All checks
Medium
Transfer Family connectors should have logging enabled
Checks that the Transfer Family connector has a logging role, which lets it write its events to CloudWatch Logs; a connector without one fails. The log records the connector's activity, such as transfers to and from a trading partner, for audits and investigations.
- service
- Transfer
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
Transfer Family → Connectors → the connector → Edit
- Logging role
- A role trusting transfer.amazonaws.com that may create and write to log groups under /aws/transfer
With the AWS CLI
aws transfer update-connector --connector-id <connector-id> --logging-role <logging-role-arn> --region <region>With Terraform
resource "aws_transfer_connector" "this" {
access_role = var.access_role_arn
url = var.partner_url
logging_role = var.logging_role_arn
}See which of your accounts this check is failing on.
Book a live scan