Store AWS Transfer Family SFTP Host Keys in Secrets Manager for Easier Migration and Failover!
Hi everyone, it's Shii-chan! Here's an update for anyone running SFTP servers.
AWS What's New
aws.amazon.com
What was announced?
AWS What's New announced that AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. That gives you more control over your server identity and helps simplify server migrations and failover.
The story so far
Transfer Family used to store host keys within the service, so you could not retrieve the associated private key material. That meant you couldn't give another server the same host key.
What changes
When creating a server or importing a host key, you can now choose Secrets Manager as the storage type. Because you can retrieve the private key, you can reuse the same host key across servers and Regions.
- Use it on a standby server for failover
- Use it on a replacement server during migration
- In both cases, clients don't have to trust a new host key
Dive Deep
- AWS Identity and Access Management (IAM) policies control who can retrieve the stored keys
- You can also migrate existing host keys to Secrets Manager, which may require additional steps, so check the AWS Transfer Family User Guide
- Available in all AWS Regions where AWS Transfer Family is available
- To get started, go to the Transfer Family console; for details, see "Store SFTP server host keys in AWS Secrets Manager" in the User Guide
Wrap-up
- SFTP server host keys can be stored in Secrets Manager in your own account
- You can retrieve the private key and reuse the same host key across servers and Regions
- IAM policies control access, and existing keys can be migrated (possibly with extra steps)
This is for engineers who want SFTP failover or migration without disrupting clients!
