AWS transfer medium security documentation change

Service: transfer · 2025-07-04 · Security-related medium

File: transfer/latest/userguide/infrastructure-security.md

Summary

Added section warning against using Network Load Balancers with Transfer Family servers

Security assessment

Directly addresses security and operational risks of NLB usage including loss of source IP visibility and connection limitations

Diff

diff --git a/transfer/latest/userguide/infrastructure-security.md b/transfer/latest/userguide/infrastructure-security.md
index 7bd89a2e4..8c12c3f11 100644
--- a//transfer/latest/userguide/infrastructure-security.md
+++ b//transfer/latest/userguide/infrastructure-security.md
@@ -4,0 +5,2 @@
+NLB considerations
+
@@ -19,0 +22,8 @@ Additionally, requests must be signed by using an access key ID and a secret acc
+## Avoid placing NLBs in front of AWS Transfer Family servers
+
+We've spoken with many customers who have configured a Network Load Balancer (NLB) to route traffic to their AWS Transfer Family server. Usually, they've done this either because they created their server before we offered a way to access it from both inside their VPC and from the internet, or to support FTP on the internet. This not only increases the cost for the customer, it can cause other issues, which we describe in this section.
+
+If you're using this configuration, we encourage you to move to a VPC endpoint and use an Elastic IP. Placing an NLB in front of your AWS Transfer Family server removes your ability to see the source IP of your users, because AWS Transfer Family will see only the IP address of your NLB. This not only degrades your ability to audit who is accessing your server, it can also impact performance. AWS Transfer Family uses the source IP to shard your connections across our data plane. In the case of FTPS, this means that instead of being able to have 10,000 simultaneous connections, a AWS Transfer Family server with an NLB in front of it would be limited to only 300 simultaneous connections.
+
+If you have a use case that requires you to place an NLB in front of your AWS Transfer Family server, reach out to the AWS Transfer Family Product Management team through AWS Support, so we can look for options to help you take full advantage of our service.
+