How to allow access to EFS from SFTP using lambda as Identity Provider?

Question

'm trying to build an SFTP server for an EFS that uses a lambda function to check username and password provided against a Secret in AWS.

I followed [this article](https://aws.amazon.com/blogs/storage/enable-password-authentication-for-aws-transfer-for-sftp-using-aws-secrets-manager/) but changed it a bit, I'm not using an API Gateway, I use the lambda function directly as identity provider which fetches the following data from secret Manager :

```
 "Role" : "arn:aws:iam::xxxxxxxxxxx:role/my-transfer-role",
"PosixProfile": {
    "Uid": 1001,
    "Gid": 1001,
    "SecondaryGids": []
 },
 "HomeDirectory": "/"
```

so far I can only connect to the SFTP server, but can't read or write what's on the EFS `Message="Unable to list directory: permission denied for /"`

I created a role and a policy attached to Transfer with permissions on my EFS as explained in [this guide](https://docs.aws.amazon.com/transfer/latest/userguide/requirements-roles.html)

Is there something I'm missing in this configuration please? Thanks

Accepted Answer

HichamZouarhi@,

Considering you are able to connect to the server and authenticate, the overall Lambda IDP configuration seems to be working. In regards to your error, I believe you need to provide the EFS id within the `HomeDirectory` to be able to access. Right now with `HomeDirectory: /` , it assumes root of EFS and probably attempts to list available EFS resources. Unless you have permissions for the same, the error would be expected behavior.

Could you update the HomeDirectory to the EFS resource that you are trying to access? `Example: HomeDirectory: /fs-000000/user`. Further, you need to ensure that the folder you are trying to access is accessible using the POSIX configuration you specified: `(1001, 1001)` in your case.

References:
- [EFS Guide](https://docs.aws.amazon.com/efs/latest/ug/using-aws-transfer-integration.html)
- [Transfer Guide](https://docs.aws.amazon.com/transfer/latest/userguide/requirements-efs.html)

Let me know if you have follow up questions.

-- Sagar

How to allow access to EFS from SFTP using lambda as Identity Provider?

Relevant content