Configure object REST API in Azure NetApp Files (preview)

Azure NetApp Files supports access to S3 objects with the object REST API feature. With the object REST API feature, you can connect to services including Azure AI Search, Azure AI Foundry, Azure Databricks, OneLake, and others.

Register the feature

The object REST API feature in Azure NetApp Files is currently in preview. You must submit a waitlist request to use the object REST API feature. Activation takes approximately one week. An email notification is sent to confirm your enrollment in the preview.

Create the self-signed certificate

You must generate a PEM-formatted SSL certificate. You can create the SSL certificate in the Azure portal or with a script.

#!/bin/sh
# Define certificate details 
CERT_DAYS=365 
RSA_STR_LEN=2048 
CERT_DIR="./certs" 
KEY_DIR="./certs/private" 
CN="mylocalsite.local" 

# Create directories if they don't exist 
mkdir -p $CERT_DIR 
mkdir -p $KEY_DIR 

# Generate private key 
openssl genrsa -out $KEY_DIR/server-key.pem $RSA_STR_LEN 

# Generate Certificate Signing Request (CSR) 
openssl req -new -key $KEY_DIR/server-key.pem -out $CERT_DIR/server-req.pem -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=$CN" 

# Generate self-signed certificate 
openssl x509 -req -days $CERT_DAYS -in $CERT_DIR/server-req.pem -signkey $KEY_DIR/server-key.pem -out $CERT_DIR/server-cert.pem 

echo "Self-signed certificate created at $CERT_DIR/server-cert.pem"

Create a bucket

To enable object REST API, you must create a bucket.

1. From your NetApp volume, select Buckets.

2. To create a bucket, select +Create.

3. Provide the following information for the bucket:

   • Name

     Specify the name for your bucket. Refer to Naming rules and restrictions for Azure resources for naming conventions.

   • Path

     The subdirectory path for object REST API. For full volume access, leave this field blank or use / for the root directory.

   • User ID (UID)

     The UID used to read the bucket.

   • Group ID (GID)

     The GID used to read the bucket.

   • Permissions

     Select Read or Read-Write.

   

4. If you haven't provided a certificate, upload your PEM file.

   To upload a certificate, provide the following information:

   • Fully qualified ___domain name

     Enter the fully qualified ___domain name.

   • Certificate source

     Upload the appropriate certificate. Only PEM files are supported.

   Select Save.

5. Select Create.

After you create a bucket, you need to generate credentials to access the bucket.

Update bucket access

You can modify a bucket's access management settings.

1. From your NetApp volume, select Buckets.
2. Select +Create.
3. Enter the name of the bucket you want to modify.
4. Change the access management settings as required.
5. You can modify the User ID, Group ID, Username (for SMB or dual-protocol volumes), and Permissions.
6. Click Save to modify the existing bucket.

Generate credentials

1. Navigate to your newly created bucket. Select Generate keys.
2. Enter the desired Access key lifespan in days then select Generate keys. After you select Generate keys, the portal displays the access key and secret access key.

   Important

   The access key and secret access key are only displayed once. Store the keys securely. Do not share the keys.

3. After you set the credentials, you can generate a new access key and secret access key by selecting the ... menu then selecting Generate access keys. Generating new keys immediately invalidates the existing keys.

Delete a bucket

Deleting a bucket is a permanent operation. You can't recover the bucket after deleting it.

1. In your NetApp account, navigate to Buckets.
2. Select the checkbox next to the bucket you want to delete.
3. Select Delete.
4. In the modal, select Delete to confirm you want to delete the bucket.

Next steps

• Understand object REST API
• Connect to Azure Databricks
• Connect to an S3 browser
• Connect to OneLake