AWS cli documentation change

Service: cli · 2025-10-16 · Documentation low

File: cli/latest/reference/transfer/describe-server.md

Summary

Added warning about Network Load Balancers/NAT gateways impacting FTPS performance and security configurations, with guidance for TLS session resumption and VPC endpoint usage.

Security assessment

While the change adds security-related guidance (TLS session resumption enforcement) and references infrastructure security documentation, it primarily addresses performance/cost considerations rather than patching a specific vulnerability. The TLS recommendation improves security posture but isn't tied to a disclosed issue.

Diff

diff --git a/cli/latest/reference/transfer/describe-server.md b/cli/latest/reference/transfer/describe-server.md
index cee36663d..a70c168ea 100644
--- a//cli/latest/reference/transfer/describe-server.md
+++ b//cli/latest/reference/transfer/describe-server.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »
@@ -235,0 +236,4 @@ Server -> (structure)
+>> ### Note
+>> 
+>> Avoid placing Network Load Balancers (NLBs) or NAT gateways in front of Transfer Family servers, as this increases costs and can cause performance issues, including reduced connection limits for FTPS. For more details, see [Avoid placing NLBs and NATs in front of Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations) .
+>> 
@@ -253,0 +258,2 @@ Server -> (structure)
+>>>> 
+>>>> Additionally, avoid placing Network Load Balancers (NLBs) or NAT gateways in front of Transfer Family servers. This configuration increases costs and can cause performance issues. When NLBs or NATs are in the communication path, Transfer Family cannot accurately recognize client IP addresses, which impacts connection sharding and limits FTPS servers to only 300 simultaneous connections instead of 10,000. If you must use an NLB, use port 21 for health checks and enable TLS session resumption by setting `TlsSessionResumptionMode = ENFORCED` . For optimal performance, migrate to VPC endpoints with Elastic IP addresses instead of using NLBs. For more details, see [Avoid placing NLBs and NATs in front of Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations) .
@@ -902 +908 @@ Server -> (structure)
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »