CloudWatch log structure for Transfer Family
This topic describes the fields that are populated in Transfer Family logs: both for JSON structured log entries and legacy log entries.
JSON structured logs for Transfer Family
The following table contains details for log entry fields for Transfer Family SFTP/FTP/FTPS actions, in the new JSON structured log format.
| Field | Description | Example entry |
|---|---|---|
| activity-type | The action by the user |
OPEN | CLOSE | PARTIAL_CLOSE | DISCONNECTED | CONNECTED |
| bytes-in | Number of bytes uploaded by the user | 29238420042 |
| bytes-out | Number of bytes downloaded by the user | 23094032490328 |
| ciphers | Specifies the SSH cipher negotiated for the connection (available ciphers are listed in Cryptographic algorithms) | aes256-gcm@openssh.com |
| client | The user's client software | SSH-2.0-OpenSSH_7.4 |
| home-dir | The directory that the end user lands on when they connect to the
endpoint if their home directory type is PATH: if they have a
logical home directory, this value is always / |
/user-home-bucket/test |
| kex | Specifies the negotiated SSH key exchange (KEX) for the connection (available KEX are listed in Cryptographic algorithms) | diffie-hellman-group14-sha256 |
| message | Provides more information related to the error | <string> |
| method | The authentication method | publickey |
| mode | Specifies how a client opens a file | CREATE | TRUNCATE | WRITE |
| operation | The client operation on a file | OPEN | CLOSE |
| path | Actual file path affected | /user-test-bucket/test-file-1.pdf |
| resource-arn | A system-assigned, unique identifier for a specific resource (for example, a server) |
arn:aws-cn:transfer:ap-northeast-1:12346789012:server/s-1234567890akeu2js2 |
| role | The IAM role of the user |
arn:aws-cn:iam::0293883675:role/testuser-role |
| session-id | A system-assigned, unique identifier for a single session |
9ca9a0e1cec6ad9d |
| source-ip | Client IP address | 18.323.0.129 |
| user | The end user's username | myname192 |
| user-policy | The permissions specified for the end user: this field is populated if the user's policy is a session policy. | The JSON code for the session policy that is being used |
Legacy logs for Transfer Family
The following table contains details for log entries for various Transfer Family actions.
Note
These entries are not in the new JSON structured log format.
The following table contains details for log entries for various Transfer Family actions, in the new JSON structured log format.
| Action | Corresponding logs within Amazon CloudWatch Logs |
|---|---|
| Authentication failures |
ERRORS AUTH_FAILURE Method=publickey User=lhr Message="RSA SHA256:Lfz3R2nmLY4raK+b7Rb1rSvUIbAE+a+Hxg0c7l1JIZ0" SourceIP=3.8.172.211 |
| COPY/TAG/DELETE/DECRYPT workflow |
{"type":"StepStarted","details":{"input":{"fileLocation":{"backingStore":"EFS","filesystemId":"fs-12345678","path":"/lhr/regex.py"}},"stepType":"TAG","stepName":"successful_tag_step"},"workflowId":"w-1111aaaa2222bbbb3","executionId":"81234abcd-1234-efgh-5678-ijklmnopqr90","transferDetails":{"serverId":"s-1234abcd5678efghi","username":"lhr","sessionId":"1234567890abcdef0"}} |
| Custom step workflow |
{"type":"CustomStepInvoked","details":{"output":{"token":"MzM4Mjg5YWUtYTEzMy00YjIzLWI3OGMtYzU4OGI2ZjQyMzE5"},"stepType":"CUSTOM","stepName":"efs-s3_copy_2"},"workflowId":"w-9283e49d33297c3f7","executionId":"1234abcd-1234-efgh-5678-ijklmnopqr90","transferDetails":{"serverId":"s-zzzz1111aaaa22223","username":"lhr","sessionId":"1234567890abcdef0"}} |
| Deletes |
lhr.33a8fb495ffb383b DELETE Path=/bucket/user/123.jpg |
| Downloads |
lhr.33a8fb495ffb383b OPEN Path=/bucket/user/123.jpg Mode=READ llhr.33a8fb495ffb383b CLOSE Path=/bucket/user/123.jpg BytesOut=3618546 |
| Logins/Logouts |
user.914984e553bcddb6 CONNECTED SourceIP=1.22.111.222 User=lhr HomeDir=LOGICAL Client=SSH-2.0-OpenSSH_7.4 Role=arn:aws-cn::iam::123456789012:role/sftp-s3-access user.914984e553bcddb6 DISCONNECTED |
| Renames |
lhr.33a8fb495ffb383b RENAME Path=/bucket/user/lambo.png NewPath=/bucket/user/ferrari.png |
| Sample workflow error log |
{"type":"StepErrored","details":{"errorType":"BAD_REQUEST","errorMessage":"Cannot tag Efs file","stepType":"TAG","stepName":"successful_tag_step"},"workflowId":"w-1234abcd5678efghi","executionId":"81234abcd-1234-efgh-5678-ijklmnopqr90","transferDetails":{"serverId":"s-1234abcd5678efghi","username":"lhr","sessionId":"1234567890abcdef0"}} |
| Symlinks |
lhr.eb49cf7b8651e6d5 CREATE_SYMLINK LinkPath=/fs-12345678/lhr/pqr.jpg TargetPath=abc.jpg |
| Uploads |
lhr.33a8fb495ffb383b OPEN Path=/bucket/user/123.jpg Mode=CREATE|TRUNCATE|WRITE lhr.33a8fb495ffb383b CLOSE Path=/bucket/user/123.jpg BytesIn=3618546 |
| Workflows |
{"type":"ExecutionStarted","details":{"input":{"initialFileLocation":{"backingStore":"EFS","filesystemId":"fs-12345678","path":"/lhr/regex.py"}}},"workflowId":"w-1111aaaa2222bbbb3","executionId":"1234abcd-1234-efgh-5678-ijklmnopqr90","transferDetails":{"serverId":"s-zzzz1111aaaa22223","username":"lhr","sessionId":"1234567890abcdef0"}} {"type":"StepStarted","details":{"input":{"fileLocation":{"backingStore":"EFS","filesystemId":"fs-12345678","path":"/lhr/regex.py"}},"stepType":"CUSTOM","stepName":"efs-s3_copy_2"},"workflowId":"w-9283e49d33297c3f7","executionId":"1234abcd-1234-efgh-5678-ijklmnopqr90","transferDetails":{"serverId":"s-18ca49dce5d842e0b","username":"lhr","sessionId":"1234567890abcdef0"}} |