Set up an AWS Transfer Family server with Amazon Cognito as a custom identity provider

Open AWS CloudShell and ensure you are in a region you want to deploy the solution.

Clone the git repository into your environment

cd ~
git clone https://github.com/aws-samples/toolkit-for-aws-transfer-family.git

Run the following command to start the build script.

This script downloads all package dependencies and generates archives for the Lambda layer and function used in the solution.

cd ~/toolkit-for-aws-transfer-family/solutions/custom-idp
./build.sh

Monitor the execution and verify that the script completes successfully.

Run the following command to deploy the custom idp solution using the AWS SAM template.

sam deploy --guided --capabilities "CAPABILITY_NAMED_IAM"

At the prompts, provide the values as highlighted in the image:

Open AWS CloudFormation, and check the Status column for the transfer-family-custom-idp-solution stack.

Successful status is CREATE_COMPLETE

Select the stack and review the Outputs tab. We will need this information in future tasks.

Open AWS CloudShell and paste the following command to create an Amazon Cognito user pool.

aws cognito-idp create-user-pool \
  --pool-name "TransferFamilyUserPool" \
  --username-configuration CaseSensitive=false \
  --auto-verified-attributes email \
  --schema '[
    {
      "Name": "email",
      "AttributeDataType": "String",
      "Mutable": false,
      "Required": true
    },
    {
      "Name": "name",
      "AttributeDataType": "String",
      "Mutable": true,
      "Required": true
    }
  ]'

Copy and save the user pool id (format: region_xxxxxxxxxxxxx) from the command output.

In the same command line, paste the following command with your newly created user pool id to create an Amazon Cognito user pool client for the user pool created above.

aws cognito-idp create-user-pool-client \
  --user-pool-id YOUR_USER_POOL_ID \
  --client-name "TransferUserPoolClient" \
  --explicit-auth-flows ALLOW_USER_PASSWORD_AUTH ALLOW_REFRESH_TOKEN_AUTH ALLOW_USER_SRP_AUTH ALLOW_CUSTOM_AUTH \
  --allowed-o-auth-flows-user-pool-client \
  --callback-urls "http://localhost:3000" \
  --allowed-o-auth-flows code implicit \
  --allowed-o-auth-scopes phone email openid profile \
  --supported-identity-providers COGNITO

Save the ClientId in a secure location

We will use the user pool ID and Client ID to configure the identity provider for the Transfer Family Server.

Paste the following commands to create a new user named John in the Cognito User Pool created above.

Update USER_POOL_ID from previous step and choose a password of your choice.

Create a user named John:

aws cognito-idp admin-create-user --user-pool-id USER_POOL_ID --username john --temporary-password "PASSWORD" --message-action SUPPRESS --user-attributes Name=email,Value=john@example.com Name=email_verified,Value=true

Set permanent password:

aws cognito-idp admin-set-user-password --user-pool-id USER_POOL_ID --username john --password "PASSWORD" --permanent

Open Amazon DynamoDB, choose Tables from the navigation on the left hand side, then select the transfer-family-custom-idp-solution_identity_providers table.

Select Explore table items and then select Create item.

In the Create item screen, select JSON View, then paste the following into the record.

Update cognito_client_id value with your ClientId created in the previous task.

{ "provider": { "S": "CognitoIDP" }, "config": { "M": { "cognito_client_id": { "S": "YOUR_OWN_CLIENT_ID" } } }, "module": { "S": "cognito" }

Select Create item.

Now, select the transfer-family-custom-idp-solution_users table, then select Create item.

In the Create item screen, select JSON View, then paste the following into the record.

Update YOUR-BUCKET-NAME and ACCOUNTNUMBER accordingly and select Create item.

{ "user": { "S": "john" }, "identity_provider_key": { "S": "CognitoIDP" },
 "config": { "M": { "HomeDirectoryDetails": { "L": [ { "M": { "Entry": { "S": "/john" }, "Target": { "S": "/YOUR-BUCKET-NAME/john" } } } ] }, "HomeDirectoryType": { "S": "LOGICAL" }, "Role": { "S": "arn:aws:iam::ACCOUNTNUMBER:role/transfer-family-custom-idp-user-role" } } } }

Find the TRANSFER_FAMILY_SERVER_ENDPOINT_URL by opening to AWS Transfer Family and choosing Servers in the navigation bar.

Select the server you created and copy the Endpoint URL.

Open AWS CloudShell and create a test file for John by pasting the following command:

echo "This is just some text." > index.txt

Log into the AWS Transfer Family server as John by pasting the following command:

sftp john@TRANSFER_FAMILY_SERVER_ENDPOINT_URL

Enter yes for RSA key fingerprint. Press the enter key. Enter the password you set in Amazon Cognito for the user, and press the enter key.

View the contents of the logical directories that are mapped for John by running ls command.

Upload the index.txt file to the john folder.

Empty Amazon S3 bucket (required before deletion):

aws s3 rm s3://YOUR-BUCKET-NAME --recursive --region $AWS_REGION

Then delete the empty bucket:

aws s3 rb s3://YOUR-BUCKET-NAMEE --region $AWS_REGION

Detach AWS IAM policy from the AWS IAM role and then delete both:

aws iam detach-role-policy --role-name transfer-family-custom-idp-user-role --policy-arn $(aws iam list-policies --query 'Policies[?PolicyName==`transfer-family-custom-idp-user-policy`].Arn' --output text)

aws iam delete-policy --policy-arn $(aws iam list-policies --query 'Policies[?PolicyName==`transfer-family-custom-idp-user-policy`].Arn' --output text)

aws iam delete-role --role-name transfer-family-custom-idp-user-role

Delete Amazon Cognito User Pool Client ID:

aws cognito-idp delete-user-pool-client --user-pool-id USER_POOL_ID --client-id CLIENT_ID

Delete Amazon Cognito user pool:

aws cognito-idp delete-user-pool --user-pool-id USER_POOL_ID

Delete AWS Transfer Family Server (Replace s-xxxxxxxxxx with your actual server ID):

aws transfer delete-server --server-id s-xxxxxxxxxx

Delete AWS Transfer Family Custom IdP solution AWS SAM deployment:

sam delete --stack-name transfer-family-custom-idp-solution