By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

AWS Transfer Family SFTP

0

We have set up an SFTP server on AWS Transfer Family using the Service-managed Identity Provider, but it only supports SSH key-based authentication. Now, we need to migrate our on-prem SFTP server usernames and passwords to AWS.

Questions:

  1. How can we configure password-based authentication on our existing AWS Transfer Family SFTP server?
  2. Do we need to manually set up usernames and passwords after configuring a custom identity provider?

Please provide guidance on implementing this.

Topics
Migration & Modernization
Tags
AWS Transfer for SFTPAWS Transfer Family
Language
English
vishnu
asked 11 days ago31 views
1 Answer
0

You can change the authentication method for the server in the console, under the identity provider settings. You can choose "password OR public key" to be able to support password-based authentication for users needing it but use SSH keys for users able to use them.

With a custom identity provider, the users are exclusively configured in that external identity provider, such as in the DynamoDB table that the AWS-provided, Lambda-based custom identity provider uses to store user data.

EXPERT
Leo K
answered 11 days ago
profile picture
EXPERT
Gary Mclean
reviewed 11 days ago
  • vishnu
    11 days ago

    1. So, we don't need to recreate the server for these changes, correct? Also, can we use both the SSH key and password by editing the identity provider settings?

    2. Lastly, do we need to manually create the usernames and passwords, or is there another way to migrate the on-prem SFTP server user details to AWS?

  • Leo K EXPERT
    11 days ago
    1. Yes, you should be able to change the authentication method selection without recreating the server. 2. With a custom identity provider (IdP), the passwords will be up to the IdP to manage. Typically, the answer to your question would be yes: you would generate random passwords for the users and set them in the DynamoDB table behind the custom IdP, but it's also possible to use some existing passwords or to integrate with an existing AD or other backend to use existing credentials for users.
  • rePost-User-8149119 EXPERT
    10 days ago

    Agreed with what's been said above except you would need to recreate the server to change the IdP type.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content