AWS transfer documentation change
Summary
Added documentation for VPC egress type connectors using VPC Lattice, including configuration steps for Resource Gateways and Resource Configurations. Updated connector creation steps with egress type selection and CLI examples.
Security assessment
The changes document security-related network controls (VPC routing, private endpoint connectivity, NAT gateway usage) but do not address a specific security vulnerability. The VPC egress option provides security controls for traffic routing but is presented as a feature enhancement rather than a vulnerability fix.
Diff
diff --git a/transfer/latest/userguide/sftp-connectors-tutorial.md b/transfer/latest/userguide/sftp-connectors-tutorial.md index 19762ef94..8e224ccc1 100644 --- a//transfer/latest/userguide/sftp-connectors-tutorial.md +++ b//transfer/latest/userguide/sftp-connectors-tutorial.md @@ -5 +5 @@ -Step 1: Create the necessary supporting resourcesStep 2: Create and test an SFTP connectorStep 3: Send and retrieve files using the SFTP connectorProcedures to create a Transfer Family server to use as your remote SFTP server +Connector egress typesStep 1: Create the necessary supporting resourcesStep 2: Create and test an SFTP connectorStep 3: Send and retrieve files using the SFTP connectorProcedures to create a Transfer Family server to use as your remote SFTP server @@ -11 +11 @@ The purpose of a connector is to establish a relationship between your AWS stora -This tutorial illustrates how to set up an SFTP connector, and then transfer files between Amazon S3 storage and an SFTP server. +This tutorial illustrates how to set up an SFTP connector with both service managed and VPC_LATTICE egress types, and then transfer files between Amazon S3 storage and an SFTP server. @@ -13 +13 @@ This tutorial illustrates how to set up an SFTP connector, and then transfer fil -An SFTP connector retrieves SFTP credentials from AWS Secrets Manager to authenticate into a remote SFTP server and establish a connection. The connector sends files to or retrieves files from the remote server, and stores the files in Amazon S3. An IAM role is used to allow access to the Amazon S3 bucket and to the credentials stored in Secrets Manager. And you can log to Amazon CloudWatch. +An SFTP connector retrieves SFTP credentials from AWS Secrets Manager to authenticate into a remote SFTP server and establish a connection. The connector sends files to or retrieves files from the remote server, and stores the files in Amazon S3. You can choose between service managed egress (using AWS managed infrastructure) or VPC egress (routing through your VPC using Cross-VPC Resource Access). An IAM role is used to allow access to the Amazon S3 bucket and to the credentials stored in Secrets Manager. And you can log to Amazon CloudWatch. @@ -18,0 +19,24 @@ The following blog post provides a reference architecture to build an MFT workfl +## Connector egress types + +SFTP connectors support two egress types that determine how your connector routes traffic to remote SFTP servers: + + * **SERVICE_MANAGED** (default): Uses AWS Transfer Family managed infrastructure with static IP addresses for outbound connections. + + * **VPC** : Routes traffic through your VPC using Cross-VPC Resource Access, enabling private endpoint connectivity and use of your own NAT gateways. + + + + +This tutorial covers both egress types. Choose VPC egress type when you need to: + + * Connect to private SFTP servers in your VPC (private IP addresses) + + * Connect to on-premises SFTP servers via Direct Connect or VPN + + * Route public endpoint traffic through your VPC for security controls + + * Use your own Elastic IP addresses for outbound connections + + + + @@ -46,0 +71,11 @@ You can use SFTP connectors to copy files between Amazon S3 and any remote SFTP +For VPC egress type connectors, you also need: + + * A VPC with appropriate subnets and security groups + + * A Resource Gateway (minimum 2 Availability Zones required): Create a Resource Gateway (VPC egress type only). + + * A Resource Configuration pointing to your SFTP server: Create a Resource Configuration (VPC egress type only). For more information, see [Resource configurations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/resource-configuration.html) in the _Amazon VPC Lattice User Guide_. + + + + @@ -68 +103,5 @@ For the access role, create a policy with the following permissions. -The following example grants the necessary permissions to access the `amzn-s3-demo-bucket` in Amazon S3, and the specified secret stored in Secrets Manager. +JSON + + +**** + @@ -105 +144 @@ The following example grants the necessary permissions to access the `amzn-s3-de - "Resource": "arn:aws:secretsmanager:region:account-id:secret:aws/transfer/SecretName-6RandomCharacters" + "Resource": "arn:aws:secretsmanager:us-west-2:111122223333:secret:aws/transfer/SecretName-6RandomCharacters" @@ -163 +203 @@ This outputs the key in the correct format (with embedded newline characters) to - * **Key** – Enter `Username`. + * **Key** — Enter `Username`. @@ -165 +205 @@ This outputs the key in the correct format (with embedded newline characters) to - * **value** – Enter the name of our user, `sftp-testuser`. + * **value** — Enter the name of our user, `sftp-testuser`. @@ -191,0 +232,55 @@ Your screen should look as follows (key data is grayed out). +### Create a Resource Gateway (VPC egress type only) + +For VPC egress type connectors, you need to create a Resource Gateway in your VPC. The Resource Gateway serves as the entry point for Cross-VPC Resource Access. + +###### To create a Resource Gateway + + 1. Run the following command to create a Resource Gateway (replace the VPC ID and subnet IDs