Create an SFTP-enabled server - AWS Transfer Family

Create an SFTP-enabled server

Secure Shell (SSH) File Transfer Protocol (SFTP) is a network protocol used for secure transfer of data over the internet. The protocol supports the full security and authentication functionality of SSH. It is widely used to exchange data, including sensitive information between business partners in a variety of industries such as financial services, healthcare, retail, and advertising.

To create an SFTP-enabled server

  1. Open the AWS Transfer Family console at https://console.aws.amazon.com/transfer/ and choose Create server.

  2. In Choose protocols, select SFTP, and then choose Next.

  3. In Choose an identity provider, choose Service managed to store user identities and keys in AWS Transfer Family, and then choose Next.

    For a Custom identity provider, you provide an API Gateway endpoint and an AWS Identity and Access Management (IAM) role to access the endpoint. By doing so, you can integrate your directory service to authenticate and authorize your users. To learn more about working with custom identity providers, see Working with custom identity providers.

  4. In Choose an endpoint, do the following:

    1. For Endpoint type, choose the Publicly accessible endpoint type. For a VPC hosted endpoint, see Creating a server in a virtual private cloud.

    2. (Optional) For Custom hostname, choose None.

      You get a server hostname provided by AWS Transfer Family. The server hostname takes the form serverId.server.transfer.regionId.amazonaws.com.

      For a custom hostname, you specify a custom alias for your server endpoint. To learn more about working with custom hostnames, see Working with custom hostnames.

    3. (Optional) For FIPS Enabled, select the FIPS Enabled endpoint check box to ensure the endpoint complies with Federal Information Processing Standards (FIPS).

      Note

      FIPS-enabled endpoints are only available in North American AWS Regions. For available regions, see AWS Transfer Family endpoints and quotas in the AWS General Reference. For more information about the available FIPS endpoints, see Federal Information Processing Standard (FIPS) 140-2 .

    4. Choose Next.

  5. In Configure additional details, do the following:

    1. For CloudWatch logging, choose one of the following to enable Amazon CloudWatch logging of your user activity:

      • Create a new role to allow Transfer Family to automatically create the IAM role, as long as you have the right permissions to create a new role. The IAM role that is created is called AWSTransferLoggingAccess.

      • Choose an existing role to choose an existing IAM role from your account. Under Logging role, choose the role. This IAM role should include a trust policy with Service set to transfer.amazonaws.com.

        For more information about CloudWatch logging, see Log activity with CloudWatch.

      Note

      • You can't view end-user activity in CloudWatch if you don't specify a logging role.

      • If you don't want to set up a CloudWatch logging role, choose Choose an existing role, but don't select a logging role.

    2. For Cryptographic algorithm options, choose a security policy that contains the cryptographic algorithms enabled for use by your server.

      Note

      By default:

      • If FIPS Enabled endpoint is not selected, the TransferSecurityPolicy-2020-06 security policy is attached to your server.

      • If FIPS Enabled endpoint is selected, the TransferSecurityPolicy-FIPS-2020-06 security policy is attached to your server.

      For more information about security policies, see Working with security policies.

    3. (Optional) For Server Host Key, enter an RSA private key that will be used to identify your server when clients connect to it over SFTP.

      Note

      This section is only for migrating users from an existing SFTP-enabled server.

    4. (Optional) For Tags, for Key and Value, enter one or more tags as key-value pairs, and then choose Add tag.

    5. Choose Next.

  6. In Review and create, review your choices. If you:

    • Want to edit any of them, choose Edit next to the step.

      Note

      You will need to review each step after the step you chose to edit.

    • Have no changes, choose Create server to create your server. You are taken to the Servers page, shown following, where your new server is listed.

It can take a couple of minutes before the status for your new server changes to Online. At that point, your server can perform file operations for your users.

Next step

Add a user