aws-sdk-transfer 1.145.0 → 1.147.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1bb6c2892600ee08f4c21f9bd8171ceb1a066b15ec4a4fd7eee664eae2605ae
-  data.tar.gz: 02263343d75464e86711741a178ab40551eb920b45ba8c230359ccb80491a09c
+  metadata.gz: a9cbb63695e95961f0e2be8a88cd0919d888d70ab1fab4f12039ec9a5d9d5755
+  data.tar.gz: 52443d5846e6f00571aa3d05773124986fcf2294209517f83f242fb36b49b29a
 SHA512:
-  metadata.gz: 36a9f8b2cb9ba792deafb3541bef2cd27151a85eac4eaf7be60fbc30a1f9c4e36f88353191bce8fec678efbfe7f333f12ea7e1de1ca7213762e2a511193557ef
-  data.tar.gz: 9f4413e7d9fe8271df7bf8ccd0bdc5ed872faa098e678e8c64d156ca5138bfa2e085af2e0f87471bdc76471f5e7352eaeda5ab15e5b2c3af8187b5952c2d5cc4
+  metadata.gz: 5aafb54d26c091bbe835da563b9ce828f4675a29b4f7b069f770dc2768796b071728fc7f2deb142c524f5e6138f225b6f3b454226f4371e28ee83266fee28eda
+  data.tar.gz: c33270ca2ff7a7d6a76093d69c94b88642ee367bd4262fd1a2abfde0775602caf897ff02a5e4fca96f5245837f1fbc8169d680714d2f14c30545f15bb86a619d

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.147.0 (2026-09-29)
+------------------
+
+* Feature - AWS Transfer Family now supports configuring up to three custom ports on public SFTP servers, instead of the single default port 22. You can also set each port's communication mode (server-talk-first or client-talk-first) so legacy and modern SFTP clients connect reliably.
+
+1.146.0 (2026-09-15)
+------------------
+
+* Feature - AWS Transfer Family now preserves the original source IP address using Proxy Protocol v2 when you place a Network Load Balancer in front of your server for SFTP connections.
+
 1.145.0 (2026-09-11)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.145.0
+1.147.0

data/lib/aws-sdk-transfer/client.rb

@@ -1269,6 +1269,9 @@ module Aws::Transfer
     #     CloudWatch Logs, so that you can determine when the client is making
     #     a `SETSTAT` call.
     #
+    #   * To specify which ports your Transfer Family server listens to, use
+    #     the `SftpPorts` parameter.
+    #
     #   * To determine whether your Transfer Family server resumes recent,
     #     negotiated sessions through a unique session ID, use the
     #     `TlsSessionResumptionMode` parameter.
@@ -1384,7 +1387,16 @@ module Aws::Transfer
     #       passive_ip: "PassiveIp",
     #       tls_session_resumption_mode: "DISABLED", # accepts DISABLED, ENABLED, ENFORCED
     #       set_stat_option: "DEFAULT", # accepts DEFAULT, ENABLE_NO_OP
+    #       sftp_ports: [
+    #         {
+    #           sftp_port: 1, # required
+    #           communication_mode: "CLIENT_TALK_FIRST", # accepts CLIENT_TALK_FIRST, SERVER_TALK_FIRST
+    #         },
+    #       ],
     #       as_2_transports: ["HTTP"], # accepts HTTP
+    #       proxy_config: {
+    #         sftp_mode: "NONE", # accepts NONE, PROXY_PROTOCOL_V2_ENFORCED
+    #       },
     #     },
     #     security_policy_name: "SecurityPolicyName",
     #     tags: [
@@ -2692,8 +2704,12 @@ module Aws::Transfer
     #   resp.server.protocol_details.passive_ip #=> String
     #   resp.server.protocol_details.tls_session_resumption_mode #=> String, one of "DISABLED", "ENABLED", "ENFORCED"
     #   resp.server.protocol_details.set_stat_option #=> String, one of "DEFAULT", "ENABLE_NO_OP"
+    #   resp.server.protocol_details.sftp_ports #=> Array
+    #   resp.server.protocol_details.sftp_ports[0].sftp_port #=> Integer
+    #   resp.server.protocol_details.sftp_ports[0].communication_mode #=> String, one of "CLIENT_TALK_FIRST", "SERVER_TALK_FIRST"
     #   resp.server.protocol_details.as_2_transports #=> Array
     #   resp.server.protocol_details.as_2_transports[0] #=> String, one of "HTTP"
+    #   resp.server.protocol_details.proxy_config.sftp_mode #=> String, one of "NONE", "PROXY_PROTOCOL_V2_ENFORCED"
     #   resp.server.domain #=> String, one of "S3", "EFS"
     #   resp.server.endpoint_details.address_allocation_ids #=> Array
     #   resp.server.endpoint_details.address_allocation_ids[0] #=> String
@@ -5150,6 +5166,9 @@ module Aws::Transfer
     #     CloudWatch Logs, so that you can determine when the client is making
     #     a `SETSTAT` call.
     #
+    #   * To specify which ports your Transfer Family server listens to, use
+    #     the `SftpPorts` parameter.
+    #
     #   * To determine whether your Transfer Family server resumes recent,
     #     negotiated sessions through a unique session ID, use the
     #     `TlsSessionResumptionMode` parameter.
@@ -5412,7 +5431,16 @@ module Aws::Transfer
     #       passive_ip: "PassiveIp",
     #       tls_session_resumption_mode: "DISABLED", # accepts DISABLED, ENABLED, ENFORCED
     #       set_stat_option: "DEFAULT", # accepts DEFAULT, ENABLE_NO_OP
+    #       sftp_ports: [
+    #         {
+    #           sftp_port: 1, # required
+    #           communication_mode: "CLIENT_TALK_FIRST", # accepts CLIENT_TALK_FIRST, SERVER_TALK_FIRST
+    #         },
+    #       ],
     #       as_2_transports: ["HTTP"], # accepts HTTP
+    #       proxy_config: {
+    #         sftp_mode: "NONE", # accepts NONE, PROXY_PROTOCOL_V2_ENFORCED
+    #       },
     #     },
     #     endpoint_details: {
     #       address_allocation_ids: ["AddressAllocationId"],
@@ -5773,7 +5801,7 @@ module Aws::Transfer
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-transfer'
-      context[:gem_version] = '1.145.0'
+      context[:gem_version] = '1.147.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-transfer/client_api.rb