with your values): + + aws vpc-lattice create-resource-gateway \ + --name my-sftp-resource-gateway \ + --vpc-identifier vpc-12345678 \ + --subnet-ids subnet-12345678 subnet-87654321 + +###### Note + +Resource Gateways require subnets in at least 2 Availability Zones. + + 2. Note the Resource Gateway ID from the response for use in the next step. + + + + +### Create a Resource Configuration (VPC egress type only) + +Create a Resource Configuration that points to your SFTP server. This can be a private IP address for servers in your VPC, or a public DNS name for external servers. For more information about Resource Configurations, see [Resource configurations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/resource-configuration.html) in the _Amazon VPC Lattice User Guide_. + +###### To create a Resource Configuration + + 1. For a private SFTP server, run: + + aws vpc-lattice create-resource-configuration \ + --name my-sftp-resource-config \ + --port-ranges 22 \ + --type SINGLE \ + --resource-gateway-identifier rgw-12345678 \ + --resource-configuration-definition ipResource={ipAddress="10.0.1.100"} + + 2. For a public SFTP server (DNS name only), run: + + aws vpc-lattice create-resource-configuration \ + --name my-public-sftp-resource-config \ + --port-ranges 22 \ + --type SINGLE \ + --resource-gateway-identifier rgw-12345678 \ + --resource-configuration-definition dnsResource={domainName="sftp.example.com"} + +###### Note + +Public endpoints must use DNS names, not IP addresses. + + 3. Note the Resource Configuration ARN from the response for use when creating the connector. + + + + @@ -202 +297,11 @@ In this section, we create an SFTP connector that uses all of the resources that - 3. In the **Connector configuration** section, provide the following information: + 3. For **Egress type** , choose one of the following: + + * **Service managed** (default): Uses AWS Transfer Family managed infrastructure with static IP addresses for outbound connections. + + * **VPC Lattice** : Routes traffic through your VPC using Cross-VPC Resource Access. Choose this option for private endpoint connectivity or to use your own NAT gateways. + +###### Important + +You cannot change the egress type after creating the connector. Choose carefully based on your connectivity requirements. + + 4. In the **Connector configuration** section, provide the following information: @@ -211,0 +317,4 @@ Replace `1111aaaa2222bbbb3` with your Transfer Family server ID. + * For **Resource Configuration ARN** (VPC Lattice egress type only), enter the ARN of the Resource Configuration you created earlier: + + arn:aws:vpc-lattice:us-east-1:account-id:resourceconfiguration/rcfg-12345678 + @@ -218 +327 @@ Replace `1111aaaa2222bbbb3` with your Transfer Family server ID. - 4. In the **SFTP Configuration** section, provide the following information: + 5. In the **SFTP Configuration** section, provide the following information: @@ -228 +337,21 @@ Replace `1111aaaa2222bbbb3` with your Transfer Family server ID. - 5. After you have confirmed all of your settings, choose **Create connector** to create the SFTP connector. + 6. After you have confirmed all of your settings, choose **Create connector** to create the SFTP connector. + + + + +You can also create connectors using the AWS Command Line Interface. + + * To create an SFTP connector with service-managed egress run the following command: + + aws transfer create-connector \ + --url "sftp://s-1111aaaa2222bbbb3.server.transfer.us-east-1.amazonaws.com" \ + --access-role "arn:aws::iam::account-id:role/sftp-connector-role" \ + --sftp-config UserSecretId="aws/transfer/sftp-connector1",TrustedHostKeys="ssh-rsa AAAAB3NzaC..." + + * To create an SFTP connector with VPC-based egress run the following command: + + aws transfer create-connector \ + --url "sftp://my.sftp.server.com:22" \ + --access-role "arn:aws::iam::account-id:role/sftp-connector-role" \ + --sftp-config UserSecretId="aws/transfer/sftp-connector1",TrustedHostKeys="ssh-rsa AAAAB3NzaC..." \ + --egress-config VpcLattice={ResourceConfigurationArn="arn:aws:vpc-lattice:us-east-1:account-id:resourceconfiguration/rcfg-12345678",PortNumber=22} @@ -234,0 +364,4 @@ After you create an SFTP connector, we recommend that you test it before you att +###### Note + +For VPC egress type connectors, DNS resolution may take several minutes after creation. During this time, the connector status will be `PENDING` and `TestConnection` will return "Connector not available". Wait for the status to become `ACTIVE` before attempting file transfers. + @@ -280,0 +414,24 @@ If the test is unsuccessful, you receive a descriptive error message, for exampl +When you describe a VPC egress type connector, the response includes the new fields: + + + { + "Connector": { + "AccessRole": "arn:aws:iam::219573224423:role/sftp-connector-role", + "Arn": "arn:aws:transfer:us-east-1:219573224423:connector/c-5dfa309ccabf40759", + "ConnectorId": "c-5dfa309ccabf40759", + "Status": "ACTIVE", + "EgressConfig": { + "ResourceConfigurationArn": "arn:aws:vpc-lattice:us-east-1:025066256552:resourceconfiguration/rcfg-079259b27a357a190" + }, + "EgressType": "VPC", + "ServiceManagedEgressIpAddresses": null, + "SftpConfig": { + "TrustedHostKeys": [ "ssh-rsa AAAAB3NzaC..." ], + "UserSecretId": "aws/transfer/sftp-connector1" + }, + "Url": "sftp://my.sftp.server.com:22" + } + } + +Note that `ServiceManagedEgressIpAddresses` is null for VPC egress type connectors since traffic routes through your VPC instead of AWS managed infrastructure. + @@ -375,0 +533,30 @@ If successful, the log entry looks like the following: +### Troubleshooting VPC egress type connectors + +If you're experiencing issues with VPC egress type connectors, check the following: