AWS transfer medium security documentation change
Summary
Added guidance for trusted host key validation, concurrent connections configuration, and UI screenshots
Security assessment
Added explicit instructions for out-of-band validation of host keys and security best practices for SSH key management. The emphasis on validating host keys through TestConnection and warnings about fingerprint verification address potential man-in-the-middle vulnerabilities.
Diff
diff --git a/transfer/latest/userguide/configure-sftp-connector.md b/transfer/latest/userguide/configure-sftp-connector.md index 87bf6499d..d982590bf 100644 --- a//transfer/latest/userguide/configure-sftp-connector.md +++ b//transfer/latest/userguide/configure-sftp-connector.md @@ -17,2 +16,0 @@ This topic describes how to create SFTP connectors, the security algorithms asso - * [Generate and format the SFTP connector private key](./format-sftp-connector-key.html) - @@ -42,0 +41,2 @@ Console + + @@ -132,0 +133,2 @@ You can also store secrets containing your SFTP credentials in another AWS accou + + @@ -135 +137,17 @@ You can also store secrets containing your SFTP credentials in another AWS accou - * For **Trusted host keys** , paste in the public portion of the host key that is used to identify the external server. You can add more than one key, by choosing **Add trusted host key** to add an additional key. You can use the `ssh-keyscan` command against the SFTP server to retrieve the necessary key. For details about the format and type of trusted host keys that Transfer Family supports, see [SFTPConnectorConfig](https://docs.aws.amazon.com/transfer/latest/APIReference/API_SftpConnectorConfig.html). + * (Optional) **Trusted host keys** of the remote server will be required to use your connector for establishing connections with the remote server. You can enter the Trusted host key(s) at the time of creating your connector, or update your connector later by using the host key information returned by the `TestConnection` console action or API command. + +For the **Trusted host keys** text box, do either of the following: + + * Paste in the public portion of the host key that is used to identify the external server. You can add more than one key, by choosing **Add trusted host key** to add an additional key. You can use the `ssh-keyscan` command against the SFTP server to retrieve the necessary key. For details about the format and type of trusted host keys that Transfer Family supports, see [SFTPConnectorConfig](https://docs.aws.amazon.com/transfer/latest/APIReference/API_SftpConnectorConfig.html). + + * If you do not have the host key information at the time of creating your connector, you can leave this parameter empty for now and proceed with creating your connector. After the connector is created, use the new connector's ID to run the `TestConnection` command, either in the AWS CLI or from the connector's detail page. If successful, `TestConnection` will return the necessary host key information. You can then edit your connector using the console (or by running the `UpdateConnector` AWS CLI command) and add the host key information that was returned when you ran `TestConnection`. + +###### Important + +If you retrieve the remote server's host key by running `TestConnection`, make sure that you perform out-of-band validation on the key that is returned. + +You must accept the new key as trusted, or verify the presented fingerprint with a previously known fingerprint that you have received from the owner of the remote SFTP server you are connecting to. + + * (Optional) For **Maximum concurrent connections** , from the dropdown list, choose the number of concurrent connections that your connector creates to the remote server. The default selection on the console is **5**. + +This setting specifies the number of active connections that your connector can establish with the remote server at the same time. Creating concurrent connections can enhance connector performance by enabling parallel operations. @@ -271,0 +290 @@ Then run the following command to create the connector. + --maximum-concurrent-connections integer-from-1-to-5