--- title: "AI Activate - Confirming Object Storage Access" slug: "ai-activate-confirming-object-storage-access" tags: ["AI Activate", "AWS", "Azure", "Cloud Credentials", "Configuration"] updated: 2026-10-02T19:50:51Z published: 2026-10-02T19:50:51Z canonical: "docs.nasuni.com/ai-activate-confirming-object-storage-access" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.nasuni.com/llms.txt > Use this file to discover all available pages before exploring further. # AI Activate - Confirming Object Storage Access ## Before You Begin: How the Platform Connects to Storage AI Activate is a hosted product that makes your Nasuni files available to AI tools through MCP. To make the files available, the Nasuni platform connects to your cloud object storage. The Nasuni platform connects via your cloud object storage’s public service endpoint, authenticating with the same credentials that your Nasuni Edge Appliances already use. No new credentials are created, and the platform runs only read operations against your data. The platform reads new and changed files as new versions of your volume are committed to the cloud, so the platform needs to access your storage on an ongoing basis. This means your storage needs to be reachable over your storage’s public service endpoint. Before you check your settings, review the following points: - Access is authenticated, not anonymous. The platform signs every request with your existing credentials. The platform does not use public or anonymous access. - For Amazon S3, you do not need to make the bucket public or disable S3 Block Public Access. Those settings govern public and anonymous access, which the platform does not use. - Your UniFS volume data remains encrypted at rest with your own keys. The one requirement is that your storage must not be restricted to a private network path or a fixed set of IP addresses. The platform does not connect from a fixed, shareable set of public IP addresses, so the platform cannot be added to an IP allowlist or reached through a private network path such as a VPC endpoint or private endpoint. If your storage is restricted in that way, the platform cannot connect to your storage. Use the instructions below to confirm your configuration. ## Part 1: Identify the Storage Resource for Your Volume Find the name of the resource that holds your volume. To find your storage location name, follow these steps: 1. In the Nasuni Management Console (NMC), open the **Volumes** page. 2. Select your volume from the **Volume List**. The volume properties appear, including the **Name** and storage details for that volume. 3. Note the following values for your volume. Use these values in the steps below to locate the correct resource in your cloud console. 1. **Bucket** for Amazon S3 volumes. Use the bucket name in [Part 2a](/v1/docs/ai-activate-confirming-object-storage-access#part-2a-volumes-in-amazon-s3). 2. **Container** for Microsoft Azure volumes. Use the container name in [Part 2b](/v1/docs/ai-activate-confirming-object-storage-access#part-2b-volumes-in-microsoft-azure). ## Part 2a: Checking Amazon S3 Bucket Compatibility ### Amazon S3 Compatibility Requirements Your bucket must be reachable over the public S3 service endpoint. Specifically, the bucket policy must **not** restrict access by IP address or by network path. The platform cannot connect if the bucket policy limits access to specific IP addresses, a specific VPC, or a specific VPC endpoint. You do **not** need to change S3 Block Public Access, nor do you need to make the bucket public. ### Check Amazon S3 Settings in the AWS Console To check the Amazon S3 settings, follow these steps: 1. Sign in to the [AWS Management Console](https://aws.amazon.com/) and open the **Amazon S3** service. 2. In the **Buckets** list, select the bucket name that you found in step 3a of [Part 1: Identify the Storage Resource for Your Volume](/v1/docs/confirming-object-storage-network-access-nasuni-enterprise-search-ai#step-1-find-your-storage-location-name). 3. Click the **Permissions** tab. 4. Scroll to the **Bucket policy** section and review the policy. 