Skip to content

Commit f0b9a4c

Browse files
author
AWS
committed
AWS Transfer for SFTP Update: This release adds logical directories support to your AWS SFTP server endpoint, so you can now create logical directory structures mapped to Amazon Simple Storage Service (Amazon S3) bucket paths for users created and stored within the service. Amazon S3 bucket names and paths can now be hidden from AWS SFTP users, providing an additional level of privacy to meet security requirements. You can lock down your SFTP users' access to designated folders (commonly referred to as 'chroot'), and simplify complex folder structures for data distribution through SFTP without replicating files across multiple users.
1 parent dbc2918 commit f0b9a4c

File tree

2 files changed

+134
-17
lines changed

2 files changed

+134
-17
lines changed

‎.changes/next-release/feature-AWSTransferforSFTP-ac211dd.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"type": "feature",
3+
"category": "AWS Transfer for SFTP",
4+
"description": "This release adds logical directories support to your AWS SFTP server endpoint, so you can now create logical directory structures mapped to Amazon Simple Storage Service (Amazon S3) bucket paths for users created and stored within the service. Amazon S3 bucket names and paths can now be hidden from AWS SFTP users, providing an additional level of privacy to meet security requirements. You can lock down your SFTP users' access to designated folders (commonly referred to as 'chroot'), and simplify complex folder structures for data distribution through SFTP without replicating files across multiple users."
5+
}