@@ -38,6 +38,7 @@ module Aws::Transfer
     CertificateStatusType = Shapes::StringShape.new(name: 'CertificateStatusType')
     CertificateType = Shapes::StringShape.new(name: 'CertificateType')
     CertificateUsageType = Shapes::StringShape.new(name: 'CertificateUsageType')
+    CommunicationMode = Shapes::StringShape.new(name: 'CommunicationMode')
     CompressionEnum = Shapes::StringShape.new(name: 'CompressionEnum')
     ConflictException = Shapes::StructureShape.new(name: 'ConflictException')
     ConnectorEgressConfig = Shapes::UnionShape.new(name: 'ConnectorEgressConfig')
@@ -273,6 +274,8 @@ module Aws::Transfer
     Protocol = Shapes::StringShape.new(name: 'Protocol')
     ProtocolDetails = Shapes::StructureShape.new(name: 'ProtocolDetails')
     Protocols = Shapes::ListShape.new(name: 'Protocols')
+    ProxyConfig = Shapes::StructureShape.new(name: 'ProxyConfig')
+    ProxyMode = Shapes::StringShape.new(name: 'ProxyMode')
     Resource = Shapes::StringShape.new(name: 'Resource')
     ResourceExistsException = Shapes::StructureShape.new(name: 'ResourceExistsException')
     ResourceNotFoundException = Shapes::StructureShape.new(name: 'ResourceNotFoundException')
@@ -321,6 +324,8 @@ module Aws::Transfer
     SftpConnectorTrustedHostKey = Shapes::StringShape.new(name: 'SftpConnectorTrustedHostKey')
     SftpConnectorTrustedHostKeyList = Shapes::ListShape.new(name: 'SftpConnectorTrustedHostKeyList')
     SftpPort = Shapes::IntegerShape.new(name: 'SftpPort')
+    SftpPortWithOptions = Shapes::StructureShape.new(name: 'SftpPortWithOptions')
+    SftpPorts = Shapes::ListShape.new(name: 'SftpPorts')
     SigningAlg = Shapes::StringShape.new(name: 'SigningAlg')
     SourceFileLocation = Shapes::StringShape.new(name: 'SourceFileLocation')
     SourceIp = Shapes::StringShape.new(name: 'SourceIp')
@@ -1275,11 +1280,16 @@ module Aws::Transfer
     ProtocolDetails.add_member(:passive_ip, Shapes::ShapeRef.new(shape: PassiveIp, location_name: "PassiveIp"))
     ProtocolDetails.add_member(:tls_session_resumption_mode, Shapes::ShapeRef.new(shape: TlsSessionResumptionMode, location_name: "TlsSessionResumptionMode"))
     ProtocolDetails.add_member(:set_stat_option, Shapes::ShapeRef.new(shape: SetStatOption, location_name: "SetStatOption"))
+    ProtocolDetails.add_member(:sftp_ports, Shapes::ShapeRef.new(shape: SftpPorts, location_name: "SftpPorts"))
     ProtocolDetails.add_member(:as_2_transports, Shapes::ShapeRef.new(shape: As2Transports, location_name: "As2Transports"))
+    ProtocolDetails.add_member(:proxy_config, Shapes::ShapeRef.new(shape: ProxyConfig, location_name: "ProxyConfig"))
     ProtocolDetails.struct_class = Types::ProtocolDetails
 
