AWS transfer medium security documentation change
Summary
Added section 'FTP and FTPS Network Load Balancer considerations' with security recommendations including disabling health checks on ports 8192-8200, enforcing TLS session resumption, and migration guidance away from NLBs
Security assessment
The changes explicitly address security configurations by recommending TLS enforcement (CWE-319), port hardening, and migration from NLBs to improve security posture. References a security blog post about server hardening.
Diff
diff --git a/transfer/latest/userguide/sftp-for-transfer-family.md b/transfer/latest/userguide/sftp-for-transfer-family.md index 67eea66b6..53a64994e 100644 --- a//transfer/latest/userguide/sftp-for-transfer-family.md +++ b//transfer/latest/userguide/sftp-for-transfer-family.md @@ -5 +5 @@ -Identity provider optionsAWS Transfer Family endpoint type matrix +Identity provider optionsAWS Transfer Family endpoint type matrixFTP/FTPS NLB considerations @@ -18,0 +19,2 @@ This topic provides details for creating and using AWS Transfer Family server en + * FTP and FTPS Network Load Balancer considerations + @@ -87,0 +90 @@ Client firewall allow list | You must allow the DNS name of the server. Because +IP address type | IPv4 (default) or dual-stack (IPv4 and IPv6) | IPv4 only (dual-stack not supported) | IPv4 (default) or dual-stack (IPv4 and IPv6) | IPv4 only (dual-stack not supported) @@ -111,0 +115,15 @@ If you use a Network Load Balancer, the AWS Transfer Family CloudWatch logs show +## FTP and FTPS Network Load Balancer considerations + +While we recommend avoiding Network Load Balancers in front of AWS Transfer Family servers (see [Avoid placing NLBs in front of AWS Transfer Family servers](./infrastructure-security.html#nlb-considerations)), if your FTP or FTPS implementation requires an NLB, follow these recommendations: + + * Turn off health checks on ports 8192-8200. Consider using port 21 instead for health checks. + + * Enable TLS session resumption by setting `TlsSessionResumptionMode = ENFORCED`. + + * If possible, migrate away from using an NLB to take full advantage of AWS Transfer Family performance and connection limits. + + + + +For additional guidance on NLB alternatives, contact the AWS Transfer Family Product Management team through AWS Support. For more details on improving your security posture, see the blog post [Six tips to improve the security of your AWS Transfer Family server](https://aws.amazon.com/blogs/security/six-tips-to-improve-the-security-of-your-aws-transfer-family-server/) +