‎services/transfer/src/main/resources/codegen-resources/service-2.json

Lines changed: 129 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,8 @@
7373
{"shape":"ServiceUnavailableException"},
7474
{"shape":"InternalServiceError"},
7575
{"shape":"InvalidRequestException"},
76-
{"shape":"ResourceNotFoundException"}
76+
{"shape":"ResourceNotFoundException"},
77+
{"shape":"ThrottlingException"}
7778
],
7879
"documentation":"<p>Deletes a user's Secure Shell (SSH) public key.</p> <p>No response is returned from this operation.</p>"
7980
},
@@ -137,7 +138,8 @@
137138
{"shape":"InternalServiceError"},
138139
{"shape":"InvalidRequestException"},
139140
{"shape":"ResourceExistsException"},
140-
{"shape":"ResourceNotFoundException"}
141+
{"shape":"ResourceNotFoundException"},
142+
{"shape":"ThrottlingException"}
141143
],
142144
"documentation":"<p>Adds a Secure Shell (SSH) public key to a user account identified by a <code>UserName</code> value assigned to a specific server, identified by <code>ServerId</code>.</p> <p>The response returns the <code>UserName</code> value, the <code>ServerId</code> value, and the name of the <code>SshPublicKeyId</code>.</p>"
143145
},
@@ -201,7 +203,8 @@
201203
{"shape":"ServiceUnavailableException"},
202204
{"shape":"InternalServiceError"},
203205
{"shape":"InvalidRequestException"},
204-
{"shape":"ResourceNotFoundException"}
206+
{"shape":"ResourceNotFoundException"},
207+
{"shape":"ThrottlingException"}
205208
],
206209
"documentation":"<p>Changes the state of a Secure File Transfer Protocol (SFTP) server from <code>OFFLINE</code> to <code>ONLINE</code>. It has no impact on an SFTP server that is already <code>ONLINE</code>. An <code>ONLINE</code> server can accept and process file transfer jobs.</p> <p>The state of <code>STARTING</code> indicates that the server is in an intermediate state, either not fully able to respond, or not fully online. The values of <code>START_FAILED</code> can indicate an error condition. </p> <p>No response is returned from this call.</p>"
207210
},
@@ -216,7 +219,8 @@
216219
{"shape":"ServiceUnavailableException"},
217220
{"shape":"InternalServiceError"},
218221
{"shape":"InvalidRequestException"},
219-
{"shape":"ResourceNotFoundException"}
222+
{"shape":"ResourceNotFoundException"},
223+
{"shape":"ThrottlingException"}
220224
],
221225
"documentation":"<p>Changes the state of an SFTP server from <code>ONLINE</code> to <code>OFFLINE</code>. An <code>OFFLINE</code> server cannot accept and process file transfer jobs. Information tied to your server such as server and user properties are not affected by stopping your server. Stopping a server will not reduce or impact your Secure File Transfer Protocol (SFTP) endpoint billing.</p> <p>The state of <code>STOPPING</code> indicates that the server is in an intermediate state, either not fully able to respond, or not fully offline. The values of <code>STOP_FAILED</code> can indicate an error condition.</p> <p>No response is returned from this call.</p>"
222226
},
@@ -230,7 +234,8 @@
230234
"errors":[
231235
{"shape":"ServiceUnavailableException"},
232236
{"shape":"InternalServiceError"},
233-
{"shape":"InvalidRequestException"}
237+
{"shape":"InvalidRequestException"},
238+
{"shape":"ResourceNotFoundException"}
234239
],
235240
"documentation":"<p>Attaches a key-value pair to a resource, as identified by its Amazon Resource Name (ARN). Resources are users, servers, roles, and other entities.</p> <p>There is no response returned from this call.</p>"
236241
},
@@ -260,7 +265,8 @@
260265
"errors":[
261266
{"shape":"ServiceUnavailableException"},
262267
{"shape":"InternalServiceError"},
263-
{"shape":"InvalidRequestException"}
268+
{"shape":"InvalidRequestException"},
269+
{"shape":"ResourceNotFoundException"}
264270
],
265271
"documentation":"<p>Detaches a key-value pair from a resource, as identified by its Amazon Resource Name (ARN). Resources are users, servers, roles, and other entities.</p> <p>No response is returned from this call.</p>"
266272
},
@@ -276,7 +282,9 @@
276282
{"shape":"ServiceUnavailableException"},
277283
{"shape":"InternalServiceError"},
278284
{"shape":"InvalidRequestException"},
279-
{"shape":"ResourceNotFoundException"}
285+
{"shape":"ResourceExistsException"},
286+
{"shape":"ResourceNotFoundException"},
287+
{"shape":"ThrottlingException"}
280288
],
281289
"documentation":"<p>Updates the server properties after that server has been created.</p> <p>The <code>UpdateServer</code> call returns the <code>ServerId</code> of the Secure File Transfer Protocol (SFTP) server you updated.</p>"
282290
},
@@ -292,7 +300,8 @@
292300
{"shape":"ServiceUnavailableException"},
293301
{"shape":"InternalServiceError"},
294302
{"shape":"InvalidRequestException"},
295-
{"shape":"ResourceNotFoundException"}
303+
{"shape":"ResourceNotFoundException"},
304+
{"shape":"ThrottlingException"}
296305
],
297306
"documentation":"<p>Assigns new properties to a user. Parameters you pass modify any or all of the following: the home directory, role, and policy for the <code>UserName</code> and <code>ServerId</code> you specify.</p> <p>The response returns the <code>ServerId</code> and the <code>UserName</code> for the updated user.</p>"
298307
}
@@ -301,7 +310,8 @@
301310
"Arn":{
302311
"type":"string",
303312
"max":1600,
304-
"min":20
313+
"min":20,
314+
"pattern":"arn:.*"
305315
},
306316
"CreateServerRequest":{
307317
"type":"structure",
@@ -316,7 +326,7 @@
316326
},
317327
"HostKey":{
318328
"shape":"HostKey",
319-
"documentation":"<p>The RSA private key as generated by the <code>ssh-keygen -N \"\" -f my-new-server-key</code> command.</p> <important> <p>If you aren't planning to migrate existing users from an existing SFTP server to a new AWS SFTP server, don't update the host key. Accidentally changing a server's host key can be disruptive.</p> </important> <p> For more information, see \"https://docs.aws.amazon.com/transfer/latest/userguide/change-host-key\" in the <i>AWS SFTP User Guide.</i> </p>"
329+
"documentation":"<p>The RSA private key as generated by the <code>ssh-keygen -N \"\" -f my-new-server-key</code> command.</p> <important> <p>If you aren't planning to migrate existing users from an existing SFTP server to a new AWS SFTP server, don't update the host key. Accidentally changing a server's host key can be disruptive.</p> </important> <p> For more information, see \"https://alpha-docs-aws.amazon.com/transfer/latest/userguide/configuring-servers.html#change-host-key\" in the <i>AWS SFTP User Guide.</i> </p>"
320330
},
321331
"IdentityProviderDetails":{
322332
"shape":"IdentityProviderDetails",
@@ -356,7 +366,15 @@
356366
"members":{
357367
"HomeDirectory":{
358368
"shape":"HomeDirectory",
359-
"documentation":"<p>The landing directory (folder) for a user when they log in to the server using their SFTP client. An example is <code>/home/<i>username</i> </code>.</p>"
369+
"documentation":"<p>The landing directory (folder) for a user when they log in to the server using their SFTP client. </p> <p>An example is &lt;<code>your-Amazon-S3-bucket-name&gt;/home/username</code>.</p>"
370+
},
371+
"HomeDirectoryType":{
372+
"shape":"HomeDirectoryType",
373+
"documentation":"<p>The type of landing directory (folder) you want your users' home directory to be when they log into the SFTP server. If you set it to <code>PATH</code>, the user will see the absolute Amazon S3 bucket paths as is in their SFTP clients. If you set it <code>LOGICAL</code>, you will need to provide mappings in the <code>HomeDirectoryMappings</code> for how you want to make S3 paths visible to your user.</p>"
374+
},
375+
"HomeDirectoryMappings":{
376+
"shape":"HomeDirectoryMappings",
377+
"documentation":"<p>Logical directory mappings that specify what S3 paths and keys should be visible to your user and how you want to make them visible. You will need to specify the \"<code>Entry</code>\" and \"<code>Target</code>\" pair, where <code>Entry</code> shows how the path is made visible and <code>Target</code> is the actual S3 path. If you only specify a target, it will be displayed as is. You will need to also make sure that your AWS IAM Role provides access to paths in <code>Target</code>. The following is an example.</p> <p> <code>'[ \"/bucket2/documentation\", { \"Entry\": \"your-personal-report.pdf\", \"Target\": \"/bucket3/customized-reports/${transfer:UserName}.pdf\" } ]'</code> </p> <p>In most cases, you can use this value instead of the scope down policy to lock your user down to the designated home directory (\"chroot\"). To do this, you can set <code>Entry</code> to '/' and set <code>Target</code> to the HomeDirectory parameter value. </p>"
360378
},
361379
"Policy":{
362380
"shape":"Policy",
@@ -566,7 +584,15 @@
566584
},
567585
"HomeDirectory":{
568586
"shape":"HomeDirectory",
569-
"documentation":"<p>This property specifies the landing directory (or folder), which is the location that files are written to or read from in an Amazon S3 bucket for the described user. An example is <code>/<i>bucket_name</i>/home/<i>username</i> </code>.</p>"
587+
"documentation":"<p>This property specifies the landing directory (or folder), which is the location that files are written to or read from in an Amazon S3 bucket for the described user. An example is <code>/<i>your s3 bucket name</i>/home/<i>username</i> </code>.</p>"
588+
