Cannot connect AWS Transfer via SFTP

Question

I just setup a new server on AWS Transfer. I enable SFTP and use Service managed for identity provider. I created a user with role and policy that should have access to S3 bucket I want to interact, and I added ssh public key.  
  
Now I try to connect SFTP server following guide, but I could not connect  
https://docs.aws.amazon.com/transfer/latest/userguide/getting-started-use-the-service.html#cyberduck  
  
With Cyberduck I got "Interoperability failure" "EOF while reading packet. Please contact your web hosting service provider for assistance."  
I also tried sftp command but no luck.   
  
What can we try to trouble shoot this? cloudwatch has nothing.  
  
Below is output form SFTP command (I replace my server name with s-xxxxx)  
sftp -vvv -i ~/.ssh/awstest kazuki-test@s-16def29693e541d5a.server.transfer.us-east-1.amazonaws.com  
  
_sftp -vvv -i ~/.ssh/awstest kazuki-test@s-xxxxx.server.transfer.us-east-1.amazonaws.com_  
_OpenSSH_7.5p1, OpenSSL 1.0.2s  28 May 2019_  
_debug1: Reading configuration data /Users/kazuki/.ssh/config_  
_debug1: /Users/kazuki/.ssh/config line 3: Applying options for *_  
_debug1: /Users/kazuki/.ssh/config line 66: Applying options for *_  
_debug2: checking match for 'exec "/usr/local/bin/step ssh check-host %h"' host s-xxxxx.server.transfer.us-east-1.amazonaws.com originally s-xxxxx.server.transfer.us-east-1.amazonaws.com_  
_debug1: Executing command: '/usr/local/bin/step ssh check-host s-xxxxx.server.transfer.us-east-1.amazonaws.com'_  
_debug1: permanently_drop_suid: 502_  
_debug3: command returned status 1_  
_debug3: /Users/kazuki/.ssh/config line 67: not matched 'exec "/usr/local/bin/step ssh check-host s-xxxxx.server.transfer.us-east-1.amazonaws.com"'_  
_debug2: match not found_  
_debug1: Reading configuration data /usr/local/etc/ssh/ssh_config_  
_debug1: auto-mux: Trying existing master_  
_debug1: Control socket "/Users/kazuki/.ssh/sockets/98b42242aeb5403d857ec57a3a002a3dcef0f0b1" does not exist_  
_debug2: resolving "s-xxxxx.server.transfer.us-east-1.amazonaws.com" port 22_  
_debug2: ssh_connect_direct: needpriv 0_  
_debug1: Connecting to s-xxxxx.server.transfer.us-east-1.amazonaws.com \[3.217.63.140] port 22._  
_debug1: Connection established._  
_debug1: identity file /Users/kazuki/.ssh/awstest type 1_  
_debug1: key_load_public: No such file or directory_  
_debug1: identity file /Users/kazuki/.ssh/awstest-cert type -1_  
_debug1: Enabling compatibility mode for protocol 2.0_  
_debug1: Local version string SSH-2.0-OpenSSH_7.5_  
_debug1: Remote protocol version 2.0, remote software version AWS_SFTP_1.0_  
_debug1: no match: AWS_SFTP_1.0_  
_debug2: fd 6 setting O_NONBLOCK_  
_debug1: Authenticating to s-xxxxx.server.transfer.us-east-1.amazonaws.com:22 as 'kazuki-test'_  
_debug3: hostkeys_foreach: reading file "/Users/kazuki/.ssh/known_hosts"_  
_debug3: record_hostkey: found key type RSA in file /Users/kazuki/.ssh/known_hosts:342_  
_debug3: load_hostkeys: loaded 1 keys from s-xxxxx.server.transfer.us-east-1.amazonaws.com_  
_debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa_  
_debug3: send packet: type 20_  
_debug1: SSH2_MSG_KEXINIT sent_  
_debug3: receive packet: type 20_  
_debug1: SSH2_MSG_KEXINIT received_  
_debug2: local client KEXINIT proposal_  
_debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c_  
_debug2: host key algorithms: ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519_  
_debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc_  
_debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc_  
_debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1_  
_debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1_  
_debug2: compression ctos: none,zlib@openssh.com,zlib_  
_debug2: compression stoc: none,zlib@openssh.com,zlib_  
_debug2: languages ctos:_  
_debug2: languages stoc:_  
_debug2: first_kex_follows 0_  
_debug2: reserved 0_  
_debug2: peer server KEXINIT proposal_  
_debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1_  
_debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256_  
_debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com_  
_debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com_  
_debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1_  
_debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1_  
_debug2: compression ctos: none,zlib@openssh.com_  
_debug2: compression stoc: none,zlib@openssh.com_  
_debug2: languages ctos:_  
_debug2: languages stoc:_  
_debug2: first_kex_follows 0_  
_debug2: reserved 0_  
_debug1: kex: algorithm: curve25519-sha256_  
_debug1: kex: host key algorithm: rsa-sha2-512_  
_debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none_  
_debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none_  
_debug3: send packet: type 30_  
_debug1: expecting SSH2_MSG_KEX_ECDH_REPLY_  
_debug3: receive packet: type 31_  
_debug1: Server host key: ssh-rsa SHA256:fbLuv_TqVBVQXVq15Ty7e/uVMpUqi5xK4z/9upU4LlQ+  
_debug3: hostkeys_foreach: reading file "/Users/kazuki/.ssh/known_hosts"_  
_debug3: record_hostkey: found key type RSA in file /Users/kazuki/.ssh/known_hosts:342_  
_debug3: load_hostkeys: loaded 1 keys from s-xxxxx.server.transfer.us-east-1.amazonaws.com_  
_debug3: hostkeys_foreach: reading file "/Users/kazuki/.ssh/known_hosts"_  
_debug3: record_hostkey: found key type RSA in file /Users/kazuki/.ssh/known_hosts:345_  
_debug3: load_hostkeys: loaded 1 keys from 3.217.63.140_  
_debug1: Host 's-xxxxx.server.transfer.us-east-1.amazonaws.com' is known and matches the RSA host key._  
_debug1: Found key in /Users/kazuki/.ssh/known_hosts:342_  
_debug3: send packet: type 21_  
_debug2: set_newkeys: mode 1_  
_debug1: rekey after 134217728 blocks_  
_debug1: SSH2_MSG_NEWKEYS sent_  
_debug1: expecting SSH2_MSG_NEWKEYS_  
_debug3: receive packet: type 21_  
_debug1: SSH2_MSG_NEWKEYS received_  
_debug2: set_newkeys: mode 0_  
_debug1: rekey after 134217728 blocks_  
_debug2: key: /Users/kazuki/.ssh/awstest (0x7ffd49d01580), explicit_  
_debug3: send packet: type 5_  
_debug3: receive packet: type 7_  
_debug1: SSH2_MSG_EXT_INFO received_  
_debug1: kex_input_ext_info: server-sig-algs=_  
_debug3: receive packet: type 6_  
_debug2: service_accept: ssh-userauth_  
_debug1: SSH2_MSG_SERVICE_ACCEPT received_  
_debug3: send packet: type 50_  
_debug3: receive packet: type 51_  
_debug1: Authentications that can continue: publickey_  
_debug3: start over, passed a different list publickey_  
_debug3: preferred publickey,keyboard-interactive,password_  
_debug3: authmethod_lookup publickey_  
_debug3: remaining preferred: keyboard-interactive,password_  
_debug3: authmethod_is_enabled publickey_  
_debug1: Next authentication method: publickey_  
_debug1: Offering RSA public key: /Users/kazuki/.ssh/awstest_  
_debug3: send_pubkey_test_  
_debug3: send packet: type 50_  
_debug2: we sent a publickey packet, wait for reply_  
_debug3: receive packet: type 60_  
_debug1: Server accepts key: pkalg rsa-sha2-512 blen 279_  
_debug2: input_userauth_pk_ok: fp SHA256:fViont1oUaqlW/BSI9KXgkC43OuFg_BL3uMFxppvsJw+  
_debug3: sign_and_send_pubkey: RSA SHA256:fViont1oUaqlW/BSI9KXgkC43OuFg_BL3uMFxppvsJw+  
_debug3: send packet: type 50_  
_debug3: receive packet: type 52_  
_debug1: Authentication succeeded (publickey)._  
_Authenticated to s-xxxxx.server.transfer.us-east-1.amazonaws.com (\[3.217.63.140]:22)._  
_debug1: setting up multiplex master socket_  
_debug3: muxserver_listen: temporary control path /Users/kazuki/.ssh/sockets/98b42242aeb5403d857ec57a3a002a3dcef0f0b1.WXBNdTY8hK0Cl18b_  
_debug2: fd 7 setting O_NONBLOCK_  
_debug3: fd 7 is O_NONBLOCK_  
_debug3: fd 7 is O_NONBLOCK_  
_debug1: channel 0: new \[/Users/kazuki/.ssh/sockets/98b42242aeb5403d857ec57a3a002a3dcef0f0b1]_  
_debug3: muxserver_listen: mux listener channel 0 fd 7_  
_debug2: fd 6 setting TCP_NODELAY_  
_debug3: ssh_packet_set_tos: set IP_TOS 0x08_  
_debug1: control_persist_detach: backgrounding master process_  
_debug2: control_persist_detach: background process is 54294_  
