AWS cli medium security documentation change

Service: cli · 2025-10-16 · Security-related medium

File: cli/latest/reference/transfer/update-server.md

Summary

Added warning about Network Load Balancers/NAT gateways impacting FTPS performance and connection limits

Security assessment

The documentation update addresses security-adjacent operational risks by warning about IP address obfuscation and reduced TLS connection capacity when using NLBs/NATs, which could indirectly impact security monitoring and DDoS protection capabilities.

Diff

diff --git a/cli/latest/reference/transfer/update-server.md b/cli/latest/reference/transfer/update-server.md
index 07729e5e5..4ffd18b82 100644
--- a//cli/latest/reference/transfer/update-server.md
+++ b//cli/latest/reference/transfer/update-server.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »
@@ -144,0 +145,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
+> ### Note
+> 
+> Avoid placing Network Load Balancers (NLBs) or NAT gateways in front of Transfer Family servers, as this increases costs and can cause performance issues, including reduced connection limits for FTPS. For more details, see [Avoid placing NLBs and NATs in front of Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations) .
+> 
@@ -162,0 +167,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
+>>> 
+>>> Additionally, avoid placing Network Load Balancers (NLBs) or NAT gateways in front of Transfer Family servers. This configuration increases costs and can cause performance issues. When NLBs or NATs are in the communication path, Transfer Family cannot accurately recognize client IP addresses, which impacts connection sharding and limits FTPS servers to only 300 simultaneous connections instead of 10,000. If you must use an NLB, use port 21 for health checks and enable TLS session resumption by setting `TlsSessionResumptionMode = ENFORCED` . For optimal performance, migrate to VPC endpoints with Elastic IP addresses instead of using NLBs. For more details, see [Avoid placing NLBs and NATs in front of Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/infrastructure-security.html#nlb-considerations) .
@@ -988 +994 @@ ServerId -> (string)
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »