AWS Security ChangesHomeSearch

AWS transfer documentation change

Service: transfer · 2025-10-16 · Documentation low

File: transfer/latest/userguide/reference-architectures.md

Summary

Added new section 'VPC reference architectures' with diagrams and guidance for VPC_LATTICE-enabled SFTP connectors in single-account and cross-account configurations

Security assessment

The changes document network architecture patterns that include security controls like centralized security controls, B2B firewalls, and separation of duties between teams. However, there is no evidence of addressing a specific vulnerability.

Diff

diff --git a/transfer/latest/userguide/reference-architectures.md b/transfer/latest/userguide/reference-architectures.md
index bb99a7e57..570501832 100644
--- a//transfer/latest/userguide/reference-architectures.md
+++ b//transfer/latest/userguide/reference-architectures.md
@@ -5 +5 @@
-Blog postsWorkshopsSolutions
+Blog postsWorkshopsSolutionsVPC reference architectures
@@ -36,0 +37,38 @@ AWS Transfer Family provides the following solutions:
+## VPC reference architectures
+
+The following reference architectures show common patterns for deploying VPC_LATTICE-enabled SFTP connectors. These examples help you understand where VPC Lattice resources need to be created in your overall AWS architecture.
+
+### Single account with shared egress infrastructure
+
+In this architecture, the egress infrastructure (NAT Gateway, VPN tunnel, or Direct Connect) is configured in a VPC within the same account as your SFTP connectors. All connectors can share the same Resource Gateway and NAT Gateway.
+
+![Architecture diagram showing VPC_LATTICE-enabled SFTP connectors in a single account with shared egress infrastructure including NAT Gateway, Resource Gateway, and VPC Lattice components.](/images/transfer/latest/userguide/images/vpc-customer-architecture-1.png)
+
+This pattern is ideal when:
+
+  * All SFTP connectors are managed within a single AWS account
+
+  * Egress infrastructure is setup in a VPC within the same account as your SFTP connectors
+
+
+
+
+### Cross-account with centralized egress infrastructure
+
+In this architecture, the egress infrastructure (NAT Gateway, VPN tunnel, Direct Connect, or B2B Firewalls) is configured in a central Egress account managed by the networking team. SFTP connectors are created in the MFT Application account managed by the MFT admin team. Cross-account networking is established using Transit Gateway to honor existing networking rules.
+
+![Architecture diagram showing VPC_LATTICE-enabled SFTP connectors in a cross-account setup with centralized egress infrastructure managed by a separate networking team account.](/images/transfer/latest/userguide/images/vpc-customer-architecture-2.png)
+
+This pattern is ideal when:
+
+  * Network infrastructure is managed by a separate team in a dedicated account
+
+  * You have existing routes (such as AWS Transit Gateway ) between the account where SFTP connectors are created and the account where Egress infrastructure is setup. SFTP connectors will be able to leverage your existing routes connecting the two accounts.
+
+  * Centralized security controls and B2B firewalls are required
+
+  * You need to maintain separation of duties between networking and application teams
+
+
+
+