AWS transfer medium security documentation change
Summary
Updated NLB recommendations with security-focused guidance including TLS session resumption and attack prevention
Security assessment
Explicitly addresses security improvements by mandating TLS session resumption, preventing downgrade attacks, and enhancing encryption parameters. The note about 'stronger security guarantees' and compliance demonstrates concrete security context.
Diff
diff --git a/transfer/latest/userguide/sftp-for-transfer-family.md b/transfer/latest/userguide/sftp-for-transfer-family.md index 53a64994e..a532d3379 100644 --- a//transfer/latest/userguide/sftp-for-transfer-family.md +++ b//transfer/latest/userguide/sftp-for-transfer-family.md @@ -117 +117 @@ If you use a Network Load Balancer, the AWS Transfer Family CloudWatch logs show -While we recommend avoiding Network Load Balancers in front of AWS Transfer Family servers (see [Avoid placing NLBs in front of AWS Transfer Family servers](./infrastructure-security.html#nlb-considerations)), if your FTP or FTPS implementation requires an NLB, follow these recommendations: +While we recommend avoiding Network Load Balancers in front of AWS Transfer Family servers, if your FTP or FTPS implementation requires an NLB, follow these recommendations: @@ -119 +119 @@ While we recommend avoiding Network Load Balancers in front of AWS Transfer Fami - * Turn off health checks on ports 8192-8200. Consider using port 21 instead for health checks. + * Use port 21 for health checks, rather than ports 8192-8200. @@ -122,0 +123,12 @@ While we recommend avoiding Network Load Balancers in front of AWS Transfer Fami +###### Note + +This is the Recommended mode, as it provides enhanced security: + + * Requires clients to use TLS session resumption for subsequent connections. + + * Provides stronger security guarantees by ensuring consistent encryption parameters. + + * Helps prevent potential downgrade attacks. + + * Maintains compliance with security standards while optimizing performance. + @@ -128 +140,3 @@ While we recommend avoiding Network Load Balancers in front of AWS Transfer Fami -For additional guidance on NLB alternatives, contact the AWS Transfer Family Product Management team through AWS Support. For more details on improving your security posture, see the blog post [Six tips to improve the security of your AWS Transfer Family server](https://aws.amazon.com/blogs/security/six-tips-to-improve-the-security-of-your-aws-transfer-family-server/) +For additional guidance on NLB alternatives, contact the AWS Transfer Family Product Management team through AWS Support. For more details on improving your security posture, see the blog post [Six tips to improve the security of your AWS Transfer Family server](https://aws.amazon.com/blogs/security/six-tips-to-improve-the-security-of-your-aws-transfer-family-server/). + +Security guidance for NLBs is provided in [Avoid placing NLBs in front of AWS Transfer Family servers](./infrastructure-security.html#nlb-considerations).