AWS Transfer Family now supports source IP preservation for SFTP servers behind a Network Load Balancer (NLB)
AWS Transfer Family now preserves client source IP addresses using Proxy Protocol v2 (PPv2) when a Network Load Balancer (NLB) is placed in front of an SFTP server using a VPC-hosted endpoint, enabling IP-based auditing, access controls, and compliance.
When placing a network load balancer before an SFTP server using VPC host endpoints, AWS Transfer Family now retains the client's source IP address using Proxy Protocol v2. This enables IP-based auditing, access control, and compliance. Previously, the NLB replaced the client's source IP with its private IP, recording the NLB's address in Transfer Family logs and events, which prevented authenticating users with their true source IP. The feature can be enabled per Transfer Family server via the console, CLI, or API, and is available in all AWS regions where AWS Transfer Family is offered.
Why it matters
This update affects users who place a Network Load Balancer in front of their SFTP servers. It is useful for applications requiring IP-based auditing, access controls, and compliance.