_debug2: fd 7 setting O_NONBLOCK_  
_debug1: forking to background_  
_debug1: Entering interactive session._  
_debug1: pledge: id_  
_debug2: set_control_persist_exit_time: schedule exit in 600 seconds_  
_debug1: multiplexing control connection_  
_debug3: fd 3 is O_NONBLOCK_  
_debug3: fd 3 is O_NONBLOCK_  
_debug1: channel 1: new \[mux-control]_  
_debug3: channel_post_mux_listener: new mux channel 1 fd 3_  
_debug3: mux_master_read_cb: channel 1: hello sent_  
_debug2: set_control_persist_exit_time: cancel scheduled exit_  
_debug3: mux_master_read_cb: channel 1 packet type 0x00000001 len 4_  
_debug2: process_mux_master_hello: channel 1 slave version 4_  
_debug2: mux_client_hello_exchange: master version 4_  
_debug3: mux_client_forwards: request forwardings: 0 local, 0 remote_  
_debug3: mux_client_request_session: entering_  
_debug3: mux_client_request_alive: entering_  
_debug3: mux_master_read_cb: channel 1 packet type 0x10000004 len 4_  
_debug2: process_mux_alive_check: channel 1: alive check_  
_debug3: mux_client_request_alive: done pid = 54296_  
_debug3: mux_client_request_session: session request sent_  
_debug3: mux_master_read_cb: channel 1 packet type 0x10000002 len 54_  
_debug2: process_mux_new_session: channel 1: request tty 0, X 0, agent 0, subsys 1, term "xterm-256color", cmd "sftp", env 0_  
_debug3: process_mux_new_session: got fds stdin 8, stdout 9, stderr 10_  
_debug2: fd 8 setting O_NONBLOCK_  
_debug3: fd 9 is O_NONBLOCK_  
_debug1: channel 2: new \[client-session]_  
_debug2: process_mux_new_session: channel_new: 2 linked to control channel 1_  
_debug2: channel 2: send open_  
_debug3: send packet: type 90_  
_debug3: receive packet: type 80_  
_debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0_  
_debug3: receive packet: type 4_  
_debug1: Remote: SFTP: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding_  
_debug3: receive packet: type 4_  
_debug1: Remote: SFTP: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding_  
_debug3: receive packet: type 91_  
_debug2: callback start_  
_debug2: client_session2_setup: id 2_  
_debug1: Sending subsystem: sftp_  
_debug2: channel 2: request subsystem confirm 1_  
_debug3: send packet: type 98_  
_debug3: mux_session_confirm: sending success reply_  
_debug2: callback done_  
_debug2: channel 2: open confirm rwindow 0 rmax 32768_  
_debug1: mux_client_request_session: master session id: 2_  
_debug2: channel 2: rcvd adjust 2097152_  
_debug3: receive packet: type 99_  
_debug2: channel_input_status_confirm: type 99 id 2_  
_debug2: subsystem request accepted on channel 2_  
_debug3: receive packet: type 96_  
_debug2: channel 2: rcvd eof_  
_debug2: channel 2: output open -> drain_  
_debug2: channel 2: obuf empty_  
_debug2: channel 2: close_write_  
_debug2: channel 2: output drain -> closed_  
_debug3: receive packet: type 98_  
_debug1: client_input_channel_req: channel 2 rtype exit-status reply 0_  
_debug3: mux_exit_message: channel 2: exit message, exitval 1_  
_debug3: receive packet: type 98_  
_debug1: client_input_channel_req: channel 2 rtype eow@openssh.com reply 0_  
_debug2: channel 2: rcvd eow_  
_debug2: channel 2: close_read_  
_debug2: channel 2: input open -> closed_  
_debug3: receive packet: type 97_  
_debug2: channel 2: rcvd close_  
_debug3: channel 2: will not send data after close_  
_debug2: channel 2: send close_  
_debug3: send packet: type 97_  
_debug2: channel 2: is dead_  
_debug2: channel 2: gc: notify user_  
_debug3: mux_master_session_cleanup_cb: entering for channel 2_  
_debug2: channel 1: rcvd close_  
_debug2: channel 1: output open -> drain_  
_debug2: channel 1: close_read_  
_debug2: channel 1: input open -> closed_  
_debug2: channel 2: gc: user detached_  
_debug2: channel 2: is dead_  
_debug2: channel 2: garbage collecting_  
_debug1: channel 2: free: client-session, nchannels 3_  
_debug3: channel 2: status: The following connections are open:_  
  _#1 mux-control (t16 r-1 i3/0 o1/16 fd 3/3 cc -1)_  
  _#2 client-session (t4 r0 i3/0 o3/0 fd -1/-1 cc -1)_  
  
