Feature Request: Support S3 Access Points in defineStorage

[Yoshiki0705]

Environment information

System:
  OS: macOS 15.4.1
  CPU: Apple M4 Max
  Memory: 128 GB
  Shell: /bin/zsh
Binaries:
  Node: 22.16.0
  npm: 10.9.2
  pnpm: 9.7.0
NPM Packages:
  @aws-amplify/backend: 1.14.0
  @aws-amplify/backend-cli: 1.4.7
  aws-cdk-lib: 2.150.0
AWS environment variables:
  AWS_REGION: ap-northeast-1

Describe the feature

Currently, defineStorage in Amplify Gen2 only supports standard S3 buckets. There is no mechanism to specify an S3 Access Point (AP) as the storage backend.

S3 Access Points expose bucket data through a separate endpoint with its own IAM policy. FSx for ONTAP S3 Access Points take this further by exposing NAS file data (NFS/SMB volumes) through the S3 API — no data copying required.

Requested behavior: Allow defineStorage (or a new construct) to accept an S3 Access Point alias or ARN as the backend target:

// Option A: Access Point in existing bucket connection
export const storage = defineStorage({
  name: 'nasFiles',
  isDefault: true,
  accessPoint: {
    alias: 'my-fsxn-ap-s3alias',
    // or arn: 'arn:aws:s3:ap-northeast-1:123456789012:accesspoint/my-ap'
  }
});

// Option B: Minimal — just accept AP alias where bucket name is expected
// (this already works at the SDK level since AP aliases are valid bucket identifiers)

This would enable Amplify.Storage.list(), .getUrl(), .uploadData(), .remove() to work against S3 Access Points — including FSx for ONTAP S3 AP.

Use case

I'm building file portal UIs where enterprise NAS data (design drawings, simulation logs, contracts) stored on FSx for ONTAP needs to be accessible from a web application. The data is already on FSx for ONTAP volumes accessed via NFS/SMB — S3 Access Points provide a zero-copy S3 API layer on top.

Current workaround: Custom AppSync resolvers + Lambda functions that call S3 API with the AP alias as the bucket parameter. All file operations (list, download, upload) go through Lambda, adding:

• 500-800ms cold start latency per first request
• Lambda execution costs (~$45/month for a 100-user deployment)
• Operational complexity (8 Lambda functions for file operations)

With native defineStorage support for S3 AP, file operations would go directly from the browser (via SigV4 credentials from Cognito) to the S3 AP endpoint — cutting latency to ~200ms and eliminating Lambda proxy costs.

Note: The Amplify UI team has a related issue for Storage Browser + S3 AP support: aws-amplify/amplify-ui#6227 — I've verified that Storage Browser already works with AP aliases via createManagedAuthAdapter. The gap is in the backend defineStorage / Amplify.Storage client integration.

Reference implementation: https://github.com/Yoshiki0705/FSx-for-ONTAP-S3AccessPoints-Serverless-Patterns (28 serverless patterns using FSx for ONTAP S3 AP, including an Amplify Gen2 portal with Lambda-proxied file access)