Configure SFTP connectors

To create an SFTP connector

1. Open the Amazon Transfer Family console at https://console.amazonaws.cn/transfer/.

2. In the left navigation pane, choose Connectors, then choose Create connector.

3. Choose SFTP for the connector type to create an SFTP connector, and then choose Next.

   

4. In the Connector configuration section, provide the following information:

   • For the URL, enter the URL for a remote SFTP server. This URL must be formatted as sftp://partner-SFTP-server-url, for example sftp://AnyCompany.com.

     Note

     Optionally, you can provide a port number in your URL. The format is sftp://partner-SFTP-server-url:port-number. The default port number (when no port is specified) is port 22.

   • For the Access role, choose the Amazon Resource Name (ARN) of the Amazon Identity and Access Management (IAM) role to use.

     • Make sure that this role provides read and write access to the parent directory of the file location that's used in the StartFileTransfer request.

     • Make sure that this role provides permission for secretsmanager:GetSecretValue to access the secret.

       Note

       In the policy, you must specify the ARN for the secret. The ARN contains the secret name, but appends the name with six, random, alphanumeric characters. An ARN for a secret has the following format.

       arn:aws-cn:secretsmanager:region:account-id:secret:aws/transfer/SecretName-6RandomCharacters

     • Make sure this role contains a trust relationship that allows the connector to access your resources when servicing your users' transfer requests. For details on establishing a trust relationship, see To establish a trust relationship.

     The following example grants the necessary permissions to access the DOC-EXAMPLE-BUCKET in Amazon S3, and the specified secret stored in Secrets Manager.

     {
       "Version": "2012-10-17",
       "Statement": [
         {
             "Sid": "AllowListingOfUserFolder",
             "Action": [
                 "s3:ListBucket",
                 "s3:GetBucketLocation"
             ],
             "Effect": "Allow",
             "Resource": [
                 "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET"
             ]
         },
         {
             "Sid": "HomeDirObjectAccess",
             "Effect": "Allow",
             "Action": [
                 "s3:PutObject",
                 "s3:GetObject",
                 "s3:DeleteObject",
                 "s3:DeleteObjectVersion",
                 "s3:GetObjectVersion",
                 "s3:GetObjectACL",
                 "s3:PutObjectACL"
             ],
             "Resource": "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*"
         },
         {
             "Sid": "GetConnectorSecretValue",
             "Effect": "Allow",
             "Action": [
                 "secretsmanager:GetSecretValue"
             ],
             "Resource": "arn:aws-cn:secretsmanager:region:account-id:secret:aws/transfer/SecretName-6RandomCharacters"
         }
       ]
     }

     Note

     For the access role, the example grants access to a single secret. However, you can use a wildcard character, which can save work if you want to reuse the same IAM role for multiple users and secrets. For example, the following resource statement grants permissions for all secrets that have names beginning with aws/transfer.

     "Resource": "arn:aws-cn:secretsmanager:region:account-id:secret:aws/transfer/*"

     You can also store secrets containing your SFTP credentials in another Amazon Web Services account. For details on enabling cross-account secret access, see Permissions to Amazon Secrets Manager secrets for users in a different account.

   • (Optional) For the Logging role, choose the IAM role for the connector to use to push events to your CloudWatch logs. The following example policy lists the necessary permissions to log events for SFTP connectors.

     {
         "Version": "2012-10-17",
         "Statement": [{
             "Sid": "SFTPConnectorPermissions",
             "Effect": "Allow",
             "Action": [
                 "logs:CreateLogStream",
                 "logs:DescribeLogStreams",
                 "logs:CreateLogGroup",
                 "logs:PutLogEvents"
             ],
             "Resource": [
                 "arn:aws:logs:*:*:log-group:/aws/transfer/*"
             ]
         }]
     }

5. In the SFTP Configuration section, provide the following information:

   • For Connector credentials, from the dropdown list, choose the name of a secret in Amazon Secrets Manager that contains the SFTP user's private key or password. You must create a secret and store it in a specific manner. For details, see Store a secret for use with an SFTP connector.

   • For Trusted host keys, paste in the public portion of the host key that is used to identify the external server. You can add more than one key, by choosing Add trusted host key to add an additional key. You can use the ssh-keyscan command against the SFTP server to retrieve the necessary key. For details about the format and type of trusted host keys that Transfer Family supports, see SFTPConnectorConfig.

6. In the Cryptographic algorithm options section, choose a Security policy from the dropdown list in the Security Policy field. The security policy enables you to select the cryptographic algorithms that your connector supports. For details on the available security policies and algorithms, see Security policies for Amazon Transfer Family SFTP connectors.

7. (Optional) In the Tags section, for Key and Value, enter one or more tags as key-value pairs.

8. After you have confirmed all of your settings, choose Create connector to create the SFTP connector. If the connector is created successfully, a screen appears with a list of the assigned static IP addresses and a Test connection button. Use the button to test the configuration for your new connector.