AUTH_FAILURE in AWS Transfer Service when calling Lambda

Question

I currently get this error in Cloudwatch logs from my AWS Transfer Family Server:

{
    "identity-provider-request-id": ""****"",
    "method": "password",
    "activity-type": "AUTH_FAILURE",
    "source-ip": ""****"",
    "resource-arn": "arn:aws:transfer:eu-central-1:****:server/s-"****"",
    "message": "Authentication failure",
    "user": "****"
}

The result of my Lambda function is:

Response:
{
  "statusCode": 200,
  "body": {
    "Response": {
      "Role": "arn:aws:iam::****:role/***",
      "HomeDirectory": "/dir",
      "PosixProfile": {
        "Uid": 1,
        "Gid": 2
      }
    }
  }
}

I assume that the Lambda response is correct.

Unfortunately there's no futher information anywhere in the logs to analyse what's the current problem.

Any idea on how to proceed and how to analyse the problem?

re:Post Agent · Answer

Based on the information provided, it appears that your AWS Transfer Family server is encountering an authentication failure despite your Lambda function returning a seemingly correct response. Here are some steps you can take to analyze and troubleshoot the issue:

1. Double-check the Lambda function response format:
   Ensure that the response from your Lambda function exactly matches the expected format. The "Response" object should be at the top level, not nested within a "body" object. Try modifying your Lambda function to return:

{
     "Role": "arn:aws:iam::****:role/***",
     "HomeDirectory": "/dir",
     "PosixProfile": {
       "Uid": 1,
       "Gid": 2
     }
   }

2. Verify IAM permissions:
   Make sure that the IAM role specified in the Lambda response has the necessary permissions to access the resources required by the Transfer Family server, including the home directory.

3. Check POSIX profile:
   Ensure that the POSIX profile information (Uid and Gid) is correct and matches the permissions required for the user to access the specified home directory.

4. Examine Lambda function logs:
   Review the CloudWatch logs for your Lambda function to see if there are any errors or unexpected behaviors occurring during execution.

5. Test the identity provider:
   Use the AWS Transfer Family console or AWS CLI to test your custom identity provider. This can help isolate whether the issue is with the Lambda function or the Transfer Family server configuration.

6. Check Transfer Family server configuration:
   Verify that the server is correctly configured to use your custom identity provider and that the ARN of the Lambda function is correct.

7. Increase logging verbosity:
   If possible, increase the logging verbosity for your Transfer Family server to get more detailed information about the authentication process.

8. Review IAM permissions for Transfer Family:
   Ensure that the Transfer Family service has the necessary permissions to invoke your Lambda function and assume the role specified in the Lambda response.

9. Review CloudTrail history for access denied messages

If you're still unable to resolve the issue after trying these steps, you may need to contact AWS Support for further assistance. They can help you investigate the problem more deeply and provide guidance specific to your setup.  
**Sources**  
[Troubleshooting AWS Transfer Family - AWS Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/troubleshooting.html)  
[Using AWS Lambda to integrate your identity provider - AWS Transfer Family](https://docs.aws.amazon.com/transfer/latest/userguide/custom-lambda-idp.html)  
[Troubleshooting AWS Lambda identity and access - AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/security_iam_troubleshoot.html)

Alex Volanis · Answer

Your Lambda response is incorrect. The `Role` element must be the actual ARN of a role in the target account that has properly configured access for the S3 buckets or EFS filesystems you are planning to access.

See documentation here: https://docs.aws.amazon.com/transfer/latest/userguide/custom-lambda-idp.html#lambda-valid-values

Leo K · Answer

It's a bit difficult to say for sure without seeing the original, uncensored reply from the Lambda function, but at the risk of pointing out the obvious, the value of the HomeDirectory property should start with a forward slash, followed by the ID of the file system, optionally further followed by a path name in the EFS file system, and in either case, not containing a trailing slash.

Valid return values would include:
```
"HomeDirectory": "/fs-12345678"
"HomeDirectory": "/fs-12345678/dir"
```

And these would be invalid. The first two because of trailing slashes, the third because of a missing file system ID, and the last one because of a missing leading slash:
```
"HomeDirectory": "/fs-12345678/"
"HomeDirectory": "/fs-12345678/dir/"
"HomeDirectory": "/dir"
"HomeDirectory": "fs-12345678/dir"
```

Your example shows `/dir` as the HomeDirectory value. Have you got the file system ID in place of or preceding "dir"? If it's missing, the Transfer server wouldn't know which EFS file system to connect to.

AUTH_FAILURE in AWS Transfer Service when calling Lambda

Add your answer

Relevant content