},
589+
"HomeDirectoryMappings":{
590+
"shape":"HomeDirectoryMappings",
591+
"documentation":"<p>Logical directory mappings that you specified for what S3 paths and keys should be visible to your user and how you want to make them visible. You will need to specify the \"<code>Entry</code>\" and \"<code>Target</code>\" pair, where <code>Entry</code> shows how the path is made visible and <code>Target</code> is the actual S3 path. If you only specify a target, it will be displayed as is. You will need to also make sure that your AWS IAM Role provides access to paths in <code>Target</code>.</p> <p>In most cases, you can use this value instead of the scope down policy to lock your user down to the designated home directory (\"chroot\"). To do this, you can set <code>Entry</code> to '/' and set <code>Target</code> to the HomeDirectory parameter value. </p> <p>In most cases, you can use this value instead of the scope down policy to lock your user down to the designated home directory (\"chroot\"). To do this, you can set <code>Entry</code> to '/' and set <code>Target</code> to the HomeDirectory parameter value.</p>"
592+
},
593+
"HomeDirectoryType":{
594+
"shape":"HomeDirectoryType",
595+
"documentation":"<p>The type of landing directory (folder) you mapped for your users' to see when they log into the SFTP server. If you set it to <code>PATH</code>, the user will see the absolute Amazon S3 bucket paths as is in their SFTP clients. If you set it <code>LOGICAL</code>, you will need to provide mappings in the <code>HomeDirectoryMappings</code> for how you want to make S3 paths visible to your user.</p>"
570596
},
571597
"Policy":{
572598
"shape":"Policy",
@@ -613,6 +639,37 @@
613639
"max":1024,
614640
"pattern":"^$|/.*"
615641
},
642+
"HomeDirectoryMapEntry":{
643+
"type":"structure",
644+
"required":[
645+
"Entry",
646+
"Target"
647+
],
648+
"members":{
649+
"Entry":{
650+
"shape":"MapEntry",
651+
"documentation":"<p>Represents an entry and a target for <code>HomeDirectoryMappings</code>.</p>"
652+
},
653+
"Target":{
654+
"shape":"MapTarget",
655+
"documentation":"<p>Represents the map target that is used in a <code>HomeDirectorymapEntry</code>.</p>"
656+
}
657+
},
658+
"documentation":"<p>Represents an object that contains entries and a targets for <code>HomeDirectoryMappings</code>.</p>"
659+
},
660+
"HomeDirectoryMappings":{
661+
"type":"list",
662+
"member":{"shape":"HomeDirectoryMapEntry"},
663+
"max":50,
664+
"min":1
665+
},
666+
"HomeDirectoryType":{
667+
"type":"string",
668+
"enum":[
669+
"PATH",
670+
"LOGICAL"
671+
]
672+
},
616673
"HostKey":{
617674
"type":"string",
618675
"max":4096,
@@ -866,6 +923,10 @@
866923
"shape":"HomeDirectory",
867924
"documentation":"<p>This value specifies the location that files are written to or read from an Amazon S3 bucket for the user you specify by their ARN.</p>"
868925
},
926+
"HomeDirectoryType":{
927+
"shape":"HomeDirectoryType",
928+
"documentation":"<p>The type of landing directory (folder) you mapped for your users' home directory. If you set it to <code>PATH</code>, the user will see the absolute Amazon S3 bucket paths as is in their SFTP clients. If you set it <code>LOGICAL</code>, you will need to provide mappings in the <code>HomeDirectoryMappings</code> for how you want to make S3 paths visible to your user.</p>"
929+
},
869930
"Role":{
870931
"shape":"Role",
871932
"documentation":"<p>The role in use by this user. A <i>role</i> is an AWS Identity and Access Management (IAM) entity that, in this case, allows the SFTP server to act on a user's behalf. It allows the server to inherit the trust relationship that enables that user to perform file operations to their Amazon S3 bucket.</p>"
@@ -885,6 +946,16 @@
885946
"type":"list",
886947
"member":{"shape":"ListedUser"}
887948
},
949+
"MapEntry":{
950+
"type":"string",
951+
"max":1024,
952+
"pattern":"^/.*"
953+
},
954+
"MapTarget":{
955+
"type":"string",
956+
"max":1024,
957+
"pattern":"^/.*"
958+
},
888959
"MaxResults":{
889960
"type":"integer",
890961
"max":1000,
@@ -898,9 +969,13 @@
898969
},
899970
"NullableRole":{
900971
"type":"string",
972+
"max":2048,
901973
"pattern":"^$|arn:.*role/.*"
902974
},
903-
"Policy":{"type":"string"},
975+
"Policy":{
976+
"type":"string",
977+
"max":2048
978+
},
904979
"Resource":{"type":"string"},
905980
"ResourceExistsException":{
906981
"type":"structure",
@@ -934,12 +1009,17 @@
9341009
},
9351010
"ResourceType":{"type":"string"},
9361011
"Response":{"type":"string"},
1012+
"RetryAfterSeconds":{"type":"string"},
9371013
"Role":{
9381014
"type":"string",
1015+
"max":2048,
1016+
"min":20,
9391017
"pattern":"arn:.*role/.*"
9401018
},
9411019
"ServerId":{
9421020
