SFTP Connector Authentication Failing with nondescript "Key exchange failed" error. Credentials and Trusted Host Key are 100% correct

Question

Trying to connect to a SFTP server via an AWS Transfer Connector. SFTP server is hosted by a 3rd party and pull files in to S3. I am 100% sure that my  connector is set up correctly, URL is valid, and the credentials in secrets manager are the correct values (Username, Password, and PrivateKey) and formatted correctly per the documentation from AWS. Very well versed in SFTP, PKI-based authentication, etc. and when I connect to this server outside of AWS with the exact same parameters (via my laptop's CLI and SFTP client (CyberDuck on Mac and WinSCP on a Windows machine)) everything works perfectly without issue. However, when I try to  test the connection via the connector in the AWS Console, I get a generic, nondescript error message that says "Key exchange failed" (see below image) with 0 details around what exactly happened during the key exchange that went wrong. Key pair is ssh-rsa, I've verified fingerprints of host key matches what is in connector UI, I've parsed through logs in SFTP clients, etc. Everything outside of AWS clearly shows every part of the connection is working flawlessly (including Key Exchange and Host Key validation). Can someone please help? 
Errors:
![Transfer Connector Error](/media/postImages/original/IMH0_yh-yATYqfTxzgxCglKA)

```
  "status-code": "FAILED",
    "failure-code": "CONNECTION_ERROR",
    "failure-message": "Key exchange failed",
```

Answer

Hey @jpetro, can you send me an email to yoonmsuh@amazon.com so we can look into this further? Thank you!

Answer

Hi! From the error, seems likely that the connector failed due to incompatible SSH host key algorithms. 
SFTP connectors support the following host key algorithms:

```
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
rsa-sha2-512
rsa-sha2-256
```
Does your remote server supports at least one of the algorithms from the list above?

Documentation: https://docs.aws.amazon.com/transfer/latest/userguide/creating-connectors.html

Answer

Exactly the same problem here. The configuration is not using the private key but otherwise similar results. Algorithms have been verified.

SFTP Connector Authentication Failing with nondescript "Key exchange failed" error. Credentials and Trusted Host Key are 100% correct

Relevant content