AWS transfer documentation change
Summary
Added detailed instructions for configuring dual-stack AS2 servers using an Application Load Balancer with IPv6 support
Security assessment
The changes focus on enabling IPv6 connectivity through ALB configuration without addressing specific security vulnerabilities. While security groups are mentioned, this is part of standard network configuration rather than a security feature addition.
Diff
diff --git a/transfer/latest/userguide/ipv6-support.md b/transfer/latest/userguide/ipv6-support.md index e0eec8e6c..3dd1d7d2f 100644 --- a//transfer/latest/userguide/ipv6-support.md +++ b//transfer/latest/userguide/ipv6-support.md @@ -5 +5 @@ -IPv6 limitationsConfiguring IPv6 for servers +IPv6 limitationsConfiguring IPv6 for serversUse ALB for dual-stack AS2 public server @@ -13 +13,3 @@ AWS Transfer Family supports dual-stack (IPv4 and IPv6) endpoints for the follow - * SFTP/FTPS/FTP VPC internal endpoints + * VPC internal endpoints for all protocols (SFTP/FTPS/FTP and AS2) + + * Public endpoints for AS2-enabled Transfer Family servers, by using the steps provided in Using an Application Load Balancer for dual-stack AS2 server connectivity @@ -75,0 +78,89 @@ For VPC-Internet endpoints, dual-stack mode is not currently supported. +## Using an Application Load Balancer for dual-stack AS2 server connectivity + +You can enable dual-stack (IPv4 and IPv6) connectivity to your AS2 server by using an Application Load Balancer that has a public-facing endpoint. This allows trading partners to connect to your AS2 server using either IPv4 or IPv6. + +To set up a dual-stack Application Load Balancer for your AS2 server + + 1. Create a VPC with the following settings: + + * VPC only + + * Manual IPv4 CIDR input + + * Amazon-provided IPv6 CIDR block + + 2. Create at least two subnets in different Availability Zones: + + * Add IPv6 CIDRs to the subnets + + * When creating subnets, allocate only a subset of the VPC's IPv4/IPv6 addresses to leave addresses available for additional subnets + + 3. Create an internet gateway for the VPC. + + 4. Edit the route table and add two routes: + + * One route with _Destination_ `0.0.0.0/0` + + * One route with _Destination_ `::/0` + + * Set both route targets to the internet gateway you created + + 5. Create an AS2-enabled server in the VPC that you created in step 1. Make sure to specify the `IpAddressType` as `DUALSTACK`. + +For details on how to create a Transfer Family server that uses the AS2 protocol, see [Create an AS2 server](./create-as2-transfer-server.html). + + 6. Create a target group: + + * For _Specify group details_ , configure: + + * Target type: IP addresses + + * Name: Enter a name + + * Protocol: HTTP + + * Port: 5080 + + * VPC: Select the VPC you created + + * Protocol version: HTTP1 + + * Health checks: Use defaults + + * For _Register targets_ : + + * Enter your AS2 server's private IPv4 address + + * Choose _Include as pending below_ + + 7. Create an Application Load Balancer: + + * Enter a name + + * For _Scheme_ , choose _Internet-facing_ + + * For _IP address type_ , choose _Dualstack_ + + * For _Network mapping_ : + + * Select the VPC you created + + * Select the Availability Zones where you created subnets + + * For _Security groups_ , select a security group that allows inbound IPv4 and IPv6 traffic from any IP address on port 80 + + * For _Listeners and routing_ : + + * Protocol: HTTP + + * Port: 80 + + * Default action: Forward to the target group you created + + * Choose _Create load balancer_ + + + + +After you create the Application Load Balancer, trading partners can use its DNS name to send traffic to your AS2 server. This configuration enables your AS2 server to accept connections from both IPv4 and IPv6 clients through the dual-stack Application Load Balancer. +