AWS transfer documentation change
Summary
Enhanced AS2 protocol documentation with details about CMS encryption, Drummond certification, partner setup requirements, and clarified TLS termination responsibility
Security assessment
The changes add explicit details about security mechanisms (CMS encryption, digital signatures, MDN verification) and compliance certifications. While the TLS termination note clarifies security responsibilities, this is a documentation clarification rather than evidence of addressing a specific vulnerability.
Diff
diff --git a/transfer/latest/userguide/as2-for-transfer-family.md b/transfer/latest/userguide/as2-for-transfer-family.md index 310e15a1a..0ec3c94ef 100644 --- a//transfer/latest/userguide/as2-for-transfer-family.md +++ b//transfer/latest/userguide/as2-for-transfer-family.md @@ -9 +9 @@ AS2 use casesAS2 CloudFormation templates -Applicability Statement 2 (AS2) is an RFC-defined file-transmission specification that includes strong message protection and verification mechanisms. The AS2 protocol is critical to workflows with compliance requirements that rely on having data protection and security features built into the protocol. +Applicability Statement 2 (AS2) is an RFC-defined file-transmission specification that includes strong message protection and verification mechanisms. Protecting an AS2 payload in transit uses Cryptographic Message Syntax (CMS) with encryption and digital signatures to provide data protection and peer authentication. A signed Message Disposition Notice (MDN) response payload provides verification (non-repudiation) that a message was received and successfully decrypted. @@ -11 +11 @@ Applicability Statement 2 (AS2) is an RFC-defined file-transmission specificatio -###### Note +The AS2 protocol is critical for workflows with compliance requirements that rely on having data protection and security features built into the protocol. AWS Transfer Family AS2 endpoints are [Drummond certified](https://aws.amazon.com/about-aws/whats-new/2023/06/aws-transfer-family-drummond-group-as2-certification/), enabling customers in industries such as retail, life sciences, manufacturing, financial services, and utilities to securely transact with their business partners. @@ -13 +13 @@ Applicability Statement 2 (AS2) is an RFC-defined file-transmission specificatio -AS2 for Transfer Family is [Drummond certified](https://aws.amazon.com/about-aws/whats-new/2023/06/aws-transfer-family-drummond-group-as2-certification/). +When you use AS2 with Transfer Family, the transacted data is natively accessible in AWS for: @@ -15 +15 @@ AS2 for Transfer Family is [Drummond certified](https://aws.amazon.com/about-aws -Customers in industries such as retail, life sciences, manufacturing, financial services, and utilities that rely on AS2 for supply chain, logistics, and payments workflows can use AWS Transfer Family AS2 endpoints to securely transact with their business partners. The transacted data is natively accessible in AWS for processing, analysis, and machine learning. This data is also available for integrations with enterprise resource planning (ERP) and customer relationship management (CRM) systems that run on AWS. With AS2, customers can run their business-to-business (B2B) transactions at scale in AWS while maintaining existing business partner integrations and compliance. + * Processing, analysis, and machine learning @@ -17 +17 @@ Customers in industries such as retail, life sciences, manufacturing, financial -If you are a Transfer Family customer who wants to exchange files with a partner who has an AS2-enabled server, the setup involves generating one public-private key pair for encryption and another for signing and exchanging the public keys with the partner. + * Integration with enterprise resource planning (ERP) systems @@ -19 +19 @@ If you are a Transfer Family customer who wants to exchange files with a partner -Transfer Family provides a workshop that you can attend, in which you can configure a Transfer Family endpoint with AS2 enabled, and a Transfer Family AS2 connector. You can view the details for this workshop [here](https://catalog.workshops.aws/transfer-family-as2/en-US). + * Integration with customer relationship management (CRM) systems @@ -21 +20,0 @@ Transfer Family provides a workshop that you can attend, in which you can config -Protecting an AS2 payload in transit typically involves the use of Cryptographic Message Syntax (CMS) and commonly uses encryption and a digital signature to provide data protection and peer authentication. A signed Message Disposition Notice (MDN) response payload provides verification (non-repudiation) that a message was received and successfully decrypted. @@ -23 +21,0 @@ Protecting an AS2 payload in transit typically involves the use of Cryptographic -Transport of these CMS payloads and MDN responses occurs over HTTP. @@ -25 +22,0 @@ Transport of these CMS payloads and MDN responses occurs over HTTP. -###### Note @@ -27 +24,9 @@ Transport of these CMS payloads and MDN responses occurs over HTTP. -HTTPS AS2 server endpoints are not currently supported. TLS termination is currently the responsibility of the customer. +To exchange files with a partner who has an AS2-enabled server, you must: + + * Generate a public-private key pair for encryption + + * Generate a public-private key pair for signing + + * Exchange the public keys with your partner + + @@ -29 +33,0 @@ HTTPS AS2 server endpoints are not currently supported. TLS termination is curre -For a detailed, step-by-step walkthrough of setting up an Applicability Statement 2 (AS2) configuration, see the tutorial, [Setting up an AS2 configuration](./as2-example-tutorial.html). @@ -31 +35,7 @@ For a detailed, step-by-step walkthrough of setting up an Applicability Statemen -The user guide provides instructions for each step in the process of configuring AS2 in Transfer Family. +###### Important + +HTTPS AS2 server endpoints are not currently supported. You are responsible for TLS termination. + +Transfer Family provides a workshop that you can attend, in which you can configure a Transfer Family endpoint with AS2 enabled, and a Transfer Family AS2 connector. You can view the details for this workshop [here](https://catalog.workshops.aws/transfer-family-as2/en-US). + +For step-by-step instructions to configure AS2 in Transfer Family, see the following: @@ -45,0 +56,6 @@ The user guide provides instructions for each step in the process of configuring +For a complete example, see [Setting up an AS2 configuration](./as2-example-tutorial.html). + +###### Note + +To show support for AS2 Terraform templates, add a thumbs up reaction (👍) to the [Transfer Family Terraform templates feature request](https://github.com/aws-ia/terraform-aws-transfer-family/issues/62#issue-3364703944). You can also add a comment describing your use case. +