Amazon Snow Family

Key definitions for Amazon Snow Family:

• Simple management and monitoring

  AWS OpsHub is a free graphical user interface (GUI) designed to facilitate the setup and management of Snow devices

• NFS endpoint

  Applications can connect to Snow Family devices using an NFS mount point. With support for NFS v3 and v4.1, you can easily integrate Snow devices with your existing on-premises servers and file-based applications

• On-board computing

  Snow Family devices are equipped with computing resources for data collection and processing at the edge. They support Amazon EC2 instances, AWS IoT Greengrass functions, and Kubernetes deployments using Amazon EKS Anywhere

• Encryption

  All data transferred to AWS Snow Family devices is encrypted using 256-bit encryption keys managed by the AWS Key Management Service (KMS). The encryption keys are never stored on the device, ensuring your data remains secure during transit

• Anti-tamper & Tamper-evident

  AWS Snow devices include a Trusted Platform Module (TPM) that offers a hardware root of trust. Each device undergoes inspection after every use to verify its integrity and safeguard the confidentiality of data

• End-to-end tracking

  Each device is equipped with an E-Ink shipping label that simplifies tracking and automatically updates for return shipping via Amazon Simple Notification Service (SNS), text messages, and the AWS Console

• Secure erasure

  Upon completion and verification of the data migration job, AWS performs a software erasure of the device, adhering to the National Institute of Standards and Technology (NIST) guidelines for media sanitization

• Security best practices

  General Security

  • If you detect anything suspicious about the AWS Snowball Edge device, avoid connecting it to your internal network. Instead, contact AWS Support, and a replacement device will be shipped to you
  • We recommend not saving the unlock code in the same location on the workstation as the job manifest. Storing them separately helps prevent unauthorized access to the AWS Snowball Edge device. For instance, you can save the manifest on your local server and email the unlock code to the user who will unlock the device. This approach limits access to the device to individuals who have access to both the server files and the user's email
  • The credentials provided when you run the Snowball Edge client commands `list-access-keys` and `get-secret-access-key` are a set of access keys designated for your device. These keys are exclusively linked to the specific job and the local resources on the device. They are not connected to your AWS account or any other AWS account. If you attempt to use these keys to access AWS Cloud services and resources, they will not work, as they are only valid for the local resources related to your job
  • If you suspect that your credentials are lost or compromised, you should request a new manifest file and unlock code by following the steps to update the device's SSL certificate. Please refer to the instructions in the Updating the SSL Certificate section
  • For information on using AWS Identity and Access Management (IAM) policies to control access, see AWS-Managed (Predefined) Policies for AWS Snowball Edge.

  Network Security

  • We advise using only one method at a time for reading and writing data to a local bucket on an AWS Snowball Edge device. Concurrently using both the file interface and the Amazon S3 adapter on the same Amazon S3 bucket may result in read/write conflicts
  • To avoid data corruption, refrain from disconnecting the AWS Snowball Edge device or changing its network settings during data transfers. Ensure that files being written to the device are not altered, as modifications during this process can cause read/write conflicts
  • For more details on enhancing the performance of your AWS Snowball Edge device, refer to the Performance section

• Resource Management best practices

  Consider the following best practices for managing jobs and resources on your AWS Snowball Edge device:

  • The 10 free days for completing your on-premises data transfer start the day after the AWS Snowball Edge device arrives at your data center. This applies exclusively to Snowball Edge device types.
  • A job can only be canceled when it is in the "Job created" status. Once the job changes to a different status, cancellation is no longer possible. This applies to clusters.
  • For import jobs, do not delete your local copies of the transferred data until the import into Amazon S3 is confirmed successful. Ensure you verify the results of the data transfer as part of your process.

• Feature comparison matrix

  	AWS SNOWCONE	AWS SNOWBALL EDGE STORAGE OPTIMIZED 80 TB	AWS SNOWBALL EDGE STORAGE OPTIMIZED 210 TB	AWS SNOWBALL EDGE COMPUTE OPTIMIZED
  Usable HDD Storage	8 TB	80 TB HDD	N/A	N/A
  Usable SSD Storage	14 TB	1 TB	210 TB NVMe	28 TB
  Usable vCPUs	2 vCPUs	40 vCPUs	104 vCPUs	104 vCPUs
  Usable Memory	4 GB	80 GB	416 GB	416 GB
  Device Size	9in x 6in x 3in	548 mm x 320 mm x 501 mm	548 mm x 320 mm x 501 mm	227 mm x 148.6 mm x 82.65 mm
  	548 mm x 320 mm x 501 mm
  Device Weight	4.5 lbs. (2.1 kg)	49.7 lbs. (22.3 kg)	49.7 lbs. (22.3 kg)	49.7 lbs. (22.3 kg)
  Storage Clustering	No	No	No	Yes, 3-16 nodes
  256-bit Encryption	Yes	Yes	Yes	Yes
  HIPAA Compliant	No	Yes, eligible	Yes, eligible	Yes, eligible