorities, Get Certificate Authorities, List Certificate Authorities, Set Certificate Authorities, Delete Certificate Authorities
61
+
* Secrets: Get, List, Set, Delete
62
+
63
+
> [!NOTE]
64
+
> If these permissions are missing, bucket creation fails when Azure NetApp Files attempts to retrieve the certificate.
65
+
66
+
67
+
### Option 2: Direct certificate upload
68
+
69
+
Use this option if you plan to generate the certificate and upload it manually during bucket creation.
70
+
71
+
When creating the certificate, ensure:
72
+
73
+
***Content Type**: PEM
74
+
***Subject**: IP address or fully qualified domain name (FQDN) of your Azure NetApp Files endpoint using the format `"CN=<IP or FQDN>"`
75
+
***DNS Names**: IP address or FQDN
76
+
77
+
## Generate the certificate
78
+
79
+
Use the provided script to generate a self‑signed PEM certificate. The script creates both the certificate and private key files required for upload. Set the computer name `CN=` to the IP address or fully qualified domain name (FQDN) of your object REST API-enabled endpoint. This script creates a folder that includes the necessary PEM file and private keys.
echo"Self-signed certificate created at $CERT_DIR/server-cert.pem"
67
106
```
68
-
---
107
+
After the certificate is created, you will need to create a bucket.
69
108
70
109
## Create a bucket
71
110
72
-
To enable object REST API, you must create a bucket.
111
+
To enable object REST API, you must create a bucket on an Azure NetApp Files volume.
73
112
74
113
1. From your NetApp volume, select **Buckets**.
75
-
1. To create a bucket, select **+Create**.
76
-
1. Provide the following information for the bucket:
114
+
1. Select **+Create or update bucket**.
115
+
1. In Create or update bucket, provide the following information for the bucket:
116
+
117
+
**Bucket configuration**
118
+
77
119
***Name**
78
120
79
121
Specify the name for your bucket. Refer to [Naming rules and restrictions for Azure resources](../azure-resource-manager/management/resource-name-rules.md#microsoftnetapp) for naming conventions.
80
122
***Path**
81
123
82
124
The subdirectory path for object REST API. For full volume access, leave this field blank or use `/` for the root directory.
83
125
84
-
***User ID (UID)**
126
+
**Protocol access**
127
+
128
+
***NFS volume**
129
+
130
+
***User ID (UID)**
85
131
86
-
The UID used to read the bucket.
132
+
The UID used to access the bucket.
87
133
88
-
***Group ID (GID)**
134
+
***Group ID (GID)**
89
135
90
-
The GID used to read the bucket.
136
+
The GID used to access the bucket.
91
137
92
-
***Permissions**
138
+
***SMB volume**
93
139
94
-
Select Read or Read-Write.
140
+
***Username**
141
+
142
+
The ID used to read the bucket.
143
+
144
+
***Permissions**
145
+
146
+
Select Read-only or Read and write.
95
147
96
148
:::image type="content" source="./media/object-rest-api-access-configure/create-bucket.png" alt-text="Screenshot of create a bucket menu." lightbox="./media/object-rest-api-access-configure/create-bucket.png":::
97
149
98
-
1.If you haven't provided a certificate, upload your PEM file.
150
+
1.Select **Save**.
99
151
100
-
To upload a certificate, provide the following information:
152
+
Additional details are needed to create the first bucket on a set of volumes sharing the same IP address.
153
+
154
+
**Certificate management**
101
155
102
156
***Fully qualified domain name**
103
157
104
-
Enter the fully qualified domain name.
158
+
Enter the endpoint FQDN used by clients to access the buckets.
159
+
160
+
**Certificate source**
161
+
162
+
***Azure Key Vault**
163
+
164
+
***Vault URI**
165
+
166
+
Select the name from the drop-down list.
105
167
106
-
***Certificate source**
168
+
***Secret name**
107
169
108
-
Upload the appropriate certificate. Only PEM files are supported.
170
+
Enter the name of the certificate.
171
+
172
+
***Upload certificate**
109
173
110
-
Select **Save**.
174
+
Select the **certificate** option to upload a certificate file directly.
111
175
112
-
1. Select **Create**.
176
+
If you haven't provided a certificate, upload the PEM file.
177
+
178
+
***Certificate source**.
179
+
180
+
Upload the appropriate certificate. Only PEM files are supported.
181
+
182
+
**Credentials storage**
183
+
184
+
***Azure Key Vault**
185
+
186
+
***Vault URI**
187
+
188
+
Select the name from the drop-down list.