     Protocols.member = Shapes::ShapeRef.new(shape: Protocol)
 
+    ProxyConfig.add_member(:sftp_mode, Shapes::ShapeRef.new(shape: ProxyMode, location_name: "SftpMode"))
+    ProxyConfig.struct_class = Types::ProxyConfig
+
     ResourceExistsException.add_member(:message, Shapes::ShapeRef.new(shape: Message, required: true, location_name: "Message"))
     ResourceExistsException.add_member(:resource, Shapes::ShapeRef.new(shape: Resource, required: true, location_name: "Resource"))
     ResourceExistsException.add_member(:resource_type, Shapes::ShapeRef.new(shape: ResourceType, required: true, location_name: "ResourceType"))
@@ -1348,6 +1358,12 @@ module Aws::Transfer
 
     SftpConnectorTrustedHostKeyList.member = Shapes::ShapeRef.new(shape: SftpConnectorTrustedHostKey)
 
+    SftpPortWithOptions.add_member(:sftp_port, Shapes::ShapeRef.new(shape: SftpPort, required: true, location_name: "SftpPort"))
+    SftpPortWithOptions.add_member(:communication_mode, Shapes::ShapeRef.new(shape: CommunicationMode, location_name: "CommunicationMode"))
+    SftpPortWithOptions.struct_class = Types::SftpPortWithOptions
+
+    SftpPorts.member = Shapes::ShapeRef.new(shape: SftpPortWithOptions)
+
     SshPublicKey.add_member(:date_imported, Shapes::ShapeRef.new(shape: DateImported, required: true, location_name: "DateImported"))
     SshPublicKey.add_member(:ssh_public_key_body, Shapes::ShapeRef.new(shape: SshPublicKeyBody, required: true, location_name: "SshPublicKeyBody"))
     SshPublicKey.add_member(:ssh_public_key_id, Shapes::ShapeRef.new(shape: SshPublicKeyId, required: true, location_name: "SshPublicKeyId"))

