AWS transfer documentation change
Summary
Added new section 'VPC reference architectures' with diagrams and guidance for VPC_LATTICE-enabled SFTP connectors in single-account and cross-account configurations
Security assessment
The changes document network architecture patterns that include security controls like centralized security controls, B2B firewalls, and separation of duties between teams. However, there is no evidence of addressing a specific vulnerability.
Diff
diff --git a/transfer/latest/userguide/reference-architectures.md b/transfer/latest/userguide/reference-architectures.md index bb99a7e57..570501832 100644 --- a//transfer/latest/userguide/reference-architectures.md +++ b//transfer/latest/userguide/reference-architectures.md @@ -5 +5 @@ -Blog postsWorkshopsSolutions +Blog postsWorkshopsSolutionsVPC reference architectures @@ -36,0 +37,38 @@ AWS Transfer Family provides the following solutions: +## VPC reference architectures + +The following reference architectures show common patterns for deploying VPC_LATTICE-enabled SFTP connectors. These examples help you understand where VPC Lattice resources need to be created in your overall AWS architecture. + +### Single account with shared egress infrastructure + +In this architecture, the egress infrastructure (NAT Gateway, VPN tunnel, or Direct Connect) is configured in a VPC within the same account as your SFTP connectors. All connectors can share the same Resource Gateway and NAT Gateway. + + + +This pattern is ideal when: + + * All SFTP connectors are managed within a single AWS account + + * Egress infrastructure is setup in a VPC within the same account as your SFTP connectors + + + + +### Cross-account with centralized egress infrastructure + +In this architecture, the egress infrastructure (NAT Gateway, VPN tunnel, Direct Connect, or B2B Firewalls) is configured in a central Egress account managed by the networking team. SFTP connectors are created in the MFT Application account managed by the MFT admin team. Cross-account networking is established using Transit Gateway to honor existing networking rules. + + + +This pattern is ideal when: + + * Network infrastructure is managed by a separate team in a dedicated account + + * You have existing routes (such as AWS Transit Gateway ) between the account where SFTP connectors are created and the account where Egress infrastructure is setup. SFTP connectors will be able to leverage your existing routes connecting the two accounts. + + * Centralized security controls and B2B firewalls are required + + * You need to maintain separation of duties between networking and application teams + + + +