AWS cli medium security documentation change

Service: cli · 2025-10-16 · Security-related medium

File: cli/latest/reference/transfer/create-server.md

Summary

Added security advisory about Network Load Balancers/NAT gateways and FTPS connection limits

Security assessment

The change documents security-impacting infrastructure configurations, specifically how NLBs/NATs can reduce FTPS connection limits from 10,000 to 300 and obscure client IPs. It provides TLS session resumption guidance to mitigate these issues, directly addressing security-related performance limitations.

Diff

diff --git a/cli/latest/reference/transfer/create-server.md b/cli/latest/reference/transfer/create-server.md
index d7db821d5..3216d8731 100644
--- a//cli/latest/reference/transfer/create-server.md
+++ b//cli/latest/reference/transfer/create-server.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »
@@ -512,0 +513,4 @@ Syntax:
+> ### Note
+> 
+> Avoid placing Network Load Balancers (NLBs) or NAT gateways in front of Transfer Family servers, as this increases costs and can cause performance issues, including reduced connection limits for FTPS. For more details, see [Avoid placing NLBs and NATs in front of Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations) .
+> 
@@ -530,0 +535,2 @@ Syntax:
+>>> 
+>>> Additionally, avoid placing Network Load Balancers (NLBs) or NAT gateways in front of Transfer Family servers. This configuration increases costs and can cause performance issues. When NLBs or NATs are in the communication path, Transfer Family cannot accurately recognize client IP addresses, which impacts connection sharding and limits FTPS servers to only 300 simultaneous connections instead of 10,000. If you must use an NLB, use port 21 for health checks and enable TLS session resumption by setting `TlsSessionResumptionMode = ENFORCED` . For optimal performance, migrate to VPC endpoints with Elastic IP addresses instead of using NLBs. For more details, see [Avoid placing NLBs and NATs in front of Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations) .
@@ -1041 +1047 @@ ServerId -> (string)
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »