Compliant SFTP endpoint
The Compliant SFTP endpoint blueprint (sftp v1) deploys an AWS Transfer
Family server for exchanging files with partners: SFTP only, SSH
public-key authentication, one isolated home prefix per user, and session
logging with a retention window set by your adopted framework.
What it provisions
Section titled “What it provisions”- A Transfer Family server: SFTP is the only protocol (no FTP or FTPS listener), service-managed identities, S3 storage.
- A backing S3 bucket with SSE-KMS default encryption using a dedicated customer-managed KMS key (annual rotation enabled), versioning, and all public access blocked. The endpoint can instead back onto an existing Secure Bucket deployment via a wired link.
- Per-user isolation: each SFTP user gets a Transfer Family user, an
SSH key, and a least-privilege IAM role confined to its own
home/<user>/prefix. No user can list or read another user’s prefix. - A CloudWatch log group for session and transfer activity. Retention comes from your adopted framework’s parameters (2,190 days for a HIPAA profile; 365 for SOC 2 only).
- A CIDR-restricted ingress security group.
One caveat ships with the mapping and is worth reading before you deploy: the v1 endpoint is public, and AWS attaches security groups only to VPC endpoints, so the allowed CIDR ranges are declared and provisioned but not network-enforced. SSH public-key authentication is the enforced access control. The VPC endpoint variant is the planned v2 posture.
Inputs
Section titled “Inputs”| Input | Required | Description |
|---|---|---|
| Endpoint name | Yes | Prefixes every resource this template creates. |
| Target VPC | Yes | Chosen from the discovered inventory. |
| Allowed CIDR blocks | Yes | One per line; provisioned as the ingress security group. |
| SFTP users | Yes | One or more: unique username plus SSH public key, and optionally a destination bucket. |
Region, tags, and the log-retention parameter are platform-supplied.
Control mapping
Section titled “Control mapping”Generated from backend/templates/sftp/v1/controls.yaml (framework: hipaa-security-rule). Run npm run generate:blueprints to refresh.
| HIPAA citation | Requirement | Status | Implemented by |
|---|---|---|---|
| §164.312(a)(1) | Access control | Partial | aws_iam_role_policy.sftp_user_scope, aws_security_group.sftp_ingress |
| §164.312(a)(2)(i) | Unique user identification | Implemented | aws_transfer_user.sftp |
| §164.312(a)(2)(iv) | Encryption and decryption | Implemented | aws_s3_bucket_server_side_encryption_configuration.sftp, aws_kms_key.sftp |
| §164.312(b) | Audit controls | Partial | aws_cloudwatch_log_group.sftp, platform.audit_timeline |
| §164.312(c)(1) | Integrity | Implemented | aws_s3_bucket_versioning.sftp |
| §164.312(d) | Person or entity authentication | Implemented | aws_transfer_ssh_key.sftp |
| §164.312(e)(1) | Transmission security | Implemented | aws_transfer_server.sftp |
| §164.312(e)(2)(ii) | Encryption (in transit) | Implemented | aws_transfer_server.sftp |
| §164.308(a)(1)(ii)(D) | Information system activity review | Partial | aws_cloudwatch_log_group.sftp, platform.audit_timeline |
| §164.308(a)(4)(i) | Information access management | Implemented | aws_iam_role_policy.sftp_user_scope, aws_s3_bucket_public_access_block.sftp |
Caveats recorded in the mapping, shown verbatim:
- §164.312(a)(1): G1: the v1 endpoint is public and AWS attaches security groups only to VPC endpoints, so the allowed CIDR ranges are declared and provisioned but not network-enforced. SSH public-key authentication is the enforced access control. The VPC endpoint variant is the v2 posture.
- §164.312(b): G2: session logs flow through the service’s legacy logging role into the /aws/transfer/
group. The template manages that group’s retention (var.log_retention_days, re-pointed 2026-07-21, awaiting live verification on the next deployment); structured logging in a dedicated namespace is deferred to the v2 landing zone. - §164.308(a)(1)(ii)(D): G2: shares the audit-controls caveat - retention managed by var.log_retention_days, re-pointed to the receiving log group 2026-07-21, awaiting live verification; structured logging deferred to v2.
Generated documents
Section titled “Generated documents”Once applied, the Documentation Center derives a System overview, an Endpoint runbook (connect instructions per user, data layout, key rotation, teardown), and a Control narrative. The deployment page also shows per-partner key instructions for onboarding.
Revising a live endpoint
Section titled “Revising a live endpoint”This is the one blueprint that supports revise: add partners, allowed CIDR blocks, or an additional Secure Bucket destination to an applied endpoint. Revising re-plans and goes through approval again; the endpoint name, VPC, and primary bucket never change.