_debug2: channel 1: obuf empty_  
_debug2: channel 1: close_write_  
_debug2: channel 1: output drain -> closed_  
_debug2: channel 1: is dead (local)_  
_debug2: channel 1: gc: notify user_  
_debug3: mux_master_control_cleanup_cb: entering for channel 1_  
_debug2: channel 1: gc: user detached_  
_debug2: channel 1: is dead (local)_  
_debug2: channel 1: garbage collecting_  
_debug1: channel 1: free: mux-control, nchannels 2_  
_debug3: mux_client_read_packet: read header failed: Broken pipe_  
_debug3: channel 1: status: The following connections are open:_  
  _#1 mux-control (t16 r-1 i3/0 o3/0 fd 3/3 cc -1)_  
  
_debug2: set_control_persist_exit_time: schedule exit in 600 seconds_  
_debug2: Received exit status from master 1_  
_Connection closed_

Answer

Thanks for response, I believe logging role is admin IAM that has  
  
{  
    "Version": "2012-10-17",  
    "Statement": \[  
        {  
            "Effect": "Allow",  
            "Action": "*",  
            "Resource": "*"  
        }  
    ]  
}  
  
also can you shed some light on how to troubleshoot this?

Answer

Hi kazuki,  
  
The IAM policy you included in your previous post appears to be the Role Policy, which defines the permissions granted after AssumeRole. However, it's the role's Trust Policy that defines who can call AssumeRole in the first place. Can you confirm that your role's Trust Policy explicitly allows transfer.amazonaws.com? For example, the Trust Policy should look like this:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "transfer.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

You can view the Trust Policy in the IAM Console, when looking at your logging role, under Trust relationships tab. Please refer to the screenshots in https://docs.aws.amazon.com/transfer/latest/userguide/requirements-roles.html for reference.

Regards,  
  
Ian

Answer

Please ensure your logging role is assumable by the service.
 `transfer.amazonaws.com`
 You can read more about creating a logging role in the _Create an IAM role and policy_ documentation.  
https://docs.aws.amazon.com/transfer/latest/userguide/requirements-roles.html

Cannot connect AWS Transfer via SFTP

Relevant content