AWS transfer medium security documentation change

Service: transfer · 2025-10-16 · Security-related medium

File: transfer/latest/userguide/track-connector-progress.md

Summary

Added detailed documentation about monitoring VPC egress type connectors including status monitoring, cost tracking, network monitoring through VPC Flow Logs/Lattice access logs, and troubleshooting guidance

Security assessment

The changes add security-focused monitoring documentation including security group monitoring, network traffic pattern analysis, and access logging - all security best practices. Specific security controls mentioned include VPC Flow Logs for traffic monitoring and security group rule validation.

Diff

diff --git a/transfer/latest/userguide/track-connector-progress.md b/transfer/latest/userguide/track-connector-progress.md
index cb59132ef..5de2cd5c6 100644
--- a//transfer/latest/userguide/track-connector-progress.md
+++ b//transfer/latest/userguide/track-connector-progress.md
@@ -5 +5 @@
-Use the connector API to query the status of file transfer requestsView SFTP connector events in Amazon EventBridgeView SFTP connector logs in Amazon CloudWatch
+Use the connector API to query the status of file transfer requestsView SFTP connector events in Amazon EventBridgeView SFTP connector logs in Amazon CloudWatchMonitoring VPC egress type connectors
@@ -31,0 +32,82 @@ All SFTP connector operations generate detailed logs in CloudWatch. For example
+## Monitoring VPC egress type connectors
+
+VPC egress type connectors provide additional monitoring capabilities and considerations beyond standard service managed connectors:
+
+### Connector status monitoring
+
+VPC_LATTICE connectors include additional information to help you monitor the provisioning and operational state:
+
+  * **EgressType field** : Shows `VPC` for VPC_LATTICE egress type connectors
+
+  * **EgressConfig field** : Contains the Resource Configuration ARN and port information
+
+
+
+
+Monitor connector status using the `describe-connector` API:
+    
+    
+    aws transfer describe-connector --connector-id c-1234567890abcdef0
+
+### VPC Lattice cost monitoring
+
+VPC egress type connectors incur additional VPC Lattice charges that you should monitor:
+
+  * **Resource provider charges** : You are billed $0.006/GB for data processing as the resource provider (billed directly by VPC Lattice)
+
+  * **Resource consumer charges** : AWS Transfer Family absorbs the $0.01/GB resource consumer costs (first 1 PB)
+
+  * **NAT Gateway charges** : For public endpoints accessed via VPC, additional NAT Gateway and data transfer charges may apply
+
+  * **Transfer Family charges** : Standard $0.40/GB data processing fees still apply
+
+
+
+
+Monitor VPC Lattice usage and costs through the AWS Cost and Billing console, filtering by the VPC Lattice service.
+
+### Network monitoring for VPC connectors
+
+Monitor network activity and performance for VPC egress type connectors:
+
+  * **VPC Flow Logs** : Enable VPC Flow Logs to monitor network traffic patterns between Resource Gateways and SFTP servers
+
+  * **VPC Lattice access logs** : VPC Lattice provides access logs showing source/destination IP addresses, connection timing, and data transfer volumes
+
+  * **Security group monitoring** : Monitor security group rules and traffic patterns to ensure proper network access controls
+
+  * **DNS resolution monitoring** : Monitor DNS resolution times and failures for service network endpoints
+
+
+
+
+Example VPC Lattice access log entry:
+    
+    
+    {
+      "eventTimestamp": "2025-01-16T20:59:08.531Z",
+      "serviceNetworkArn": "arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-1234567890abcdef0",
+      "sourceVpcArn": "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-12345678",
+      "resourceConfigurationArn": "arn:aws:vpc-lattice:us-east-1:123456789012:resourceconfiguration/rcfg-12345678",
+      "protocol": "tcp",
+      "sourceIpPort": "10.0.1.100:33760",
+      "destinationIpPort": "10.0.2.200:22",
+      "gatewayIpPort": "10.0.1.150:1769",
+      "resourceIpPort": "10.0.2.200:22"
+    }
+
+### Troubleshooting through monitoring
+
+Use monitoring data to troubleshoot common VPC connector issues:
+
+  * **PENDING status** : Monitor DNS resolution progress and wait for ACTIVE status before attempting transfers
+
+  * **Connection timeouts** : Check VPC Flow Logs and security group rules for blocked traffic on port 22
+
+  * **Transfer failures** : Review CloudWatch logs for detailed error messages and VPC Lattice access logs for network-level issues
+
+  * **Performance issues** : Monitor VPC Lattice access logs for connection timing and throughput metrics
+
+
+
+