AWS transfer documentation change
Summary
Updated documentation for logical directory configurations, including clarification on HomeDirectory usage, added notes about validation during user creation/updates, and expanded CLI examples.
Security assessment
The changes primarily clarify usage of logical directories and provide additional examples. While there is a mention of service validation for HomeDirectory mappings, this appears to be a general configuration check rather than addressing a specific security vulnerability.
Diff
diff --git a/transfer/latest/userguide/logical-dir-mappings.md b/transfer/latest/userguide/logical-dir-mappings.md index 8cae302f2..941fd7735 100644 --- a//transfer/latest/userguide/logical-dir-mappings.md +++ b//transfer/latest/userguide/logical-dir-mappings.md @@ -5 +5 @@ -Rules for using logical directoriesImplementing logical directories and chrootConfigure logical directories exampleConfigure logical directories for Amazon EFSCustom AWS Lambda response +Rules for using logical directoriesImplementing logical directories and chrootConfigure logical directories examplesConfigure logical directories for Amazon EFSCustom AWS Lambda response @@ -53,2 +52,0 @@ If the number that you estimated in step 3 is less than 2.1 MB, then your mappin - * Don't specify the `HomeDirectory` parameter, because this value is implied by the `Entry` `Target` pairs when you're using the `LOGICAL` value for the `HomeDirectoryType` parameter. - @@ -67,0 +66,6 @@ If the number that you estimated in step 3 is less than 2.1 MB, then your mappin +###### Note + +The default value of HomeDirectory will remain as `/` if not specified. + +You can specify a HomeDirectory value when using the LOGICAL HomeDirectoryType. This enhancement applies to Service Managed users, Active Directory access, and Custom Identity Provider implementations where the HomeDirectoryDetails are provided in the response. + @@ -70 +74,8 @@ If the number that you estimated in step 3 is less than 2.1 MB, then your mappin -Unless you choose to optimize performance for your Amazon S3 directories (when you create or update a server), the root directory must exist on startup. For Amazon S3, this means that you must have already created a zero-byte object ending with a forward slash (`/`) to create the root folder. Avoiding this issue is a reason to consider optimizing Amazon S3 performance. +Note the following: + + * Unless you choose to optimize performance for your Amazon S3 directories (when you create or update a server), the root directory must exist on startup. For Amazon S3, this means that you must have already created a zero-byte object ending with a forward slash (`/`) to create the root folder. Avoiding this issue is a reason to consider optimizing Amazon S3 performance. + + * When specifying a HomeDirectory with LOGICAL HomeDirectoryType, the value must map to one of your logical directory mappings. The service validates this during both user creation and updates to prevent configurations that would not work. + + + @@ -157 +168 @@ For more information about configuring logical directories and **chroot** for yo -## Configure logical directories example +## Configure logical directories examples @@ -162 +173,2 @@ In this example, we create a user and assign two logical directories. The follow - aws transfer create-user --user-name marymajor-logical --server-id s-11112222333344445 --role arn:aws:iam::1234abcd5678:role/marymajor-role --home-directory-type LOGICAL \ + aws transfer create-user --user-name marymajor --server-id s-11112222333344445 \ + --role arn:aws:iam::1234abcd5678:role/marymajor-role --home-directory-type LOGICAL \ @@ -169 +181 @@ If `marymajor` is an existing user and her home directory type is `PATH`, you ca - aws transfer update-user --user-name marymajor-logical \ + aws transfer update-user --user-name marymajor \ @@ -177,0 +190,4 @@ Note the following: +###### Note + +These directories are created automatically by the Transfer Family server if you have configured optimized directories. + @@ -191,0 +208,19 @@ Note the following: +This example provides an alternate configuration for a logical home path. + + + aws transfer create-user --user-name marymajor --server-id s-11112222333344445 \ + --role arn:aws:iam::1234abcd5678:role/marymajor-role \ + --home-directory-type LOGICAL \ + --home-directory /home/marymajor \ + --home-directory-mappings "[{\"Entry\":\"/home/marymajor/pics\", \"Target\":\"/amzn-s3-demo-bucket1/pics\"}, {\"Entry\":\"/home/marymajor/doc\", \"Target\":\"/amzn-s3-demo-bucket2/test/mydocs\"}]" \ + --ssh-public-key-body file://~/.ssh/id_rsa.pub + +Note the following: + + * The mappings provide for a common path, `/home/marymajor`, which is the first part of the two logical paths. Files then can be added to the `pics` and `doc` folders. + + * As in the previous example, the home directory, `/home/marymajor`, is read-only. + + + +