AI Activate - Confirming Object Storage Access

  • Updated on Oct 16, 2026
  • Published on Jul 6, 2026
  • 5 minute(s) read
  • ED
  • CD
  • PG
 Prev Next

Before You Begin: How the Platform Connects to Storage

AI Activate is a hosted product that makes your Nasuni files available to AI tools through MCP. To make the files available, the Nasuni platform connects to your cloud object storage. The Nasuni platform connects via your cloud object storage’s public service endpoint, authenticating with the same credentials that your Nasuni Edge Appliances already use. No new credentials are created, and the platform runs only read operations against your data. The platform reads new and changed files as new versions of your volume are committed to the cloud, so the platform needs to access your storage on an ongoing basis.

This means your storage needs to be reachable over your storage’s public service endpoint. Before you check your settings, review the following points:

  • Access is authenticated, not anonymous. The platform signs every request with your existing credentials. The platform does not use public or anonymous access.

  • For Amazon S3, you do not need to make the bucket public or disable S3 Block Public Access. Those settings govern public and anonymous access, which the platform does not use.

  • Your UniFS volume data remains encrypted at rest with your own keys.

The one requirement is that your storage must not be restricted to a private network path or a fixed set of IP addresses. The platform does not connect from a fixed, shareable set of public IP addresses, so the platform cannot be added to an IP allowlist or reached through a private network path such as a VPC endpoint or private endpoint. If your storage is restricted in that way, the platform cannot connect to your storage.

Use the instructions below to confirm your configuration.

Part 1: Identify the Storage Resource for Your Volume

Find the name of the resource that holds your volume.

To find your storage location name, follow these steps:

  1. In the Nasuni Management Console (NMC), open the Volumes page.

  2. Select your volume from the Volume List. The volume properties appear, including the Name and storage details for that volume.

  3. Note the following values for your volume. Use these values in the steps below to locate the correct resource in your cloud console.

    1. Bucket for Amazon S3 volumes. Use the bucket name in Part 2a.

    2. Container for Microsoft Azure volumes. Use the container name in Part 2b.

Part 2a: Check Amazon S3 Bucket Compatibility

Amazon S3 Compatibility Requirements

Your bucket must be reachable over the public S3 service endpoint. Specifically, the bucket policy must not restrict access by IP address or by network path. The platform cannot connect if the bucket policy limits access to specific IP addresses, a specific VPC, or a specific VPC endpoint.

You do not need to change S3 Block Public Access, nor do you need to make the bucket public.

Check Amazon S3 Settings in the AWS Console

To check the Amazon S3 settings, follow these steps:

  1. Sign in to the AWS Management Console and open the Amazon S3 service.

  2. In the Buckets list, select the bucket name that you found in step 3a of  Part 1: Identify the Storage Resource for Your Volume.

  3. Click the Permissions tab.

  4. Scroll to the Bucket policy section and review the policy.

    1. If there is no bucket policy, no policy-based network restriction applies. Your bucket is compatible. You can stop here.

    2. If a bucket policy is present, review its Condition blocks in the next step.

  5. In the policy JSON, look for any Condition that references network or IP restrictions. The following values block the platform and are not compatible:

    1. aws:SourceIp or NotIpAddress

    2. aws:SourceVpc

    3. aws:SourceVpce

Interpret the Amazon S3 Result

  • Compatible: No statement restricts access by IP address, VPC, or VPC endpoint. Authenticated requests are allowed regardless of where those requests originate.

  • Not compatible: A statement allows access only from specific IP addresses, a specific VPC, or a specific VPC endpoint, or denies access from anywhere else. The platform cannot connect under this configuration.

Optional: Check Amazon S3 Settings with the AWS CLI

If you manage many volumes, you can inspect the bucket policy from the command line:

aws s3api get-bucket-policy --bucket <BUCKET_NAME> --query Policy --output text

  • If the command returns an error such as “The bucket policy does not exist”, then there is no bucket policy, and your bucket is compatible.

  • If the command returns a policy, review the Condition blocks for aws:SourceIp, NotIpAddress, aws:SourceVpc, or aws:SourceVpce as described in step 5 of the Check Amazon S3 Settings in the AWS Console section.

Part 2b: Check Microsoft Azure Storage Compatibility

Azure Storage Compatibility Requirements

Your storage account must allow access over your storage’s public service endpoint.

Ensure your configuration meets the following requirements:

  1. Public network access is set to Enabled from all networks.

  2. The storage account does not further restrict access by IP address or virtual network.

Unlike Amazon S3, Azure has a network access toggle on the storage account itself, so this setting must be enabled for the platform to connect.

Check Azure Storage Settings in the Azure Portal

  1. Sign in to the Azure portal and click Storage accounts.

  2. Select the storage account that holds the container you found in step 3b of Part 1: Identify the Storage Resource for Your Volume. In Azure, a container lives inside a storage account. The settings below are configured on the storage account. If you are not sure which storage account holds your container, your storage administrator can confirm the correct storage account.

  3. Under Security + networking, click Networking.

  4. On the Public access tab, in the Public network access area, click Manage and check these settings:

    1. Public Network Access: Enable (the default setting) is compatible.

    2. Public Network Access: Disable is not compatible. Access over the public service endpoint is required for the platform to connect.

    3. Public Network Access: Secured by perimeter is not compatible. The platform is not part of your network security perimeter, so it cannot access the storage account.

    4. Public Network Access Scope: Enable from all networks is compatible.

    5. Public Network Access Scope: Enable from selected networks is not compatible. The platform is not in your selected networks and cannot be added to an IP allowlist.

Interpret the Azure Result

  • Compatible: Public network access is enabled from all networks, and no IP or virtual network scope restrictions are applied.

  • Not compatible: Public network access is disabled, limited to selected networks, or secured by a network security perimeter; or an IP or virtual network scope restriction is applied.

Optional: Check Azure Settings with the Azure CLI

You can confirm both settings with a single command:

az storage account show --name <STORAGE_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --query "{publicNetworkAccess:publicNetworkAccess, defaultAction:networkRuleSet.defaultAction}"

A compatible storage account returns:

  • publicNetworkAccess: Enabled.
    A value of Disabled or SecuredByPerimeter is not compatible.

  • defaultAction: Allow.
    Allow confirms that access is open to all networks rather than selected networks.

Part 3: If Your Storage Configuration Is Not Compatible

If your storage is restricted by an IP address, a virtual network, or a private network path, the platform cannot connect to the storage, preventing AI Activate from accessing that volume. Before changing any settings, contact your Nasuni account team. Your Nasuni account team can review your configuration with you and discuss the options available for your environment.

Related articles