Hello, and welcome to a demo of the AWS Transfer Family for SFTP, FTPS, and FTP.
The AWS Transfer Family provides fully managed support to enable transfer of files
over SFTP, FTPS and FTP into and out of Amazon S3.
The AWS Transfer Family helps you seamlessly migrate your file transfer workloads to AWS
without impacting your end users and application integrations.
And, getting started is easy - there is no infrastructure to buy, setup, or maintain.
Let's take a look into how it works.
AWS Transfer Family provides a fully-managed endpoint for file transfers into and out of S3.
IAM roles are used to grant access to S3 buckets from file transfer clients in a secure way.
Users also have the option to use Route 53 to migrate an existing file transfer hostname for use in AWS.
Today, the AWS Transfer Family supports 3 commonly used file transfer protocols.
These are Secure File Transfer Protocol or SFTP which is file transfer over SSH,
File Transfer Protocol over SSL or FTPS which is FTP over a TLS-encrypted channel,
and plain File Transfer Protocol or FTP.
SFTP and FTPS protocols can be setup to be accessible from the public internet,
while using FTP is limited to be only accessible from inside a VPC through VPC endpoints.
In the remainder of this video
I’ll walk through how the AWS Transfer Family can be used with each of the three supported protocols.
For the first part of the demo, I'll demonstrate creating an endpoint which will be capable of both SFTP and FTPS
and show accessing it over the public internet.
In the second part I'll create an FTP endpoint
and demo accessing it from within a VPC.
Let's jump in.
Here we are in the console for the AWS Transfer Family.
This is the first part of the demo where I'll create a server
for SFTP and FTPS which can be accessed over the internet.
Note that in these demos I am creating new servers
however this same flow could be used to modify an existing server
such as adding the FTPS protocol to an existing SFTP server.
To get started, I'll click on "Create server."
At this point I'm given the choice for which file transfer protocols I want to enable on this endpoint.
For this part of the demo, I'll select SFTP and FTPS.
Because I selected FTPS I'll need to specify a certificate in AWS Certificate Manager
that will be used as the server certificate for TLS connections.
I'll select an existing one, and then click on, "next".
At this point I have the choice of how I want to authenticate users to this endpoint.
Let's take a second and talk about the options.
"Service Managed" means users will be created and managed within the AWS Transfer service.
I won't be able to choose this option in this demo as I have selected to enable FTPS.
"Custom" means setting up a custom authorizer endpoint.
This means an API Gateway endpoint
which is called by AWS Transfer to authenticate users when they connect to the endpoint.
This option is typically used for integrating with an existing identity provider outside of AWS Transfer or even outside of AWS.
I will provide the API Gateway endpoint as well as a role
which will allow AWS Transfer to call this endpoint when authenticating users.
I'll click, "next".
Now I have the choice to host my endpoint publicly or place it within my VPC.
Public means a publicly accessible endpoint that is not inside your VPC.
Because of this, you can't use security groups around it.
Choosing to host in a VPC means an endpoint that uses ENIs in your VPC,
and depending on the protocol, you can have an elastic IP directly attached to it.
This helps you keep EIPs static for your end users
and because it is in VPC also enables you to use Security Groups
to restrict access to only your client's source IP addresses.
Since I selected FTPS I won't be able to choose public.
I'll go back to VPC and then choose to make it "internet facing".
At this point I could also choose to use an existing hostname.
I'm going to skip this in this demo but here are the options that are available.
I'll then select an existing VPC.
This brings up the list of subnets in the VPC.
I'll select us-east-1a and 1b availability zones
and then I'll select the public subnet in each zone.
I am also choosing to associate an elastic IP in each subnet.
I'll click on, "Next".
I'll select a role which will allow AWS Transfer to write logs to CloudWatch Logs.
For this demo I'll skip over, "Server Host Key", and "Tags" and click, "Next" to go to the next step.
This page shows a summary of what will be created.
I review, and then click on, "Create server".
Now I'll just jump to the point of the server being, online.
Now that the server is online, let's test it out.
First I'll show that I can test the custom authorizer right from the console.
If I click on Test from the Actions menu
I can put in my user's username and password.
When I click on, "Test", I can see the response returned from the authorizer.
A 200 is a successful authentication,
and returned in the response is the IAM role which AWS Transfer should apply to this session.
This is how file transfer users are given access to buckets and objects in S3.
I won't go dive into IAM right now but here is the policy attached to that role.
It allows listing this S3 bucket as well as granting access to objects in that bucket.
Check the documentation as there there are many options to further scope down policies
and also the ability to create virtual directory structures for your users.
Now let's look at the objects in that S3 bucket.
There are 3 text files named Test1, 2, and 3.
If I click on one of the files and go to the S3 Select tab...
I can see a preview of the file contents. It's just a one line text file.
I want to call out one more thing before testing this out.
These are the current inbound rules in my security group for the VPC in which I deployed the server.
I need to allow inbound connections on port 22
as this is the SSH port used by SFTP.
I also need to allow inbound connections on port 21 for the FTP control channel
as well as this ephemeral port range for the FTP data channel.
Be sure to check the documentation to be sure of the port
ranges you'll need to allow for the protocols you need to support.
Now I'll test using SFTP.
I'm doing this from my local machine over the public internet using the FileZilla client.
I have already added my SSH public key to the custom authorizer
so I should be authorized to connect.
Here is the endpoint I just created. I'll click on, connect...
The status window shows a successful connection and a successful listing of the bucket.
The file viewer window shows the three text files.
At this point I could download any of these or upload new files.
Now I'll disconnect and try FTPS.
This is the same endpoint but using the FTP protocol and port.
and also set to use TLS.
In this case I'm authenticating using username and password
versus a private key in the SFTP case.
The status window again shows a successful connection...
and the same 3 files are shown in the listing.
For the second part of the demo, I'll show creating an FTP endpoint.
Note that an FTP endpoint without TLS can only be created inside a VPC
and can only be accessed through VPC endpoints.
I'll start again by clicking, Create server.
In this case I'll only select FTP in the protocol selections.
I'll click, next.
I'll use the same custom authorizer and the same role as in the previous example.
Click, next.
The only options I'll be allowed to select with FTP are inside a VPC and Internal access.
I'll select the same VPC and the same subnets.
Click on, next again.
I'll use the same logging role as as the previous example
and click, next.
I'll do a quick review and then click, Create server.
Again I'll jump to the point where the server is, online.
Now that the FTP endpoint is online we can give it a test as well.
I'll do that by first jumping onto a bastion host in the VPC.
I'll then use a command line FTP client to connect.
Notice that the host name is a VPC endpoint.
Again, I'll put in my user's password.
Now, I'll issue an ls command to list the available files.
And here are the same three files as before.
Just to show we can also do something interesting with the files, I'll get one.
If I exit the FTP client I can cat the file
and see the same line of text we saw in S3.
To recap, this video showed how easy it is to get started using AWS Transfer
for SFTP, FTPS, and FTP to transfer files into and out of Amazon S3.
The AWS Transfer Family can be used for use cases such as building data lakes,
integrations with existing systems which rely on file transfers,
and any other file transfer workload.
Thanks for your time.
I hope you learned more about the AWS Transfer Family.