189
+
190
+
***Secret name**
191
+
192
+
Enter the name of the secret. The secret name is user-defined and can be any value, that meets the naming guidelines.
193
+
194
+
***Access key**
195
+
196
+
When selecting this option, access keys are generated after the bucket is created and are displayed once in the Azure portal. You must manually copy both these values and store them securely.
197
+
198
+
1. Select **Save** to validate the configuration.
199
+
200
+
1. Select **Create** to provision the bucket.
113
201
114
202
After you create a bucket, you need to generate credentials to access the bucket.
115
203
204
+
## Generate credentials
205
+
206
+
The credential generation behavior depends on the credential storage option you selected.
207
+
208
+
1. Navigate to the newly created bucket.
209
+
210
+
1. Select **Generate credentials**.
211
+
212
+
1. Enter the desired access key lifespan in days and then select **Generate credentials**.
213
+
214
+
**Azure Key Vault–based credentials**
215
+
216
+
* The credentials are generated and stored securely in Azure Key Vault.
217
+
* The credentials and are not displayed in the Azure portal.
218
+
* You should retrieve the credentials directly from the configured Key Vault.
219
+
220
+
After the credentials are generated, perform the following:
221
+
222
+
1. Ensure that the secret is created in the specified Key Vault.
223
+
1. Verify the secret:
224
+
225
+
1. Navigate to your key vault in the Azure portal.
226
+
1. Select **Objects** then select **Secrets**.
227
+
1. Confirm that <secret_name> has been created.
228
+
229
+
**Access key-based credentials**
230
+
231
+
When using direct certificate upload:
232
+
233
+
* The access key and secret access key are displayed once in the Azure portal.
234
+
* You should copy and store both the values securely.
235
+
* The credentials cannot be retrieved again after the initial display.
236
+
237
+
> [!IMPORTANT]
238
+
> The access key and secret access key are only displayed once. You should copy and store the keys securely. If they are lost, you must generate new credentials.
239
+
240
+
**Regenerating credentials**
241
+
242
+
After the credentials are set, you can generate new credentials by selecting the three dots (`…`) on the bucket and selecting **Generate credentials**.
243
+
244
+
> [!IMPORTANT]
245
+
> Generating new credentials immediately invalidates existing credentials.
246
+
116
247
## Update bucket access
117
248
118
249
You can modify a bucket's access management settings.
119
250
251
+
* User ID / Username
252
+
* Group ID
253
+
* Permissions
254
+
120
255
1. From your NetApp volume, select **Buckets**.
121
-
1. Select **+Create**.
256
+
1. Select **+Create or update bucket**.
122
257
1. Enter the name of the bucket you want to modify.
123
258
1. Change the access management settings as required.
124
-
1. You can modify the User ID, Group ID, Username (for SMB or dual-protocol volumes), and Permissions.
125
259
1. Click **Save** to modify the existing bucket.
126
260
127
261
> [!NOTE]
128
262
> You cannot modify a bucket’s path. To update a bucket’s path, delete and re-create the bucket with the new path.
129
263
130
-
## Generate credentials
131
-
132
-
1. Navigate to your newly created bucket. Select **Generate keys**.
133
-
1. Enter the desired Access key lifespan in days then select **Generate keys**. After you select **Generate keys**, the portal displays the access key and secret access key.
134
-
>[!IMPORTANT]
135
-
>The access key and secret access key are only displayed once. Store the keys securely. Do not share the keys.
136
-
1. After you set the credentials, you can generate a new access key and secret access key by selecting the `...` menu then selecting **Generate access keys**. Generating new keys immediately invalidates the existing keys.
137
264
138
265
## Delete a bucket
139
266
140
-
Deleting a bucket is a permanent operation. You can't recover the bucket after deleting it.
267
+
Deleting a bucket permanently removes it and all associated configurations. You can't recover the bucket after deleting it.
141
268
142
269
1. In your NetApp account, navigate to **Buckets**.
143
-
1. Select the checkbox next to the bucket you want to delete.
270
+
1. Select the three dots (`…`) next to the bucket you want to delete.
144
271
1. Select **Delete**.
145
-
1. In the modal, select **Delete** to confirm you want to delete the bucket.
272
+
1. In the Delete bucket window, select **Delete** to confirm you want to delete the bucket.
Copy file name to clipboardExpand all lines: articles/azure-netapp-files/whats-new.md
+7-1Lines changed: 7 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,6 +19,12 @@ Azure NetApp Files is updated regularly. This article provides a summary about t
19
19
20
20
## April 2026
21
21
22
+
*[Secure object REST API access using Azure Key Vault certificates and credentials](object-rest-api-access-configure.md) (preview)
23
+
24
+
Azure NetApp Files now supports Azure Key Vault–based certificates and credentials for the object REST API, enabling secure, S3‑compatible access to volumes. Certificates can be generated and stored directly in Azure Key Vault and automatically retrieved during bucket creation, while S3 access credentials are securely managed in Key Vault, eliminating the need to manually upload or store sensitive information.
