Getting Started with SFTP Gateway 3.x

Introduction

SFTP Gateway is a pre-configured SFTP server that transfers uploaded files to an Amazon S3 bucket. To start, you need to create a user and password (or SSH key). This can be done through the SFTP Gateway web admin interface. After that, you can upload your files to the SFTP server. Behind the scenes, the files are uploaded to an Amazon S3 bucket. Once uploaded, you can view them directly in S3.

This guide will focus on getting started with a Single Instance SFTP Gateway setup for testing.

Before you begin

EC2 Key Pair

You will need to create an EC2 Key Pair in order to SSH into your instances. Although most SFTP Gateway configuration is via the web interface, there may be times when you need command line access.

To create an EC2 key pair:

1. Log into AWS and go to the EC2 console

2. In the navigation panel, under the Network & Security section, go to Key Pairs

3. Click Create Key Pair

4. Enter a name for the new key pair and click Create

   Note: When you click Create, your browser will download a private key file. This must be kept secure in a place where you can always find it. If this file is lost or deleted, it is difficult to regain access to your EC2 instance.

Subscribe

You first need to subscribe to the SFTP Gateway product. Doing so allows your AWS account to use the SFTP Gateway AMI.

Click here to open the AWS Marketplace page for SFTP Gateway.

Click the Continue to Subscribe button.

Click the Accept Terms button.

Click either Proceed or I'll do this later to get past the Product Support Connection modal.

Once you are subscribed, click Continue to Configuration.

Under the Fulfillment Option, choose CloudFormation Template and pick one of the options:

• SFTP Gateway (Single Instance New Network)
• SFTP Gateway (Single Instance Existing Network)
• SFTP Gateway (High Availability New Network)
• SFTP Gateway (High Availability Existing Network)

Click Continue to Launch

On the Launch this software page, under Choose Action, select Launch CloudFormation and click Launch

This will take you to the CloudFormation service in the AWS console.

Spinning up an SFTP Gateway CloudFormation stack

If you followed the instructions in the previous section, you should now be in the CloudFormation service within the AWS console.

The Template source should be pointing to a location on S3 corresponding to the CloudFormation template you specified.

To spin up a Single Instance (New Network) CloudFormation stack of SFTP Gateway:

1. The Template source is already selected, so click Next to continue.

2. Enter the details for the stack:

   • Stack name: The name of your CloudFormation stack.

   • Bucket Access: The default is restricted, which limits access to S3 buckets following a naming convention. Choose open to allow access to all S3 buckets.

   • EC2 Type: Defaults to t3.medium. We recommend using m5.large for production workloads.

   • Disk Volume Size (GB): This must be 32 (the volume size of the AMI) or higher. You can always increase this at a later time (see Resizing an EC2 instance volume).

   • VPC: Select a VPC that has a public subnet.

   • SubnetID: elect a public subnet in the above VPC.

   • InputCIDR: An IP range that allows inbound SSH and SFTP traffic to your EC2 instance. We recommend obtaining your computer's public IP from http://checkip.dyndns.org/ and then appending /32 (a CIDR range of a single address). Although you can use 0.0.0.0/0 to allow all traffic, this weakens your security posture.

   • Key Pair. Choose the EC2 key pair you created in the Before you begin section. You will need the private key in order to SSH into the server. For more information on public and private keys see, SSH Key Pairs.

3. Stack Options: The stack options page can be left as is. Scroll to the bottom of the page and click Next.

4. Review and create stack.

   • You must check the box that reads I acknowledge that AWS CloudFormation might create IAM resources to give CloudFormation permission to create IAM resources.

The stack creation progress can be monitored by selecting the stack and viewing the Events tab. Any errors that occur during creation will appear in the event log.

Access the Admin Interface

To access SFTP Gateway admin interface, go to the output tab of the stack in your AWS CloudFormation console and copy the Hostname value (Fig-1).

Fig-1

Paste the url in the address bar of your browser (Fig-2).

Fig-2

Log into the user interface

1. Use admin as your username.

2. Use the password that you chose during the setup process.

3. Click Sign In.

You can learn more about the user interface here.

Create a new user

To add a new user, click on the "Create user" button in the top right corner. You will be taken to the Create User form (click here to learn more).

1. Enter a username.

2. Select Generate new SSH key pair to generate a new key pair for the user. The private key will be downloaded when the user is created. Alternatively, you can select Upload user-provided SSH key to upload an existing public key.

3. Click Save. You will be presented with connection instructions that you can copy and paste into an email to the user, along with their new private key (if generated).

By default, files that SFTP users upload will end up in the default S3 bucket that you specified during the setup process.

Connection With FTP Client

For more information on how your users can connect to SFTP Gateway with an FTP client such as FileZilla or WinSCP, please see our SFTP Client Article

View your files on S3

Once you are done transferring the files, go to S3 in your AWS console and navigate to your default SFTP Gateway bucket that you specified earlier. (If you forget the name, you can see it on the settings page in the admin UI).

Fig-5

Video Example

For more information, we have a video that walks through setting up SFTP Gateway on AWS.