AWS transfer documentation change
Summary
Added documentation about SFTP connector egress types (Service managed vs VPC Lattice) and connectivity options
Security assessment
The changes document network security controls by explaining VPC-based routing options and access patterns, but do not address specific vulnerabilities. The added matrix helps implement security best practices for network isolation.
Diff
diff --git a/transfer/latest/userguide/configure-sftp-connector.md b/transfer/latest/userguide/configure-sftp-connector.md index cf56d9c21..9960c34b6 100644 --- a//transfer/latest/userguide/configure-sftp-connector.md +++ b//transfer/latest/userguide/configure-sftp-connector.md @@ -4,0 +5,2 @@ +Choosing SFTP connector egress type + @@ -8,0 +11,4 @@ This topic describes how to create SFTP connectors. Each connector provides the +###### Note + +For VPC-based connectors that route traffic through your Virtual Private Cloud, see [Create an SFTP connector with VPC-based egress](./create-vpc-sftp-connector-procedure.html). + @@ -11 +17 @@ This topic describes how to create SFTP connectors. Each connector provides the - 2. Create the connector, specifying the secret ARN, the remote server's URL, the security policy containing the algorithms that will be supported by the connector, and other configuration settings. + 2. Create the connector, by specifying the secret ARN, the remote server's URL or Resource Configuration ARN, the security policy containing the algorithms that will be supported by the connector, and other configuration settings. @@ -17,0 +24,34 @@ This topic describes how to create SFTP connectors. Each connector provides the +## Choosing SFTP connector egress type + +When you create a SFTP connector, you choose the Egress Type between "Service managed" and "VPC Lattice". + + * **Service managed** (default): The connector uses NAT gateways and IP addresses owned by AWS Transfer Family to route connections over the public internet. The service provides 3 static IP addresses for your connectors that need to be allowlisted on the remote servers to establish connections. + + * **VPC Lattice** : The connector routes traffic through your VPC environment using Amazon VPC Lattice. Use VPC connectivity for SFTP connectors in these scenarios: + + * **Private SFTP servers** : Connect to SFTP servers that are only accessible from your VPC + + * **On-premises connectivity** : Connect to on-premises SFTP servers through AWS Direct Connect or AWS Virtual Private Network connections + + * **Custom IP addresses** : Present your own NAT gateways and Elastic IP addresses to the remote server + + * **Centralized security controls** : Route file transfers through your organization's central ingress/egress controls + + + + +The following matrix helps you choose the right connector type for your use-cases. + +SFTP Connector Egress Type matrix Capability | Egress Type = Service managed | Egress Type = VPC Lattice +---|---|--- +Connectivity to Publicly hosted (internet-accessible) SFTP servers | Supported | Supported1 +Connectivity to Privately hosted (on-premises) SFTP servers | Not supported | Supported2 +Connectivity to Privately hosted (in-VPC) SFTP servers | Not supported | Supported +Static IP addresses presented to remote SFTP server | Supported via service supplied static IP addresses | Supported via customer owned static IP addresses +Bandwidth available | 50 MBPS per account | Higher bandwidth, as available from customer owned Resource Gateway and NAT Gateway +Traffic routing to internet over customer-owned NAT Gateways and Network Firewalls | Not supported. NAT Gateways are owned and managed by Transfer Family service. | Supported + +1 _With Egress Type = VPC Lattice, connectivity to publicly hosted servers is supported using the egress infrastructure (NAT Gateways) setup in your egress VPCs._ + +2 _With Egress Type = VPC Lattice, connectivity to privately hosted servers is supported using existing networks in your VPC, such as AWS Direct Connect or VPN._ + @@ -22 +62,3 @@ This topic describes how to create SFTP connectors. Each connector provides the - * [Create an SFTP connector](./create-sftp-connector-procedure.html) + * [Create an SFTP connector with service-managed egress](./create-sftp-connector-procedure.html) + + * [Create an SFTP connector with VPC-based egress](./create-vpc-sftp-connector-procedure.html)