terraform-aws-transfer

This is a Terraform module to create a custom identity provider for the AWS Transfer for SFTP service.

This module aims to set up an identity provider built on:

This module will output the URL for the API Gateway which should be used as the url argument for the aws_transfer_server resource

Credential Store

A DynamoDB table will be created by the resource and can be used to store SFTP user credentials and user directory details.

Alternatively for security, the credentials can be stored as AWS Secrets.

The infrastructure code is based on the example provided (in the CF template) in the AWS Storage Blog article https://aws.amazon.com/blogs/storage/enable-password-authentication-for-aws-transfer-for-sftp-using-aws-secrets-manager/. That example uses AWS Secrets Manager which costs $0.40 per Secret so a DynamoDB based solution may be more palatable as having many users may incur high costs on smaller budgets.

Name	Description	Type	Default	Required
dynamo_table_name	A name for the dynamodb table that will be created	string		yes
creds_store	The creds store that will be used for authentication Valid should be: dynamo or secrets	string	dynamo	yes

Name	Description
invoke_url	The URL which the SFTP service will use to send authentication requests to
rest_api_id	The ARN of the REST service created. This should be used in the IAM role for SFTP to invoke the service
rest_api_stage_name	The stage name of the REST service created. This should be used in the IAM role for SFTP to invoke the service

module "sftp-idp" {
  source                = "../.."
  dynamo_table_name      = "my-sftp-authentication-table"
}

This module supports Terraform v0.12 and v0.13