As discussed in the Introduction to ONTAP Cloud post ONTAP Cloud in AWS leverages Floating IP addresses to provide AZ failover of NAS LIF's. Floating IP's are required because a subnet in AWS cannot span more than one AZ.

Essentially a Floating IP address sits outside of the CIDR range of the VPC, the subnet(s) route table provides a route from the Floating IP to the LIF for it's home node. In the event of a takeover that route table is update and the Floating IP will route to a LIF on the remaining node. This is how failover works for all NAS traffic and also the cluster management LIF. SAN traffic uses ALUA there

However the challenge with Floating IP's is that they are only accessible inside the VPC of which they are used.

One way to architect around these limitations and provide HA access to NAS services outside of the VPC is to use a 3rd party solution to manage the routing. Aviatrix provides cloud based networking software that makes it simple to leverage transitive peering which will enable us to provide external access to the Floating IP addresses. An Aviatrix Gateway client is deployed inside the same VPC as the ONTAP Cloud instance as well as in the VPC or on-prem environment where access is required. The gateways will maintain internal route tables that point to the other Aviatrix Gateway therefore allowing access to the LIF.

The below details how this solution would look:

This solution is also useful for providing access to on premises management tools such as Unified Manager which leverage the cluster management LIF. This can be achieved by manually adding a LIF with a static IP however as discussed initially you would lose access in the event of a node failover.

Aviatrix have documented exactly how to do this here.