AWS Transfer Family Can Now See the Real Client IP Even Behind an NLB!

Hi, it's me, Shii-chan! Today I found an update that looks a bit low-key, but I think security folks will love it. It sounds like a networking detail, but really it's about finally knowing exactly who accessed your server, and from where!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, AWS Transfer Family SFTP servers running behind a Network Load Balancer (NLB) can now preserve the client's source IP address. It works using Proxy Protocol v2 (PPv2), and it applies to SFTP servers that use a VPC-hosted endpoint.

The story so far

Until now, putting an NLB in front of an SFTP server meant the NLB replaced the client's source IP with its own private IP address. That meant your Transfer Family logs and events recorded the NLB's address instead of the actual client's IP.

Even worse, the NLB's private IP was also what got presented to your custom identity provider during authentication, so you couldn't authorize users based on their real source IP. If you needed accurate audit trails of who connected from where, that gap was a real headache.

What changes

With this update, you can enable source IP preservation on each SFTP server individually. Once it's on, here's what changes:

• Logs and events now record the client's real source IP instead of the NLB's IP
• Your custom identity provider also receives the real client IP during authentication, so you can build IP-based authorization rules
• IP-based auditing, access control, and compliance work all get easier

If your team needs to restrict access to specific IP ranges, or has to keep accurate records of where connections come from for regulatory reasons, this is a small change that solves a real pain point.

Dive Deep

You can turn this on per server through the console, CLI, or API. If you already run SFTP behind an NLB, it's just a matter of flipping one setting on the server to start seeing the correct source IP.

The feature is available in every AWS Region where AWS Transfer Family is available, so there's no regional waiting game. Detailed console steps are covered in the Transfer Family User Guide's NLB-related page.

Wrap-up

• SFTP servers behind an NLB can now preserve the client's source IP using Proxy Protocol v2
• Previously, only the NLB's IP reached your logs and your identity provider, making IP-based authorization and auditing difficult
• You can enable it per server via console, CLI, or API, in every Region where Transfer Family is available

If you run SFTP behind an NLB and need accurate source IP tracking for compliance, this is a setting worth checking out next week!