AWS AWSCloudFormation medium security documentation change
Summary
Added warning against using NLBs/NAT gateways with Transfer Family servers, explaining performance and security impacts
Security assessment
The change highlights security implications of misconfigured network infrastructure (NLBs/NATs) leading to reduced FTPS connection limits and inability to track client IPs. It provides mitigation steps (TLS session resumption) to maintain security posture.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-transfer-server-protocoldetails.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-transfer-server-protocoldetails.md index 1c58d0b36..ed5faf353 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-transfer-server-protocoldetails.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-transfer-server-protocoldetails.md @@ -10,0 +11,4 @@ The protocol settings that are configured for your server. +###### Note + +Avoid placing Network Load Balancers (NLBs) or NAT gateways in front of AWS Transfer Family servers, as this increases costs and can cause performance issues, including reduced connection limits for FTPS. For more details, see [ Avoid placing NLBs and NATs in front of AWS Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations). + @@ -76,0 +81,2 @@ If you change the `PassiveIp` value, you must stop and then restart your Transfe +Additionally, avoid placing Network Load Balancers (NLBs) or NAT gateways in front of AWS Transfer Family servers. This configuration increases costs and can cause performance issues. When NLBs or NATs are in the communication path, Transfer Family cannot accurately recognize client IP addresses, which impacts connection sharding and limits FTPS servers to only 300 simultaneous connections instead of 10,000. If you must use an NLB, use port 21 for health checks and enable TLS session resumption by setting `TlsSessionResumptionMode = ENFORCED`. For optimal performance, migrate to VPC endpoints with Elastic IP addresses instead of using NLBs. For more details, see [ Avoid placing NLBs and NATs in front of AWS Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations). +