AWS Transfer Family SFTP Server issue

Question

I have a need to create an SFTP server using the AWS Transfer Family for my job, I am starting in my home account first to get a feeling for it
I am 99% of the way there I can connect from WINSCP or FileZilla using the SSH key set up ok
The problem is with access to the S3 Bucket 
This is the connectivity log
{
    "role": "arn:aws:iam::724772055072:role/SFTPtoS3bucket",
    "activity-type": "CONNECTED",
    "ssh-public-key-fingerprint": "SHA256:od/dmCjItOGoI6/LIZSmFrXVX++GYKgF8DIOjjl2qww",
    "home-dir": "/nexidia-om-raw-bucket/daily",
    "ssh-public-key": "***REDACTED***",
    "ssh-public-key-type": "ecdsa-sha2-nistp256",
    "macs": ",",
    "ciphers": "aes256-gcm@openssh.com,aes256-gcm@openssh.com",
    "client": "SSH-2.0-FileZilla_3.69.5",
    "source-ip": "180.181.248.215",
    "resource-arn": "arn:aws:transfer:ap-southeast-2:724772055072:server/s-698a035a2fba4fefa",
    "user": "daily",
    "kex": "curve25519-sha256",
    "session-id": "0405f67ff155c6b36828"
}

Then I get this

{
    "s3extended-request-id": "L/M0je38ruZcj4KFcOeymc/X9EuCP2skoe5c8LMT+SO6LF3Po0MuxB9frbWCXjEjSRTOW6K+9wE=",
    "path": "/nexidia-om-raw-bucket/daily",
    "activity-type": "ERROR",
    "resource-arn": "arn:aws:transfer:ap-southeast-2:724772055072:server/s-698a035a2fba4fefa",
    "message": "Access denied",
    "request-id": "ERGSEXT8EVH9TEZ8",
    "operation": "MKDIR",
    "session-id": "0405f67ff155c6b36828"
}

According to the leading AI tools its because my client is trying to create a folder that already exists, can you help me as the AI tools go round in circles

Its a bit confusing as I am using the Service Managed option but I still have to specify a Role for each user which I am told gets ignored, this doesnt seem to very intuative or professional, I dont have much hope for my getting this installed in a corporate environment

Any help would be appreciated

Regards

Andrew

Taz · Answer

Hey,

Hope you're keeping well.

In AWS Transfer Family, even with the **Service managed** identity option, each user still requires an IAM role that grants S3 access to their `HomeDirectory` path. The “Access denied” on `MKDIR` means the role attached to your Transfer Family user doesn’t have the right `s3:PutObject` and `s3:ListBucket` permissions for that exact key prefix. Check the IAM role specified in the Transfer Family user configuration and ensure the policy includes the bucket ARN and the exact prefix `/daily` under `s3:ListBucket` (with `Condition` on `s3:prefix`) and the full object ARN for `s3:PutObject`.

Thanks and regards,  
Taz

Riku_Kobayashi · Answer

Hello.

What are your IAM role and bucket policy settings?  
I have set up Transfer Family several times, and the most common reason for connection issues is due to problems with policy settings.  
I would recommend checking your session policy etc.  
https://docs.aws.amazon.com/transfer/latest/userguide/requirements-roles.html

Leo K · Answer

The advice from AI is incorrect. The IAM role you specify for a service-managed user is used. The Transfer server assumes that role on behalf of the user when they log on. I'm also not clear why you would be creating a folder that already exists; is the folder not showing on the file list?

It sounds most likely that there's something wrong with the IAM policies attached to the role "SFTPtoS3bucket". Could you copy its contents here? Please make sure to redact sensitive parts, such as your account ID or KMS key ARNs, before posting here.

AWS Transfer Family SFTP Server issue

Add your answer

Relevant content