data/lib/aws-sdk-transfer/types.rb

@@ -1075,6 +1075,9 @@ module Aws::Transfer
     #     to Amazon CloudWatch Logs, so that you can determine when the
     #     client is making a `SETSTAT` call.
     #
+    #   * To specify which ports your Transfer Family server listens to, use
+    #     the `SftpPorts` parameter.
+    #
     #   * To determine whether your Transfer Family server resumes recent,
     #     negotiated sessions through a unique session ID, use the
     #     `TlsSessionResumptionMode` parameter.
@@ -3160,6 +3163,9 @@ module Aws::Transfer
     #     to Amazon CloudWatch Logs, so that you can determine when the
     #     client is making a `SETSTAT` call.
     #
+    #   * To specify which ports your Transfer Family server listens to, use
+    #     the `SftpPorts` parameter.
+    #
     #   * To determine whether your Transfer Family server resumes recent,
     #     negotiated sessions through a unique session ID, use the
     #     `TlsSessionResumptionMode` parameter.
@@ -5868,18 +5874,111 @@ module Aws::Transfer
     #    </note>
     #   @return [String]
     #
+    # @!attribute [rw] sftp_ports
+    #   A property used with Transfer Family servers that use the SFTP
+    #   protocol and have `PUBLIC` endpoints. This property accepts a list
+    #   of up to three port configurations that the service opens on the
+    #   server endpoint.
+    #
+    #   Each entry in the list consists of two parameters, the `SftpPort`
+    #   and the `CommunicationMode`. The `SftpPort` takes any integer from
+    #   2000 to 65535, or 22. `CommunicationMode` can be one of the
+    #   following options:
+    #
+    #   * `SERVER_TALK_FIRST`: The server responds to initial TCP
+    #     connections first. Many older clients expect that an SFTP server
+    #     responds with its server string before starting SSH negotiations.
+    #
+    #   * `CLIENT_TALK_FIRST`: The server responds to the initial TCP
+    #     connection only after receiving a data packet. Most modern clients
+    #     support this behavior and send their client string along with the
+    #     initial data packets for SSH negotiation. Additionally, this mode
+    #     is more resilient to TCP retransmissions that can occur during the
+    #     initial TCP connection.
+    #
+    #   The following is an `SftpPorts` example for port 2222 with
+    #   `CLIENT_TALK_FIRST`.
+    #
+    #   `[ { "SftpPort": 2222, "CommunicationMode": "CLIENT_TALK_FIRST" } ]`
+    #
+    #   If you don't specify any configurations during `CreateServer`, the
+    #   service uses port 22 with `SERVER_TALK_FIRST` by default.
+    #   @return [Array<Types::SftpPortWithOptions>]
+    #
     # @!attribute [rw] as_2_transports
     #   Indicates the transport method for the AS2 messages. Currently, only
     #   HTTP is supported.
     #   @return [Array<String>]
     #
+    # @!attribute [rw] proxy_config
+    #   The configuration for PROXY protocol version 2 (PPv2) support on the
+    #   Transfer Family server. For more information, see [Working with
+    #   Network Load Balancers][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/transfer/latest/userguide/working-with-nlb.html
+    #   @return [Types::ProxyConfig]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/transfer-2018-11-05/ProtocolDetails AWS API Documentation
     #
     class ProtocolDetails < Struct.new(
       :passive_ip,
       :tls_session_resumption_mode,
       :set_stat_option,
-      :as_2_transports)
+      :sftp_ports,
+      :as_2_transports,
+      :proxy_config)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Contains configuration for PROXY protocol version 2 (PPv2) support on
+    # an Transfer Family server. When enabled, Transfer Family reads the
+    # added PPv2 header from incoming connections to extract the client's
+    # source IP address. This address is then available in Amazon CloudWatch
+    # Logs entries and is passed to custom identity providers during
+    # authentication, enabling IP-based access policies. For more
+    # information, see [Working with Network Load Balancers][1].
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/transfer/latest/userguide/working-with-nlb.html
+    #
+    # @!attribute [rw] sftp_mode
+    #   Specifies whether the Transfer Family server requires or ignores a
+    #   PPv2 header containing the client's source IP address on incoming
+    #   SFTP connections. If you don't specify a value, the default is
+    #   `NONE`
+    #
+    #   * `NONE`: the server reads and ignores any PPv2 header on incoming
+    #     SFTP connections. This is the default value. Use this value when
+    #     your SFTP server is not behind an NLB, or when you do not need to
+    #     preserve the client's source IP address through an NLB.
+    #
+    #   * `PROXY_PROTOCOL_V2_ENFORCED`: the server requires a valid PPv2
+    #     header on every incoming SFTP connection. When a valid header is
+    #     present, the server applies it and uses the source IP address from
+    #     the header. If a connection arrives without a PPv2 header, the
+    #     server refuses the connection and logs an error to Amazon
+    #     CloudWatch Logs indicating that the expected PPv2 header was
+    #     missing. Use this value when your SFTP server is behind an NLB
+    #     with PPv2 enabled on the target group.
+    #
+    #     With `PROXY_PROTOCOL_V2_ENFORCED` you must restrict the server's
+    #     VPC endpoint security group to allow inbound traffic only via the
+    #     trusted NLB. For more information, see [Working with Network Load
+    #     Balancers][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/transfer/latest/userguide/working-with-nlb.html
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/transfer-2018-11-05/ProxyConfig AWS API Documentation
+    #
+    class ProxyConfig < Struct.new(
+      :sftp_mode)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -6227,6 +6326,33 @@ module Aws::Transfer
       include Aws::Structure
     end
 
+    # Specifies the configuration for a single SFTP port on a Transfer
+    # Family server that uses the SFTP protocol and has a `PUBLIC` endpoint.
+    # Each entry in the `SftpPorts` list is an `SftpPortWithOptions` object
+    # that pairs a port number with a communication mode.
+    #
+    # @!attribute [rw] sftp_port
+    #   The port on which the Transfer Family server listens for SFTP
+    #   connections. Specify any integer from 2000 to 65535, or 22. This
+    #   value is required for each entry in the `SftpPorts` list.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] communication_mode
+    #   Determines whether the server or the client sends data first when a
+    #   client establishes an SFTP connection on this port. Valid values are
+    #   `SERVER_TALK_FIRST` and `CLIENT_TALK_FIRST`. For a description of
+    #   each mode, see the `SftpPorts` property. This value is optional.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/transfer-2018-11-05/SftpPortWithOptions AWS API Documentation
+    #
+    class SftpPortWithOptions < Struct.new(
+      :sftp_port,
+      :communication_mode)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Provides information about the public Secure Shell (SSH) key that is
     # associated with a Transfer Family user for the specific file transfer
     # protocol-enabled server (as identified by `ServerId`). The information
@@ -7365,6 +7491,9 @@ module Aws::Transfer
     #     to Amazon CloudWatch Logs, so that you can determine when the
     #     client is making a `SETSTAT` call.
     #
+    #   * To specify which ports your Transfer Family server listens to, use
+    #     the `SftpPorts` parameter.
+    #
     #   * To determine whether your Transfer Family server resumes recent,
     #     negotiated sessions through a unique session ID, use the
     #     `TlsSessionResumptionMode` parameter.

