How to create an AWS SFTP server with internet-facing VPC endpoint with Cloudformation?

Question

I am able to create an SFTP Server (AWS Transfer Family) inside a VPC with an internet-facing Endpoint on AWS console as described here: https://docs.aws.amazon.com/transfer/latest/userguide/create-server-in-vpc.html

VPC endpoint type access selection

Now, I need to replicate that very same creation in a CloudFormation template and don't know how to do it (if possible). According to what I see in https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-transfer-server-endpointdetails.html and in the corresponding CDK docs https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-transfer.CfnServer.EndpointDetailsProperty.html, there seems not to be a was to set the "access" property value.

All the examples I've come across use a PUBLIC endpoint (in contrast to a VPC one). Here's the snipped I'm working on:

"Resources": {
  "ftpserver": {
    "Type": "AWS::Transfer::Server",
    "DependsOn": "sftpEIP1",
    "Properties": {
      "EndpointDetails": {
        "SubnetIds": [
          {
            "Ref": "sftpSubnet1"
          }
        ],
        "VpcId": {
          "Ref": "sftpVPC"
        }
      },
      "EndpointType": "VPC",
      "Protocols": [
          "SFTP"
      ],
      "Tags": [
        {
          "Key": "KeyName",
          "Value": "ValueName"
        }
      ]
    }
  }
},
...      
}

Since there is no way to set the access type in CloudFormation, the endpoint ends up created as "Internal" instead of "Internet-facing" which is what I need.

Is there any way around this or should I just change it manually (AWS console) after every deployment?

Erico Erico · Accepted Answer · 2020-11-10T22:14:27

You need to associate Elastic IPs and define the security group.

Notice because the Elastic IPs can only be added after the server is created, it takes sometime to complete, CloudFormation actually creates the server with internal only, stops the server, adds the Elastic IPs, it starts again with elastic IPs and internet facing and then stack is completed.

Example with the CF template below works as expected.

Description: Test CF with FTP server

Resources:
  ElasticIP1:
    Type: AWS::EC2::EIP
  ElasticIP2:
    Type: AWS::EC2::EIP
  ElasticIP3:
    Type: AWS::EC2::EIP

  FTPServer:
    Type: AWS::Transfer::Server
    Properties:
      EndpointDetails:
        AddressAllocationIds:
          - !GetAtt ElasticIP1.AllocationId
          - !GetAtt ElasticIP2.AllocationId
          - !GetAtt ElasticIP3.AllocationId
        SecurityGroupIds:
          - sg-0c4184c3f5da91d4a
        SubnetIds:
          - subnet-0546e2c78cebd0a60
          - subnet-0114560b841c91de7
          - subnet-0af8fb5fae5472862
        VpcId: vpc-07daf77a355f5a8e8
      EndpointType: VPC
      Protocols:
        - SFTP

How to create an AWS SFTP server with internet-facing VPC endpoint with Cloudformation?

1 Answers