AWS transfer documentation change
Summary
Added new section 'Troubleshoot VPC connectivity issues' with subsections covering connector status problems, public IP/DNS configuration errors, AZ support issues, and connection timeout guidance
Security assessment
The changes focus on operational troubleshooting for VPC_LATTICE connectivity rather than addressing security vulnerabilities. While some sections mention security-adjacent concepts like DNS vs IP usage, there's no evidence of patching vulnerabilities or documenting security features. Connection timeout guidance relates to service limits rather than security controls.
Diff
diff --git a/transfer/latest/userguide/connector-troubleshooting.md b/transfer/latest/userguide/connector-troubleshooting.md index aa98599af..70b16d941 100644 --- a//transfer/latest/userguide/connector-troubleshooting.md +++ b//transfer/latest/userguide/connector-troubleshooting.md @@ -5 +5 @@ -Troubleshoot adding trusted host keys for your SFTP connectorKey negotiation failsSFTP connector throttlingOptimizing SFTP connector performanceMiscellaneous SFTP connector issues +Troubleshoot adding trusted host keys for your SFTP connectorKey negotiation failsSFTP connector throttlingOptimizing SFTP connector performanceTroubleshoot VPC connectivity issuesMiscellaneous SFTP connector issues @@ -20,0 +21,2 @@ This section describes possible solutions for issues with SFTP connectors. + * Troubleshoot VPC connectivity issues + @@ -139,0 +142,123 @@ To optimize SFTP connector performance: +## Troubleshoot VPC connectivity issues + +This section describes solutions for common issues with VPC_LATTICE-enabled SFTP connectors. + +### Connector stuck in PENDING status + +Description + +Your VPC_LATTICE-enabled SFTP connector remains in `PENDING` status for an extended period (more than 10 minutes). + +Cause + +This can occur due to DNS resolution delays, Resource Gateway configuration issues, or VPC Lattice service network association problems. + +Solution + +Contact AWS Support at [Contact AWS](https://aws.amazon.com/contact-us).to help analyze the root cause of the issue. You can also try the following work-around. + + 1. Verify that your Resource Gateway is in `ACTIVE` status: + + aws vpc-lattice get-resource-gateway --resource-gateway-identifier rgw-1234567890abcdef0 + + 2. Check that your Resource Configuration is properly configured and active: + + aws vpc-lattice get-resource-configuration --resource-configuration-identifier rcfg-1234567890abcdef0 + + 3. Ensure your Resource Gateway has subnets in at least two Availability Zones that support VPC Lattice. + + 4. If the issue persists, delete and recreate the connector with the same configuration. + + + + +### Connector in ERRORED status + +Description + +Your VPC_LATTICE-enabled SFTP connector shows `ERRORED` status with error details. + +Cause + +Common causes include invalid Resource Configuration ARN, insufficient IP addresses in VPC subnets, or cross-region resource sharing attempts. + +Solution + + 1. Check the error details using `describe-connector`: + + aws transfer describe-connector --connector-id c-1234567890abcdef0 + + 2. Verify the Resource Configuration ARN is correct and in the same region as your connector. + + 3. Ensure your VPC subnets have sufficient available IP addresses for the Resource Gateway. + + 4. Check that your Resource Configuration target (IP address or DNS name) is reachable from your VPC. + + + + +### Public IP address not supported error + +Description + +You receive an error when trying to create a Resource Configuration with a public IP address: `ValidationException: IP address x.x.x.x is not in allowed ranges.` + +Cause + +Resource Configurations for public endpoints must use DNS names, not IP addresses. + +Solution + +Use the public DNS name of your SFTP server instead of its IP address when creating the Resource Configuration: + + + aws vpc-lattice create-resource-configuration \ + --name my-public-server-config \ + --resource-gateway-identifier rgw-1234567890abcdef0 \ + --resource-configuration-definition dnsResource={domainName="my.sftp.server.com"} \ + --port-ranges 22 + +### Availability Zone not supported error + +Description + +You receive an error when creating a Resource Gateway: `Subnet subnet-xxx is not valid because it is not in a supported Availability Zone.` + +Cause + +Not all Availability Zones support VPC Lattice Cross-VPC Resource Access. The error message lists the supported AZs for your region. + +Solution + + 1. Create subnets in the supported Availability Zones listed in the error message. + + 2. Update your Resource Gateway to use subnets from supported AZs only. + + 3. Ensure you have at least two subnets in different supported AZs. + + + + +### Connection timeouts with VPC_LATTICE connectors + +Description + +File transfers through VPC connectors time out or fail intermittently. + +Cause + +VPC Lattice has connection limits (350 connections per resource) and idle timeouts (350 seconds for TCP). + +Solution + + 1. Monitor concurrent connections to stay within the 350 connection limit per resource. + + 2. Implement connection pooling and reuse in your applications. + + 3. Configure appropriate timeout values in your SFTP client applications (less than 350 seconds). + + 4. Consider creating multiple Resource Configurations for the same target to distribute load. + + + + @@ -165 +290 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Workflow issues +Authentication issues @@ -167 +292 @@ Workflow issues -EFS issues +SFTP connectivity issues