AWS transfer medium security documentation change
Summary
Restructured web app creation documentation: 1) Separated user assignment into a new guide 2) Added endpoint type selection (public/VPC) 3) Updated step numbering 4) Removed user assignment section 5) Updated next steps
Security assessment
Added explicit documentation for VPC-hosted endpoints (security feature) which provides network isolation. Public endpoints expose services to the internet, creating potential attack surfaces. The documentation now guides users to implement more secure VPC configurations.
Diff
diff --git a/transfer/latest/userguide/webapp-configure.md b/transfer/latest/userguide/webapp-configure.md index 7750ab852..55b21e3ae 100644 --- a//transfer/latest/userguide/webapp-configure.md +++ b//transfer/latest/userguide/webapp-configure.md @@ -5 +5 @@ -Create a Transfer Family web appAssign or add users or groups to Transfer Family web app +Create a Transfer Family web app @@ -9 +9 @@ Create a Transfer Family web appAssign or add users or groups to Transfer Family -This section describes the procedures for creating a Transfer Family web app and then assigning users and groups that can use it. +This section describes the procedures for creating a Transfer Family web app. To assign users and groups that can use it, see [Assign or add users or groups to a Transfer Family web app](./webapp-add-users.html). @@ -39 +39,3 @@ For authentication access, the pane is populated as follows. - 4. In the **Permission type** pane, you can use a previously created role, or have the service create one for you. + 4. For **Endpoint type** , choose the **Publicly accessible** endpoint type. For a **VPC hosted** endpoint, see [Create a Transfer Family web app in a VPC](./create-webapp-in-vpc.html). + + 5. In the **Permission type** pane, you can use a previously created role, or have the service create one for you. @@ -45 +47 @@ For authentication access, the pane is populated as follows. - 5. In the **Web app units** pane, choose a value. One web app unit allows web app activity from up to 250 unique sessions. When creating a web app, you provision how many units you need based on your expected peak workload volumes. Changing your web app units has an impact on your billing. For information about pricing, see [AWS Transfer Family Pricing](https://aws.amazon.com/aws-transfer-family/pricing). + 6. In the **Web app units** pane, choose a value. One web app unit allows web app activity from up to 250 unique sessions. When creating a web app, you provision how many units you need based on your expected peak workload volumes. Changing your web app units has an impact on your billing. For information about pricing, see [AWS Transfer Family Pricing](https://aws.amazon.com/aws-transfer-family/pricing). @@ -47 +49 @@ For authentication access, the pane is populated as follows. - 6. If you are using Transfer Family in an AWS GovCloud (US) Region, you can select the **FIPS Enabled endpoint** checkbox in the **FIPS Enabled** pane. For all other AWS Regions, this option is unavailable. + 7. If you are using Transfer Family in an AWS GovCloud (US) Region, you can select the **FIPS Enabled endpoint** checkbox in the **FIPS Enabled** pane. For all other AWS Regions, this option is unavailable. @@ -49 +51 @@ For authentication access, the pane is populated as follows. - 7. (Optional) Add a tag to help you organize your web apps. We suggest that you add a tag with **Name** as the key and a descriptive name as the value. + 8. (Optional) Add a tag to help you organize your web apps. We suggest that you add a tag with **Name** as the key and a descriptive name as the value. @@ -51 +53 @@ For authentication access, the pane is populated as follows. - 8. Choose **Next**. On this screen, you can optionally provide a title for your web app. If you don't provide a title, the default title of **Transfer Web App** is supplied. You can also upload image files for your logo and favicon. + 9. Choose **Next**. On this screen, you can optionally provide a title for your web app. If you don't provide a title, the default title of **Transfer Web App** is supplied. You can also upload image files for your logo and favicon. @@ -53 +55 @@ For authentication access, the pane is populated as follows. - 9. Choose **Next** , then choose **Create web app**. + 10. Choose **Next** , then choose **Create web app**. @@ -64,52 +65,0 @@ Make sure to set up a Cross-origin resource sharing (CORS) policy for all of the -## Assign or add users or groups to Transfer Family web app - -After you create a Transfer Family web app, you can assign users and groups who can then access the web app. You can either retrieve users that are already created and stored in IAM Identity Center, or you can [add new users directly](https://docs.aws.amazon.com/singlesignon/latest/userguide/addusers.html) (if you're using an IAM Identity Center directory as your identity provider). If you add new users, they are also added to your IAM Identity Center instance. - -Note the following: - - * You can only add new users if you are using the IAM Identity Center directory as your identity source and have the proper permissions. If you are a member of an organization instance, you might not have the necessary permissions to add users. - -###### Note - -If you don't assign users or groups to your application, your users will get an error when they attempt to log into your web app. - - * If you create a new user, you must also create an S3 access grant for this user so that they can access data on your web app. - - * After you create a new user, that user receives an onboarding email from IAM Identity Center with directions for how to proceed. - - - - -###### To assign users to a Transfer Family web app - - 1. Navigate to your web app list, and choose the one that you want to edit. - - 2. Choose **Assign users and groups**. - - - - 3. To assign users that you previously created in IAM Identity Center, select **Assign existing users and groups**. To create new users, skip ahead to step 4. - - 1. An information screen appears. Choose **Get started** to continue. - - 2. Search for the user. Note that no users appear until you begin entering your search criteria. You must search by the _display name_ , not the _username_ , if different. Only exact matches are returned. If you can't find your user, navigate to the IAM Identity Center management console, find the user, then copy and paste their display name here. - - - - 3. Choose the users and groups to add, then choose **Assign**. - - 4. To create a new user, select **Add and assign new users**. - - 1. An information screen appears. Choose **Get started** to continue. - - 2. Choose **Add new users**. - - 3. Enter the following user details into the dialog box: username, first and last name, and an email address. - - - - 4. Choose **Next** , then choose **Add** to add the user and close the dialog box, or **Add new user** to create another user. - - - - @@ -124 +74 @@ Configure IAM roles -Set up Cross-origin resource sharing (CORS) for your bucket +Create a Transfer Family web app in a VPC