All checks
Medium
Transfer Family servers should not use FTP protocol for endpoint connection
Checks that the Transfer Family server does not offer FTP; a server with FTP among its protocols fails. FTP sends files and sign-in credentials unencrypted, so anyone on the network path can read or alter them, while SFTP, FTPS and AS2 encrypt the connection.
- service
- Transfer
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: Clients still connecting over plain FTP are refused once FTP is removed, so move them to FTPS or SFTP first.
In the console
Transfer Family → Servers → the server → Protocols → Edit
- File Transfer Protocol (FTP)
- Cleared
- File Transfer Protocol Secure (FTPS)
- Selected, for clients moving off FTP; SFTP also passes
- Certificate
- An ACM certificate for the server's hostname, required with FTPS
With the AWS CLI
- Overwrites existing settings: --protocols replaces the server's whole list, so name every protocol it should keep, not only FTPS.
aws transfer update-server --server-id <server-id> --protocols FTPS --certificate <acm-certificate-arn> --region <region>With Terraform
resource "aws_transfer_server" "this" {
protocols = ["FTPS"]
certificate = var.acm_certificate_arn
}See which of your accounts this check is failing on.
Book a live scan