AWS Transfer Family now supports source IP preservation for SFTP servers behind a Network Load Balancer (NLB)
AWS Transfer Family now preserves client source IP addresses using Proxy Protocol v2 (PPv2) when a Network Load Balancer (NLB) is placed in front of an SFTP server using a VPC-hosted endpoint, enabling IP-based auditing, access controls, and compliance.
When placing a network load balancer (NLB) before an SFTP server using VPC host endpoints, AWS Transfer Family now retains the client's source IP address using Proxy Protocol v2 (PPv2). Previously, the NLB replaced the client's source IP with its private IP, so Transfer Family logs and events recorded the NLB's address, preventing authentication with the user's true source IP for custom identity providers. Enabling this feature records the client's source IP in logs and events and presents it to custom identity providers during authentication. The feature can be enabled for individual Transfer Family servers via the console, CLI, or API.
Why it matters
AWS Transfer Family provides file transfer services. The ability to preserve client source IPs when using an NLB with SFTP servers enhances security and compliance.