"type":"string",
1021+
"max":19,
1022+
"min":19,
9431023
"pattern":"^s-([0-9a-f]{17})$"
9441024
},
9451025
"ServiceErrorMessage":{"type":"string"},
@@ -984,6 +1064,8 @@
9841064
"SshPublicKeyCount":{"type":"integer"},
9851065
"SshPublicKeyId":{
9861066
"type":"string",
1067+
"max":21,
1068+
"min":21,
9871069
"pattern":"^key-[0-9a-f]{17}$"
9881070
},
9891071
"SshPublicKeys":{
@@ -1042,7 +1124,10 @@
10421124
},
10431125
"documentation":"<p>Creates a key-value pair for a specific resource. Tags are metadata that you can use to search for and group a resource for various purposes. You can apply tags to servers, users, and roles. A tag key can take more than one value. For example, to group servers for accounting purposes, you might create a tag called <code>Group</code> and assign the values <code>Research</code> and <code>Accounting</code> to that group.</p>"
10441126
},
1045-
"TagKey":{"type":"string"},
1127+
"TagKey":{
1128+
"type":"string",
1129+
"max":128
1130+
},
10461131
"TagKeys":{
10471132
"type":"list",
10481133
"member":{"shape":"TagKey"},
@@ -1066,7 +1151,10 @@
10661151
}
10671152
}
10681153
},
1069-
"TagValue":{"type":"string"},
1154+
"TagValue":{
1155+
"type":"string",
1156+
"max":256
1157+
},
10701158
"Tags":{
10711159
"type":"list",
10721160
"member":{"shape":"Tag"},
@@ -1119,6 +1207,14 @@
11191207
}
11201208
}
11211209
},
1210+
"ThrottlingException":{
1211+
"type":"structure",
1212+
"members":{
1213+
"RetryAfterSeconds":{"shape":"RetryAfterSeconds"}
1214+
},
1215+
"documentation":"<p>The request was denied due to request throttling.</p> <p> HTTP Status Code: 400</p>",
1216+
"exception":true
1217+
},
11221218
"UntagResourceRequest":{
11231219
"type":"structure",
11241220
"required":[
@@ -1185,7 +1281,15 @@
11851281
"members":{
11861282
"HomeDirectory":{
11871283
"shape":"HomeDirectory",
1188-
"documentation":"<p>A parameter that specifies the landing directory (folder) for a user when they log in to the server using their client. An example is <code>/home/<i>username</i> </code>.</p>"
1284+
"documentation":"<p>A parameter that specifies the landing directory (folder) for a user when they log in to the server using their client. </p> <p>An example is <code>&lt;your-Amazon-S3-bucket-name&gt;/home/username</code>.</p>"
1285+
},
1286+
"HomeDirectoryType":{
1287+
"shape":"HomeDirectoryType",
1288+
"documentation":"<p>The type of landing directory (folder) you want your users' home directory to be when they log into the SFTP serve. If you set it to <code>PATH</code>, the user will see the absolute Amazon S3 bucket paths as is in their SFTP clients. If you set it <code>LOGICAL</code>, you will need to provide mappings in the <code>HomeDirectoryMappings</code> for how you want to make S3 paths visible to your user.</p>"
1289+
},
1290+
"HomeDirectoryMappings":{
1291+
"shape":"HomeDirectoryMappings",
1292+
"documentation":"<p>Logical directory mappings that specify what S3 paths and keys should be visible to your user and how you want to make them visible. You will need to specify the \"<code>Entry</code>\" and \"<code>Target</code>\" pair, where <code>Entry</code> shows how the path is made visible and <code>Target</code> is the actual S3 path. If you only specify a target, it will be displayed as is. You will need to also make sure that your AWS IAM Role provides access to paths in <code>Target</code>. The following is an example.</p> <p> <code>'[ \"/bucket2/documentation\", { \"Entry\": \"your-personal-report.pdf\", \"Target\": \"/bucket3/customized-reports/${transfer:UserName}.pdf\" } ]'</code> </p> <p>In most cases, you can use this value instead of the scope down policy to lock your user down to the designated home directory (\"chroot\"). To do this, you can set <code>Entry</code> to '/' and set <code>Target</code> to the HomeDirectory parameter value. </p> <p> </p>"
11891293
},
11901294
"Policy":{
11911295
"shape":"Policy",
@@ -1223,18 +1327,26 @@
12231327
},
12241328
"documentation":"<p> <code>UpdateUserResponse</code> returns the user name and server identifier for the request to update a user's properties.</p>"
12251329
},
1226-
"Url":{"type":"string"},
1330+
"Url":{
1331+
"type":"string",
1332+
"max":255
1333+
},
12271334
"UserCount":{"type":"integer"},
12281335
"UserName":{
12291336
"type":"string",
1337+
"max":32,
1338+
"min":3,
12301339
"pattern":"^[a-zA-Z0-9_][a-zA-Z0-9_-]{2,31}$"
12311340
},
12321341
"UserPassword":{
12331342
"type":"string",
1343+
"max":2048,
12341344
"sensitive":true
12351345
},
12361346
"VpcEndpointId":{
12371347
"type":"string",
1348+
"max":22,
1349+
"min":22,
12381350
"pattern":"^vpce-[0-9a-f]{17}$"
12391351
}
12401352
},

0 commit comments

Comments
 (0)