1. If there is **no bucket policy**, no policy-based network restriction applies. Your bucket is compatible. You can stop here. 2. If a bucket policy is present, review its Condition blocks in the next step. 5. In the policy JSON, look for any Condition that references network or IP restrictions. The following values block the platform and are not compatible: 1. aws:SourceIp or NotIpAddress 2. aws:SourceVpc 3. aws:SourceVpce ### Interpret the Amazon S3 Result - **Compatible:** No statement restricts access by IP address, VPC, or VPC endpoint. Authenticated requests are allowed regardless of where those requests originate. - **Not compatible:** A statement allows access only from specific IP addresses, a specific VPC, or a specific VPC endpoint, or denies access from anywhere else. The platform cannot connect under this configuration. ### Optional: Check Amazon S3 Settings with the AWS CLI If you manage many volumes, you can inspect the bucket policy from the command line: `aws s3api get-bucket-policy --bucket <BUCKET_NAME> --query Policy --output text` - If the command returns an error such as “The bucket policy does not exist”, then there is no bucket policy, and your bucket is compatible. - If the command returns a policy, review the Condition blocks for `aws:SourceIp`, `NotIpAddress`, `aws:SourceVpc`, or `aws:SourceVpce` as described in step 5 of the [Check Amazon S3 Settings in the AWS Console](/v1/docs/confirming-object-storage-network-access-nasuni-enterprise-search-ai#how-to-check-aws-console) section. ## Part 2b: Check Microsoft Azure Storage Compatibility ### Azure Storage Compatibility Requirements Your storage account must allow access over your storage’s public service endpoint. Ensure your configuration meets the following requirements: 1. **Public network access** is set to **Enabled from all networks**. 2. The storage account does not further restrict access by IP address or virtual network. 3. **Storage account key access** (Shared Key authorization) is **enabled** because the platform authenticates using the account key. Unlike Amazon S3, Azure has a network access toggle on the storage account itself, so this setting must be enabled for the platform to connect. ### Check Azure Storage Settings in the Azure Portal **Public network access and network restrictions** 1. Sign in to the [Azure portal](https://portal.azure.com/) and click **Storage accounts**. 2. Select the storage account that holds the container you found in step 3b of [Part 1: Identify the Storage Resource for Your Volume](/v1/docs/confirming-object-storage-network-access-nasuni-enterprise-search-ai#step-1-find-your-storage-location-name). In Azure, a container lives inside a storage account. The settings below are configured on the storage account. If you are not sure which storage account holds your container, your storage administrator can confirm the correct storage account. 3. Under **Security + networking**, click **Networking**. 4. On the **Public access** tab, in the **Public network access** area, click **Manage** and check these settings: 1. **Public Network Access: Enable** (the default setting) is compatible. 2. **Public Network Access: Disable** is not compatible. Public access is required for the platform to connect. 3. **Public Network Access: Secured by perimeter** is not compatible. The platform is not part of your network security perimeter, so it cannot access the storage account. 4. **Public Network Access Scope: Enable from all networks** is compatible. 5. **Public Network Access Scope: Enable from selected networks** is ***not*** compatible. The platform is not in your selected networks and cannot be added to an IP allowlist. **Storage account key access** 1. Under **Settings**, click **Configuration**. 2. Confirm **Allow storage account key access** is set to **Enabled**. ### Interpret the Azure Result - **Compatible:** Public network access is enabled on all networks, no IP or virtual network scope restrictions are applied, and storage account key access is enabled. - **Not compatible:** Public network access is disabled, limited to selected networks, or secured by a network security perimeter; an IP or virtual network scope restriction is applied; or storage account key access is disabled. ### Optional: Check Azure Settings with the Azure CLI You can confirm all three settings with a single command: ```plaintext az storage account show \ --name \ --resource-group \ --query "{publicNetworkAccess:publicNetworkAccess, defaultAction:networkRuleSet.defaultAction, allowSharedKeyAccess:allowSharedKeyAccess}" ``` A compatible storage account returns: - **publicNetworkAccess**: Enabled. A value of Disabled or SecuredByPerimeter is not compatible. - **defaultAction**: Allow. Allow confirms that access is open to all networks rather than selected networks. - **allowSharedKeyAccess**: True. If allowSharedKeyAccess is not set, Shared Key access is allowed by default. ## Part 3: If Your Storage Configuration Is Not Compatible If your storage is restricted by an IP address, a virtual network, or a private network path, the platform cannot connect to the storage, preventing AI Activate from accessing that volume. Before changing any settings, contact your Nasuni account team. Your Nasuni account team can review your configuration with you and discuss the options available for your environment.