Class: AWSCDK::Transfer::CfnServer::ProtocolDetailsProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
transfer/cfn_server.rb

Overview

The protocol settings that are configured for your server.

Avoid placing Network Load Balancers (NLBs) or NAT gateways in front of AWS Transfer Family servers, as this increases costs and can cause performance issues, including reduced connection limits for FTPS. For more details, see Avoid placing NLBs and NATs in front of AWS Transfer Family .

  • To indicate passive mode (for FTP and FTPS protocols), use the PassiveIp parameter. Enter a single dotted-quad IPv4 address, such as the external IP address of a firewall, router, or load balancer.
  • To ignore the error that is generated when the client attempts to use the SETSTAT command on a file that you are uploading to an Amazon S3 bucket, use the SetStatOption parameter. To have the AWS Transfer Family server ignore the SETSTAT command and upload files without needing to make any changes to your SFTP client, set the value to ENABLE_NO_OP . If you set the SetStatOption parameter to ENABLE_NO_OP , Transfer Family generates a log entry to Amazon CloudWatch Logs, so that you can determine when the client is making a SETSTAT call.
  • To determine whether your AWS Transfer Family server resumes recent, negotiated sessions through a unique session ID, use the TlsSessionResumptionMode parameter.
  • As2Transports indicates the transport method for the AS2 messages. Currently, only HTTP is supported.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(as2_transports: nil, passive_ip: nil, set_stat_option: nil, tls_session_resumption_mode: nil) ⇒ ProtocolDetailsProperty

Returns a new instance of ProtocolDetailsProperty.

Parameters:

  • as2_transports (Array<String>, nil) (defaults to: nil) —

    List of As2Transport objects.

  • passive_ip (String, nil) (defaults to: nil) —

    Indicates passive mode, for FTP and FTPS protocols.

  • set_stat_option (String, nil) (defaults to: nil) —

    Use the SetStatOption to ignore the error that is generated when the client attempts to use SETSTAT on a file you are uploading to an S3 bucket.

  • tls_session_resumption_mode (String, nil) (defaults to: nil) —

    A property used with Transfer Family servers that use the FTPS protocol.



961
962
963
964
965
966
967
968
969
970
 
# File 'transfer/cfn_server.rb', line 961

def initialize(as2_transports: nil, passive_ip: nil, set_stat_option: nil, tls_session_resumption_mode: nil)
  @as2_transports = as2_transports
  Jsii::Type.check_type(@as2_transports, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7InByaW1pdGl2ZSI6InN0cmluZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "as2Transports") unless @as2_transports.nil?
  @passive_ip = passive_ip
  Jsii::Type.check_type(@passive_ip, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "passiveIp") unless @passive_ip.nil?
  @set_stat_option = set_stat_option
  Jsii::Type.check_type(@set_stat_option, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "setStatOption") unless @set_stat_option.nil?
  @tls_session_resumption_mode = tls_session_resumption_mode
  Jsii::Type.check_type(@tls_session_resumption_mode, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "tlsSessionResumptionMode") unless @tls_session_resumption_mode.nil?
end

Instance Attribute Details

#as2_transports ⇒ Array<String>? (readonly)

List of As2Transport objects.

Returns:

  • (Array<String>, nil)

See Also:



976
977
978
 
# File 'transfer/cfn_server.rb', line 976

def as2_transports
  @as2_transports
end

#passive_ip ⇒ String? (readonly)

Indicates passive mode, for FTP and FTPS protocols.

Enter a single IPv4 address, such as the public IP address of a firewall, router, or load balancer. For example:

aws transfer update-server --protocol-details PassiveIp=0.0.0.0

Replace 0.0.0.0 in the example above with the actual IP address you want to use.

If you change the PassiveIp value, you must stop and then restart your Transfer Family server for the change to take effect. For details on using passive mode (PASV) in a NAT environment, see Configuring your FTPS server behind a firewall or NAT with AWS Transfer Family .

Additionally, avoid placing Network Load Balancers (NLBs) or NAT gateways in front of AWS Transfer Family servers. This configuration increases costs and can cause performance issues. When NLBs or NATs are in the communication path, Transfer Family cannot accurately recognize client IP addresses, which impacts connection sharding and limits FTPS servers to only 300 simultaneous connections instead of 10,000. If you must use an NLB, use port 21 for health checks and enable TLS session resumption by setting TlsSessionResumptionMode = ENFORCED . For optimal performance, migrate to VPC endpoints with Elastic IP addresses instead of using NLBs. For more details, see Avoid placing NLBs and NATs in front of AWS Transfer Family .

Special values

The AUTO and 0.0.0.0 are special values for the PassiveIp parameter. The value PassiveIp=AUTO is assigned by default to FTP and FTPS type servers. In this case, the server automatically responds with one of the endpoint IPs within the PASV response. PassiveIp=0.0.0.0 has a more unique application for its usage. For example, if you have a High Availability (HA) Network Load Balancer (NLB) environment, where you have 3 subnets, you can only specify a single IP address using the PassiveIp parameter. This reduces the effectiveness of having High Availability. In this case, you can specify PassiveIp=0.0.0.0 . This tells the client to use the same IP address as the Control connection and utilize all AZs for their connections. Note, however, that not all FTP clients support the PassiveIp=0.0.0.0 response. FileZilla and WinSCP do support it. If you are using other clients, check to see if your client supports the PassiveIp=0.0.0.0 response.

Returns:

  • (String, nil)

See Also:



995
996
997
 
# File 'transfer/cfn_server.rb', line 995

def passive_ip
  @passive_ip
end

#set_stat_option ⇒ String? (readonly)

Use the SetStatOption to ignore the error that is generated when the client attempts to use SETSTAT on a file you are uploading to an S3 bucket.

Some SFTP file transfer clients can attempt to change the attributes of remote files, including timestamp and permissions, using commands, such as SETSTAT when uploading the file. However, these commands are not compatible with object storage systems, such as Amazon S3. Due to this incompatibility, file uploads from these clients can result in errors even when the file is otherwise successfully uploaded.

Set the value to ENABLE_NO_OP to have the Transfer Family server ignore the SETSTAT command, and upload files without needing to make any changes to your SFTP client. While the SetStatOption ENABLE_NO_OP setting ignores the error, it does generate a log entry in Amazon CloudWatch Logs, so you can determine when the client is making a SETSTAT call.

If you want to preserve the original timestamp for your file, and modify other file attributes using SETSTAT , you can use Amazon EFS as backend storage with Transfer Family.

Returns:

  • (String, nil)

See Also:



1006
1007
1008
 
# File 'transfer/cfn_server.rb', line 1006

def set_stat_option
  @set_stat_option
end

#tls_session_resumption_mode ⇒ String? (readonly)

A property used with Transfer Family servers that use the FTPS protocol.

TLS Session Resumption provides a mechanism to resume or share a negotiated secret key between the control and data connection for an FTPS session. TlsSessionResumptionMode determines whether or not the server resumes recent, negotiated sessions through a unique session ID. This property is available during CreateServer and UpdateServer calls. If a TlsSessionResumptionMode value is not specified during CreateServer , it is set to ENFORCED by default.

  • DISABLED : the server does not process TLS session resumption client requests and creates a new TLS session for each request.
  • ENABLED : the server processes and accepts clients that are performing TLS session resumption. The server doesn't reject client data connections that do not perform the TLS session resumption client processing.
  • ENFORCED : the server processes and accepts clients that are performing TLS session resumption. The server rejects client data connections that do not perform the TLS session resumption client processing. Before you set the value to ENFORCED , test your clients.

Not all FTPS clients perform TLS session resumption. So, if you choose to enforce TLS session resumption, you prevent any connections from FTPS clients that don't perform the protocol negotiation. To determine whether or not you can use the ENFORCED value, you need to test your clients.

Returns:

  • (String, nil)

See Also:



1019
1020
1021
 
# File 'transfer/cfn_server.rb', line 1019

def tls_session_resumption_mode
  @tls_session_resumption_mode
end

Class Method Details

.jsii_properties ⇒ Object 



1021
1022
1023
1024
1025
1026
1027
1028
 
# File 'transfer/cfn_server.rb', line 1021

def self.jsii_properties
  {
    :as2_transports => "as2Transports",
    :passive_ip => "passiveIp",
    :set_stat_option => "setStatOption",
    :tls_session_resumption_mode => "tlsSessionResumptionMode",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
 
# File 'transfer/cfn_server.rb', line 1030

def to_jsii
  result = {}
  result.merge!({
    "as2Transports" => @as2_transports,
    "passiveIp" => @passive_ip,
    "setStatOption" => @set_stat_option,
    "tlsSessionResumptionMode" => @tls_session_resumption_mode,
  })
  result.compact
end