AWS transfer documentation change
Summary
Updated guidance about Network Load Balancers/NAT gateways and added connection limitation warnings
Security assessment
Changes focus on architectural best practices and performance considerations rather than direct security vulnerabilities. The NAT gateway limitations mentioned relate to operational reliability rather than security flaws.
Diff
diff --git a/transfer/latest/userguide/infrastructure-security.md b/transfer/latest/userguide/infrastructure-security.md index ce5fca15f..3ac81ad3f 100644 --- a//transfer/latest/userguide/infrastructure-security.md +++ b//transfer/latest/userguide/infrastructure-security.md @@ -28 +28 @@ Servers configured with FTP and FTPS protocols only allow a configuration with a -Many customers configure a Network Load Balancer (NLB) to route traffic to their AWS Transfer Family server. They typically do this either because they created their server before AWS offered a way to access it from both inside their VPC and from the internet, or to support FTP on the internet. This configuration not only increases costs for customers, but can also cause other issues, which we describe in this section. Additionally, many clients might be behind the same NAT gateway. +Many customers configure a Network Load Balancer (NLB) to route traffic to their AWS Transfer Family server. They typically do this either because they created their server before AWS offered a way to access it from both inside their VPC and from the internet, or to support FTP on the internet. This configuration not only increases costs for customers, but can also cause other issues, which we describe in this section. @@ -30 +30,3 @@ Many customers configure a Network Load Balancer (NLB) to route traffic to their -If you're using the configuration of a Transfer Family server behind an NLB, we recommend that you move to a VPC endpoint and use an Elastic IP address instead of using an NLB. Also consider avoiding situations where many clients are behind the same NAT gateway. If there's an NLB or NAT in the communication path from the client to the FTP or FTPS server, the server can't accurately recognize the client's IP address, because AWS Transfer Family sees only the IP address of the NLB or NAT. +NAT gateways are a mandatory component when clients are connecting from a customer private network behind a corporate firewall. However, you should be aware that when many clients are behind the same NAT gateway, this can impact performance and connection limits. If there's an NLB or NAT in the communication path from the client to the FTP or FTPS server, the server can't accurately recognize the client's IP address, because AWS Transfer Family sees only the IP address of the NLB or NAT. + +If you're using the configuration of a Transfer Family server behind an NLB, we recommend that you move to a VPC endpoint and use an Elastic IP address instead of using an NLB. When using NAT gateways, be aware of the connection limitations described below.