data/lib/aws-sdk-transfer.rb

@@ -55,7 +55,7 @@ module Aws::Transfer
   autoload :EndpointProvider, 'aws-sdk-transfer/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-transfer/endpoints'
 
-  GEM_VERSION = '1.145.0'
+  GEM_VERSION = '1.147.0'
 
 end
 

data/sig/client.rbs

@@ -218,12 +218,7 @@ module Aws
                            ?post_authentication_login_banner: ::String,
                            ?pre_authentication_login_banner: ::String,
                            ?protocols: Array[("SFTP" | "FTP" | "FTPS" | "AS2")],
-                           ?protocol_details: {
-                             passive_ip: ::String?,
-                             tls_session_resumption_mode: ("DISABLED" | "ENABLED" | "ENFORCED")?,
-                             set_stat_option: ("DEFAULT" | "ENABLE_NO_OP")?,
-                             as_2_transports: Array[("HTTP")]?
-                           },
+                           ?protocol_details: Params::protocol_details,
                            ?security_policy_name: ::String,
                            ?tags: Array[
                              {
@@ -1040,12 +1035,7 @@ module Aws
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/Transfer/Client.html#update_server-instance_method
       def update_server: (
                            ?certificate: ::String,
-                           ?protocol_details: {
-                             passive_ip: ::String?,
-                             tls_session_resumption_mode: ("DISABLED" | "ENABLED" | "ENFORCED")?,
-                             set_stat_option: ("DEFAULT" | "ENABLE_NO_OP")?,
-                             as_2_transports: Array[("HTTP")]?
-                           },
+                           ?protocol_details: Params::protocol_details,
                            ?endpoint_details: {
                              address_allocation_ids: Array[::String]?,
                              subnet_ids: Array[::String]?,

data/sig/params.rbs

@@ -25,6 +25,22 @@ module Aws
       }?
     }
 
+      type protocol_details = {
+      passive_ip: ::String?,
+      tls_session_resumption_mode: ("DISABLED" | "ENABLED" | "ENFORCED")?,
+      set_stat_option: ("DEFAULT" | "ENABLE_NO_OP")?,
+      sftp_ports: Array[
+        {
+          sftp_port: ::Integer,
+          communication_mode: ("CLIENT_TALK_FIRST" | "SERVER_TALK_FIRST")?
+        }
+      ]?,
+      as_2_transports: Array[("HTTP")]?,
+      proxy_config: {
+        sftp_mode: ("NONE" | "PROXY_PROTOCOL_V2_ENFORCED")?
+      }?
+    }
+
       type workflow_details = {
       on_upload: Array[
         {

data/sig/types.rbs

@@ -1125,7 +1125,14 @@ module Aws::Transfer
       attr_accessor passive_ip: ::String
       attr_accessor tls_session_resumption_mode: ("DISABLED" | "ENABLED" | "ENFORCED")
       attr_accessor set_stat_option: ("DEFAULT" | "ENABLE_NO_OP")
+      attr_accessor sftp_ports: ::Array[Types::SftpPortWithOptions]
       attr_accessor as_2_transports: ::Array[("HTTP")]
+      attr_accessor proxy_config: Types::ProxyConfig
+      SENSITIVE: []
+    end
+
+    class ProxyConfig
+      attr_accessor sftp_mode: ("NONE" | "PROXY_PROTOCOL_V2_ENFORCED")
       SENSITIVE: []
     end
 
@@ -1202,6 +1209,12 @@ module Aws::Transfer
       SENSITIVE: []
     end
 
+    class SftpPortWithOptions
+      attr_accessor sftp_port: ::Integer
+      attr_accessor communication_mode: ("CLIENT_TALK_FIRST" | "SERVER_TALK_FIRST")
+      SENSITIVE: []
+    end
+
     class SshPublicKey
       attr_accessor date_imported: ::Time
       attr_accessor ssh_public_key_body: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-transfer
 version: !ruby/object:Gem::Version
-  version: 1.145.0
+  version: 1.147.0
 platform: ruby
 authors:
 - Amazon Web Services