Control: 2 Transfer Family servers should not use FTP protocol for endpoint connection
Description
This control checks whether an AWS Transfer Family server uses a protocol other than FTP for endpoint connection. The control fails if the server uses FTP protocol for a client to connect to the server's endpoint.
FTP (File Transfer Protocol) establishes the endpoint connection through unencrypted channels, leaving data sent over these channels vulnerable to interception. Using SFTP (SSH File Transfer Protocol), FTPS (File Transfer Protocol Secure), or AS2 (Applicability Statement 2) offers an extra layer of security by encrypting your data in transit and can be used to help prevent potential attackers from using person-in-the-middle or similar attacks to eavesdrop on or manipulate network traffic.
Remediation
To modify the protocol for a Transfer Family server, see Edit the file transfer protocols in the AWS Transfer Family User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_transfer_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_transfer_2 --shareSQL
This control uses a named query:
select arn as resource, case when protocols @> '[ "FTP" ]' then 'alarm' else 'ok' end as status, case when protocols @> '[ "FTP" ]' then title || ' uses FTP protocol for endpoint connection.' else title || ' does not uses FTP protocol for endpoint connection.' end as reason , region, account_idfrom aws_transfer_server;