25
+
26
+
This native integration with Azure Key Vault simplifies certificate lifecycle management, centralizes certificate and credential storage, strengthens security, and aligns Object REST API access with enterprise key and credential management best practices.
27
+
22
28
*[Storage with cool access enhancement](cool-access-introduction.md#throughput-for-premium-and-ultra-service-levels) for Premium and Ultra service levels (preview)
23
29
24
30
Azure NetApp Files introduces an enhancement to storage with cool access for Premium and Ultra service levels that more precisely aligns throughput with data tiering. When cool access is enabled, maximum throughput is dynamically calculated based on the amount of data tiered to cool access storage, rather than applying a fixed reduction. Hot data retains its configured performance, and throughput is adjusted only when data is tiered to the cool tier. This enhancement delivers more predictable QoS behavior while optimizing performance and cost as data access patterns evolve, without requiring manual tuning or reconfiguration.
@@ -29,7 +35,7 @@ Azure NetApp Files is updated regularly. This article provides a summary about t
29
35
30
36
Large volumes operational improvement no longer requires a support ticket to increase a large volume past the 30% imposed limit. This allows customer to automate their large volume size increases without waiting for approval and human intervention.
31
37
32
-
## January 2026
38
+
## January 2026
33
39
34
40
*[Elastic zone-redundant storage service level](elastic-zone-redundant-concept.md) (preview)
Copy file name to clipboardExpand all lines: articles/iot-operations/deploy-iot-ops/concept-production-guidelines.md
+8-11Lines changed: 8 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,15 +18,15 @@ Decide whether you're deploying Azure IoT Operations to a single-node or multi-n
18
18
19
19
## Platform
20
20
21
-
Currently, K3s on Ubuntu 24.04 is the only generally available platform for deploying Azure IoT Operations in production.
21
+
Use a [supported environment](../overview-support.md#supported-environments) for deploying Azure IoT Operations in production.
22
22
23
23
## Cluster setup
24
24
25
25
Ensure that your hardware setup is sufficient for your scenario and that you begin with a secure environment.
26
26
27
27
### System configuration
28
28
29
-
Create an Arc-enabled K3s cluster that meets the system requirements.
29
+
Create an Arc-enabled cluster that meets the system requirements.
30
30
31
31
* Use a [supported environment for Azure IoT Operations](../overview-support.md#supported-environments).
32
32
*[Configure the cluster](./howto-prepare-cluster.md) according to documentation.
@@ -88,15 +88,12 @@ In the Azure portal deployment wizard, the schema registry and its required stor
88
88
89
89
* The storage account must have hierarchical namespace enabled.
90
90
* The schema registry's managed identity must have contributor permissions for the storage account.
91
-
* The storage account is only supported with public network access enabled.
92
-
93
-
For production deployments, scope the storage account's public network access to allow traffic only from trusted Azure services. For example:
94
-
95
-
1. In the [Azure portal](https://portal.azure.com), navigate to the storage account that your schema registry uses.
96
-
1. Select **Security + networking > Networking** from the navigation menu.
97
-
1. For the public network access setting, select **Enabled from selected virtual networks and IP addresses**.
98
-
1. In the **Exceptions** section of the networking page, ensure that the **Allow trusted Microsoft services to access this resource** option is selected.
99
-
1. Select **Save** to apply the changes.
91
+
* For production deployments, scope the storage account's public network access to allow traffic only from trusted Azure services. For example:
92
+
1. In the [Azure portal](https://portal.azure.com), navigate to the storage account that your schema registry uses.
93
+
1. Select **Security + networking > Networking** from the navigation menu.
94
+
1. For the public network access setting, select **Enabled from selected virtual networks and IP addresses**.
95
+
1. In the **Exceptions** section of the networking page, ensure that the **Allow trusted Microsoft services to access this resource** option is selected.
96
+
1. Select **Save** to apply the changes.
100
97
101
98
For more information, see [Configure Azure Storage firewalls and virtual networks > Grant access to trusted Azure services](../../storage/common/storage-network-security.md#grant-access-to-trusted-azure-services).
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments