Monitoring Transfer Family usage
You can monitor activity in your server using Amazon CloudWatch and AWS CloudTrail. For further analysis, you can also record server activity as readable, near real-time metrics. To view metrics that are specific to Transfer Family servers that have the AS2 protocol enabled, see Monitoring AS2 usage.
Topics
Enable AWS CloudTrail logging
You can monitor AWS Transfer Family API calls using AWS CloudTrail. By monitoring API calls, you can get useful security and operational information. For more information about how to work with CloudTrail and AWS Transfer Family, see Logging and monitoring in AWS Transfer Family.
If you have Amazon S3 object level
logging enabled, RoleSessionName
is contained in
the Requester field as [AWS:Role Unique
Identifier]/username.sessionid@server-id
. For more information about
AWS Identity and Access Management (IAM) role unique identifiers, see Unique
identifiers in the AWS Identity and Access Management User Guide.
The maximum length of the RoleSessionName
is 64 characters. If the
RoleSessionName
is longer, the
gets truncated.server-id
Creating Amazon CloudWatch alarms
The following example shows how to create Amazon CloudWatch alarms using the AWS Transfer Family metric, FilesIn
.
Logging Amazon S3 API calls to S3 access logs
If you are using Amazon S3
access logs to identify S3 requests made on behalf of your file transfer
users, RoleSessionName
is used to display which IAM role was assumed to
service the file transfers. It also displays additional information such as the user
name, session id, and server-id used for the transfers. The format is [AWS:Role
Unique Identifier]/username.sessionid@server-id
and is contained in the
Requester field. For example, the following are the contents for a sample Requester field from an S3 access log for a file that was copied to the S3 bucket.
arn:aws:sts::AWS-Account-ID:assumed-role/IamRoleName/username.sessionid@server-id
In the Requester field above, it shows the IAM Role called IamRoleName
. For more information about IAM role unique identifiers,
see Unique
identifiers in the AWS Identity and Access Management User Guide.
Log activity with CloudWatch
To set access, you create a resource-based IAM policy and an IAM role that provides that access information.
To enable Amazon CloudWatch logging, you start by creating an IAM policy that enables CloudWatch logging. You then create an IAM role and attach the policy to it. You can do this when you are creating a server or by editing an existing server. For more information about CloudWatch, see What Is Amazon CloudWatch? and What is Amazon CloudWatch Logs? in the Amazon CloudWatch User Guide.
To create an IAM policy
-
Use the following example policy to create your own IAM policy that allows CloudWatch logging. For information about how to create a policy for AWS Transfer Family, see Create an IAM role and policy.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:CreateLogGroup", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/transfer/*" } ] }
You then create a role and attach the CloudWatch Logs policy that you created.
To create an IAM role and attach a policy
-
In the navigation pane, choose Roles, and then choose Create role.
On the Create role page, make sure that AWS service is chosen.
-
Choose Transfer from the service list, and then choose Next: Permissions. This establishes a trust relationship between AWS Transfer Family and the IAM role. Additionally, add
aws:SourceAccount
andaws:SourceArn
condition keys to protect yourself against the confused deputy problem. See the following documentation for more details:-
Procedure for establishing a trust relationship with AWS Transfer Family: To establish a trust relationship
-
Description for confused deputy problem: the confused deputy problem
-
-
In the Attach permissions policies section, locate and choose the CloudWatch Logs policy that you just created, and choose Next: Tags.
-
(Optional) Enter a key and value for a tag, and choose Next: Review.
-
On the Review page, enter a name and description for your new role, and then choose Create role.
-
To view the logs, choose the Server ID to open the server configuration page, and choose View logs. You are redirected to the CloudWatch console where you can see your log streams.
On the CloudWatch page for your server, you can see records of user authentication (success
and failure), data uploads (PUT
operations), and data downloads
(GET
operations).
Examples to limit confused deputy problem
The confused deputy problem is a security issue where an entity that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action. In AWS, cross-service impersonation can result in the confused deputy problem. For more details, see Cross-service confused deputy prevention.
In the following examples, replace each user input placeholder
with your own information.
The following example logging/invocation policy allows any server in the account to assume the role.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllServers", "Effect": "Allow", "Principal": { "Service": "transfer.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "
account-id
" }, "ArnLike": { "aws:SourceArn": "arn:aws:transfer:region
:account-id
:server/*" } } } ] }
The following example logging/invocation policy allows a specific server to assume the role.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSpecificServer", "Effect": "Allow", "Principal": { "Service": "transfer.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "
account-id
" }, "ArnEquals": { "aws:SourceArn": "arn:aws:transfer:region
:account-id
:server/server-id
" } } } ] }
Example CloudWatch log entries
This section provides some example log entries for Transfer Family.
To view your Transfer Family server logs
-
Navigate to the details page for a server.
-
Choose View logs. This opens Amazon CloudWatch.
-
The log group for your selected server is displayed.
-
You can select a log stream to display details and individual entries for the stream.
-
If there is a listing for ERRORS, you can choose it to view details for the latest errors for the server.
-
Choose any other entry to see an example log stream.
-
If your server has a managed workflow associated with it, you can view logs for the workflow runs.
Note The format for the log stream for the workflow is
. For example, decrypt-user.w-a1111222233334444.aaaa1111bbbb2222 could be the name of a log stream for userusername
.workflowID
.uniqueStreamSuffix
decrypt-user
and workfloww-a1111222233334444
.
-
For any expanded log entry, you can copy the entry to the clipboard by choosing Copy. For more details about CloudWatch logs, see Viewing log data.
Using CloudWatch metrics for Transfer Family
You can also get metrics for Transfer Family from within the Transfer Family console itself. For details, see Monitoring usage in the console
You can get information about your server using CloudWatch metrics. A metric represents a time-ordered set of data points that are published to CloudWatch. When using metrics, you must specify the Transfer Family namespace, metric name, and dimension. For more information about metrics, see Metrics in the Amazon CloudWatch User Guide.
The following table describes the CloudWatch metrics for Transfer Family.
Namespace | Metric | Description |
---|---|---|
|
|
The total number of bytes transferred into the server. Units: Count Period: 5 minutes |
|
The total number of bytes transferred out of the server. Unit: Count Period: 5 minutes |
|
|
The total number of files transferred into the server. For servers using the AS2 protocol, this metric represents the number of messages received. Units: Count Period: 5 minutes |
|
|
The total number of files transferred out of the server. Units: Count Period: 5 minutes |
|
|
The total number of AS2 messages successfully received from a trading partner. Units: Count Period: 5 minutes |
|
|
The total number of AS2 messages that were unsuccessfully received from a trading partner. That is, a trading partner sent a message, but the Transfer Family server was not able to successfully process it. Units: Count Period: 5 minutes |
|
|
The total number of on-partial-upload workflow executions started on the server. Units: Count Period: 1 minute |
|
|
The total number of successful, on-partial-upload workflow executions on the server. Units: Count Period: 1 minute |
|
|
The total number of unsuccessful, on-partial-upload workflow executions on the server. Units: Count Period: 1 minute |
|
|
The total number of workflow executions started on the server. Units: Count Period: 1 minute |
|
|
The total number of successful workflow executions on the server. Units: Count Period: 1 minute |
|
|
The total number of unsuccessful workflow executions on the server. Units: Count Period: 1 minute |
Transfer Family dimensions
A dimension is a name/value pair that is part of the identity of a metric. For more information about dimensions, see Dimensions in the Amazon CloudWatch User Guide.
The following table describes the CloudWatch dimension for Transfer Family.
Dimension | Description |
---|---|
|
The unique ID of the server. |