AWS::Transfer::Connector

Creates the connector, which captures the parameters for a connection for the AS2 or SFTP protocol. For AS2, the connector is required for sending files to an externally hosted AS2 server. For SFTP, the connector is required when sending files to an SFTP server or receiving files from an SFTP server. For more details about connectors, see Configure AS2 connectors and Create SFTP connectors.

Note

You must specify exactly one configuration object: either for AS2 (As2Config) or SFTP (SftpConfig).

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::Transfer::Connector",
  "Properties" : {
      "AccessRole" : String,
      "As2Config" : As2Config,
      "LoggingRole" : String,
      "SecurityPolicyName" : String,
      "SftpConfig" : SftpConfig,
      "Tags" : [ Tag, ... ],
      "Url" : String
    }
}

YAML

Type: AWS::Transfer::Connector
Properties:
  AccessRole: String
  As2Config: 
    As2Config
  LoggingRole: String
  SecurityPolicyName: String
  SftpConfig: 
    SftpConfig
  Tags: 
    - Tag
  Url: String

Properties

AccessRole

Connectors are used to send files using either the AS2 or SFTP protocol. For the access role, provide the Amazon Resource Name (ARN) of the AWS Identity and Access Management role to use.

For AS2 connectors

With AS2, you can send files by calling StartFileTransfer and specifying the file paths in the request parameter, SendFilePaths. We use the file’s parent directory (for example, for --send-file-paths /bucket/dir/file.txt, parent directory is /bucket/dir/) to temporarily store a processed AS2 message file, store the MDN when we receive them from the partner, and write a final JSON file containing relevant metadata of the transmission. So, the AccessRole needs to provide read and write access to the parent directory of the file location used in the StartFileTransfer request. Additionally, you need to provide read and write access to the parent directory of the files that you intend to send with StartFileTransfer.

If you are using Basic authentication for your AS2 connector, the access role requires the secretsmanager:GetSecretValue permission for the secret. If the secret is encrypted using a customer-managed key instead of the AWS managed key in Secrets Manager, then the role also needs the kms:Decrypt permission for that key.

For SFTP connectors

Make sure that the access role provides read and write access to the parent directory of the file location that's used in the StartFileTransfer request. Additionally, make sure that the role provides secretsmanager:GetSecretValue permission to AWS Secrets Manager.

Required: Yes

Type: String

Pattern: arn:.*role/.*

Minimum: 20

Maximum: 2048

Update requires: No interruption

As2Config

A structure that contains the parameters for an AS2 connector object.

Required: No

Type: As2Config

Update requires: No interruption

LoggingRole

The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows a connector to turn on CloudWatch logging for Amazon S3 events. When set, you can view connector activity in your CloudWatch logs.

Required: No

Type: String

Pattern: arn:.*role/.*

Minimum: 20

Maximum: 2048

Update requires: No interruption

SecurityPolicyName

The text name of the security policy for the specified connector.

Required: No

Type: String

Pattern: TransferSFTPConnectorSecurityPolicy-[A-Za-z0-9-]+

Maximum: 50

Update requires: No interruption

SftpConfig

A structure that contains the parameters for an SFTP connector object.

Required: No

Type: SftpConfig

Update requires: No interruption

Tags

Key-value pairs that can be used to group and search for connectors.

Required: No

Type: Array of Tag

Maximum: 50

Update requires: No interruption

Url

The URL of the partner's AS2 or SFTP endpoint.

Required: Yes

Type: String

Maximum: 255

Update requires: No interruption

Return values

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

ConnectorId

The service-assigned ID of the connector that is created.

ServiceManagedEgressIpAddresses

The list of egress IP addresses of this connector. These IP addresses are assigned automatically when you create the connector.