Class Server


  • public class Server
    extends com.pulumi.resources.CustomResource
    Provides a AWS Transfer Server resource. > **NOTE on AWS IAM permissions:** If the `endpointType` is set to `VPC`, the `ec2:DescribeVpcEndpoints` and `ec2:ModifyVpcEndpoint` [actions](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions) are used. > **NOTE:** Use the `aws.transfer.Tag` resource to manage the system tags used for [custom hostnames](https://docs.aws.amazon.com/transfer/latest/userguide/requirements-dns.html#tag-custom-hostname-cdk). ## Example Usage ### Basic
     
     package generated_program;
     
     import com.pulumi.Context;
     import com.pulumi.Pulumi;
     import com.pulumi.core.Output;
     import com.pulumi.aws.transfer.Server;
     import com.pulumi.aws.transfer.ServerArgs;
     import java.util.ArrayList;
     import java.util.Arrays;
     import java.util.Map;
     import java.io.File;
     import java.nio.file.Files;
     import java.nio.file.Paths;
     
     public class App {
         public static void main(String[] args) {
             Pulumi.run(App::stack);
         }
     
         public static void stack(Context ctx) {
             var example = new Server("example", ServerArgs.builder()
                 .tags(Map.of("Name", "Example"))
                 .build());
     
         }
     }
     
     
    ### Security Policy Name
     
     package generated_program;
     
     import com.pulumi.Context;
     import com.pulumi.Pulumi;
     import com.pulumi.core.Output;
     import com.pulumi.aws.transfer.Server;
     import com.pulumi.aws.transfer.ServerArgs;
     import java.util.ArrayList;
     import java.util.Arrays;
     import java.util.Map;
     import java.io.File;
     import java.nio.file.Files;
     import java.nio.file.Paths;
     
     public class App {
         public static void main(String[] args) {
             Pulumi.run(App::stack);
         }
     
         public static void stack(Context ctx) {
             var example = new Server("example", ServerArgs.builder()
                 .securityPolicyName("TransferSecurityPolicy-2020-06")
                 .build());
     
         }
     }
     
     
    ### VPC Endpoint
     
     package generated_program;
     
     import com.pulumi.Context;
     import com.pulumi.Pulumi;
     import com.pulumi.core.Output;
     import com.pulumi.aws.transfer.Server;
     import com.pulumi.aws.transfer.ServerArgs;
     import com.pulumi.aws.transfer.inputs.ServerEndpointDetailsArgs;
     import java.util.ArrayList;
     import java.util.Arrays;
     import java.util.Map;
     import java.io.File;
     import java.nio.file.Files;
     import java.nio.file.Paths;
     
     public class App {
         public static void main(String[] args) {
             Pulumi.run(App::stack);
         }
     
         public static void stack(Context ctx) {
             var example = new Server("example", ServerArgs.builder()
                 .endpointDetails(ServerEndpointDetailsArgs.builder()
                     .addressAllocationIds(exampleAwsEip.id())
                     .subnetIds(exampleAwsSubnet.id())
                     .vpcId(exampleAwsVpc.id())
                     .build())
                 .endpointType("VPC")
                 .build());
     
         }
     }
     
     
    ### AWS Directory authentication
     
     package generated_program;
     
     import com.pulumi.Context;
     import com.pulumi.Pulumi;
     import com.pulumi.core.Output;
     import com.pulumi.aws.transfer.Server;
     import com.pulumi.aws.transfer.ServerArgs;
     import java.util.ArrayList;
     import java.util.Arrays;
     import java.util.Map;
     import java.io.File;
     import java.nio.file.Files;
     import java.nio.file.Paths;
     
     public class App {
         public static void main(String[] args) {
             Pulumi.run(App::stack);
         }
     
         public static void stack(Context ctx) {
             var example = new Server("example", ServerArgs.builder()
                 .identityProviderType("AWS_DIRECTORY_SERVICE")
                 .directoryId(exampleAwsDirectoryServiceDirectory.id())
                 .build());
     
         }
     }
     
     
    ### AWS Lambda authentication
     
     package generated_program;
     
     import com.pulumi.Context;
     import com.pulumi.Pulumi;
     import com.pulumi.core.Output;
     import com.pulumi.aws.transfer.Server;
     import com.pulumi.aws.transfer.ServerArgs;
     import java.util.ArrayList;
     import java.util.Arrays;
     import java.util.Map;
     import java.io.File;
     import java.nio.file.Files;
     import java.nio.file.Paths;
     
     public class App {
         public static void main(String[] args) {
             Pulumi.run(App::stack);
         }
     
         public static void stack(Context ctx) {
             var example = new Server("example", ServerArgs.builder()
                 .identityProviderType("AWS_LAMBDA")
                 .function(exampleAwsLambdaFunction.arn())
                 .build());
     
         }
     }
     
     
    ### Protocols
     
     package generated_program;
     
     import com.pulumi.Context;
     import com.pulumi.Pulumi;
     import com.pulumi.core.Output;
     import com.pulumi.aws.transfer.Server;
     import com.pulumi.aws.transfer.ServerArgs;
     import com.pulumi.aws.transfer.inputs.ServerEndpointDetailsArgs;
     import java.util.ArrayList;
     import java.util.Arrays;
     import java.util.Map;
     import java.io.File;
     import java.nio.file.Files;
     import java.nio.file.Paths;
     
     public class App {
         public static void main(String[] args) {
             Pulumi.run(App::stack);
         }
     
         public static void stack(Context ctx) {
             var example = new Server("example", ServerArgs.builder()
                 .endpointDetails(ServerEndpointDetailsArgs.builder()
                     .subnetIds(exampleAwsSubnet.id())
                     .vpcId(exampleAwsVpc.id())
                     .build())
                 .endpointType("VPC")
                 .protocols(            
                     "FTP",
                     "FTPS")
                 .certificate(exampleAwsAcmCertificate.arn())
                 .identityProviderType("API_GATEWAY")
                 .url(String.format("%s%s", exampleAwsApiGatewayDeployment.invokeUrl(),exampleAwsApiGatewayResource.path()))
                 .build());
     
         }
     }
     
     
    ### Using Structured Logging Destinations
     
     package generated_program;
     
     import com.pulumi.Context;
     import com.pulumi.Pulumi;
     import com.pulumi.core.Output;
     import com.pulumi.aws.cloudwatch.LogGroup;
     import com.pulumi.aws.cloudwatch.LogGroupArgs;
     import com.pulumi.aws.iam.IamFunctions;
     import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
     import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
     import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
     import com.pulumi.aws.iam.Role;
     import com.pulumi.aws.iam.RoleArgs;
     import com.pulumi.aws.transfer.Server;
     import com.pulumi.aws.transfer.ServerArgs;
     import java.util.ArrayList;
     import java.util.Arrays;
     import java.util.Map;
     import java.io.File;
     import java.nio.file.Files;
     import java.nio.file.Paths;
     
     public class App {
         public static void main(String[] args) {
             Pulumi.run(App::stack);
         }
     
         public static void stack(Context ctx) {
             var transfer = new LogGroup("transfer", LogGroupArgs.builder()
                 .namePrefix("transfer_test_")
                 .build());
     
             final var transferAssumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
                 .statements(GetPolicyDocumentStatementArgs.builder()
                     .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                         .type("Service")
                         .identifiers("transfer.amazonaws.com")
                         .build())
                     .effect("Allow")
                     .actions("sts:AssumeRole")
                     .build())
                 .build());
     
             var iamForTransfer = new Role("iamForTransfer", RoleArgs.builder()
                 .namePrefix("iam_for_transfer_")
                 .assumeRolePolicy(transferAssumeRole.json())
                 .managedPolicyArns("arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess")
                 .build());
     
             var transferServer = new Server("transferServer", ServerArgs.builder()
                 .endpointType("PUBLIC")
                 .loggingRole(iamForTransfer.arn())
                 .protocols("SFTP")
                 .structuredLogDestinations(transfer.arn().applyValue(_arn -> String.format("%s:*", _arn)))
                 .build());
     
         }
     }
     
     
    ## Import In Terraform v1.5.0 and later, use an `import` Block to import Transfer Servers using the server `id`. For example: Using `pulumi import`, import Transfer Servers using the server `id`. For example: ```sh $ pulumi import aws:transfer/server:Server example s-12345678 ``` Certain resource arguments, such as `hostKey`, cannot be read via the API and imported into the provider. This provider will display a difference for these arguments the first run after import if declared in the provider configuration for an imported resource.
    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal
      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal
    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote
    • Constructor Summary

      Constructors 
      Constructor Description
      Server​(java.lang.String name)  
      Server​(java.lang.String name, ServerArgs args)  
      Server​(java.lang.String name, ServerArgs args, com.pulumi.resources.CustomResourceOptions options)  
    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      com.pulumi.core.Output<java.lang.String> arn()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> certificate()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> directoryId()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> domain()  
      com.pulumi.core.Output<java.lang.String> endpoint()  
      com.pulumi.core.Output<java.util.Optional<ServerEndpointDetails>> endpointDetails()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> endpointType()  
      com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> forceDestroy()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> function()  
      static Server get​(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, ServerState state, com.pulumi.resources.CustomResourceOptions options)
      Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> hostKey()  
      com.pulumi.core.Output<java.lang.String> hostKeyFingerprint()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> identityProviderType()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> invocationRole()  
      com.pulumi.core.Output<java.lang.String> ipAddressType()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> loggingRole()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> postAuthenticationLoginBanner()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> preAuthenticationLoginBanner()  
      com.pulumi.core.Output<ServerProtocolDetails> protocolDetails()  
      com.pulumi.core.Output<java.util.List<java.lang.String>> protocols()  
      com.pulumi.core.Output<java.lang.String> region()  
      com.pulumi.core.Output<ServerS3StorageOptions> s3StorageOptions()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> securityPolicyName()  
      com.pulumi.core.Output<java.lang.String> sftpAuthenticationMethods()  
      com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> structuredLogDestinations()  
      com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()  
      com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> url()  
      com.pulumi.core.Output<java.util.Optional<ServerWorkflowDetails>> workflowDetails()  
      • Methods inherited from class com.pulumi.resources.CustomResource

        getId, id, idFuture
      • Methods inherited from class com.pulumi.resources.Resource

        getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Constructor Detail

      • Server

        public Server​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.
      • Server

        public Server​(java.lang.String name,
                      @Nullable
                      ServerArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
      • Server

        public Server​(java.lang.String name,
                      @Nullable
                      ServerArgs args,
                      @Nullable
                      com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.
    • Method Detail

      • arn

        public com.pulumi.core.Output<java.lang.String> arn()
        Returns:
        ARN of Transfer Server
      • certificate

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> certificate()
        Returns:
        ARN of the AWS Certificate Manager (ACM) certificate. Required when `protocols` is set to `FTPS`.
      • directoryId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> directoryId()
        Returns:
        Directory service ID of the directory service you want to connect to with an `identityProviderType` of `AWS_DIRECTORY_SERVICE`.
      • domain

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> domain()
        Returns:
        Domain of the storage system that is used for file transfers. Valid values are: `S3` and `EFS`. The default value is `S3`.
      • endpoint

        public com.pulumi.core.Output<java.lang.String> endpoint()
        Returns:
        Endpoint of the Transfer Server (e.g., `s-12345678.server.transfer.REGION.amazonaws.com`)
      • endpointDetails

        public com.pulumi.core.Output<java.util.Optional<ServerEndpointDetails>> endpointDetails()
        Returns:
        VPC endpoint settings that you want to configure for your SFTP server. See `endpointDetails` Block below for details.
      • endpointType

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> endpointType()
        Returns:
        Type of endpoint that you want your SFTP server connect to. If you connect to a `VPC` (or `VPC_ENDPOINT`), your SFTP server isn't accessible over the public internet. If you want to connect your SFTP server via public internet, set `PUBLIC`. Defaults to `PUBLIC`.
      • forceDestroy

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> forceDestroy()
        Returns:
        Boolean that indicates all users associated with the server should be deleted so that the Server can be destroyed without error. The default value is `false`. This option only applies to servers configured with a `SERVICE_MANAGED` `identityProviderType`.
      • function

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> function()
        Returns:
        ARN for a lambda function to use for the Identity provider with an `identityProviderType` of `AWS_LAMBDA`.
      • hostKey

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> hostKey()
        Returns:
        RSA, ECDSA, or ED25519 private key (e.g., as generated by the `ssh-keygen -t rsa -b 2048 -N "" -m PEM -f my-new-server-key`, `ssh-keygen -t ecdsa -b 256 -N "" -m PEM -f my-new-server-key` or `ssh-keygen -t ed25519 -N "" -f my-new-server-key` commands).
      • hostKeyFingerprint

        public com.pulumi.core.Output<java.lang.String> hostKeyFingerprint()
        Returns:
        Message-digest algorithm (MD5) hash of the server's host key. This value is equivalent to the output of the `ssh-keygen -l -E md5 -f my-new-server-key` command.
      • identityProviderType

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> identityProviderType()
        Returns:
        Mode of authentication enabled for this service. The default value is `SERVICE_MANAGED`, which allows you to store and access SFTP user credentials within the service. `API_GATEWAY` indicates that user authentication requires a call to an API Gateway endpoint URL provided by you to integrate an identity provider of your choice. Using `AWS_DIRECTORY_SERVICE` will allow for authentication against AWS Managed Active Directory or Microsoft Active Directory in your on-premises environment, or in AWS using AD Connectors. Use the `AWS_LAMBDA` value to directly use a Lambda function as your identity provider. If you choose this value, you must specify the ARN for the lambda function in the `function` argument.
      • invocationRole

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> invocationRole()
        Returns:
        ARN of the IAM role used to authenticate the user account with an `identityProviderType` of `API_GATEWAY`.
      • ipAddressType

        public com.pulumi.core.Output<java.lang.String> ipAddressType()
        Returns:
        Type of IP addresses for the AWS Transfer Family endpoint. Valid values are `IPV4` and `DUALSTACK`. The default value is `IPV4`. When `ipAddressType` is set to `DUALSTACK`, `addressAllocationIds` cannot be specified in the `endpointDetails` block. Updating `ipAddressType` stops the server and then restarts it with the new `ipAddressType` value.
      • loggingRole

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> loggingRole()
        Returns:
        ARN of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
      • postAuthenticationLoginBanner

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> postAuthenticationLoginBanner()
        Returns:
        Specify a string to display when users connect to a server. This string is displayed after the user authenticates. The SFTP protocol does not support post-authentication display banners.
      • preAuthenticationLoginBanner

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> preAuthenticationLoginBanner()
        Returns:
        Specify a string to display when users connect to a server. This string is displayed before the user authenticates.
      • protocolDetails

        public com.pulumi.core.Output<ServerProtocolDetails> protocolDetails()
        Returns:
        Protocol settings that are configured for your server. See `protocolDetails` Block below for details.
      • protocols

        public com.pulumi.core.Output<java.util.List<java.lang.String>> protocols()
        Returns:
        File transfer protocol or protocols over which your file transfer protocol client can connect to your server's endpoint. This defaults to `SFTP`. The available protocols are `AS2` (file transfer over Applicability Statement 2), `SFTP` (file transfer over SSH), `FTPS` (file transfer with TLS encryption), and `FTP` (unencrypted file transfer).
      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
      • s3StorageOptions

        public com.pulumi.core.Output<ServerS3StorageOptions> s3StorageOptions()
        Returns:
        Whether performance for your Amazon S3 directories is optimized. This is disabled by default. See `s3StorageOptions` Block below for details.
      • securityPolicyName

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> securityPolicyName()
        Returns:
        Name of the security policy that is attached to the server. Default value is: `TransferSecurityPolicy-2018-11`. The available values are `TransferSecurityPolicy-2018-11`, `TransferSecurityPolicy-2020-06`, `TransferSecurityPolicy-2022-03`, `TransferSecurityPolicy-2023-05`, `TransferSecurityPolicy-2024-01`, `TransferSecurityPolicy-2025-03`, `TransferSecurityPolicy-FIPS-2020-06`, `TransferSecurityPolicy-FIPS-2023-05`, `TransferSecurityPolicy-FIPS-2024-01`, `TransferSecurityPolicy-FIPS-2024-05`, `TransferSecurityPolicy-FIPS-2025-03`, `TransferSecurityPolicy-PQ-SSH-Experimental-2023-04`, `TransferSecurityPolicy-PQ-SSH-FIPS-Experimental-2023-04`, `TransferSecurityPolicy-Restricted-2018-11`, `TransferSecurityPolicy-Restricted-2020-06`, `TransferSecurityPolicy-Restricted-2024-06`, `TransferSecurityPolicy-SshAuditCompliant-2025-02`, and `TransferSecurityPolicy-AS2Restricted-2025-07`. See [Security policies for AWS Transfer Family servers](https://docs.aws.amazon.com/transfer/latest/userguide/security-policies.html) for details.
      • sftpAuthenticationMethods

        public com.pulumi.core.Output<java.lang.String> sftpAuthenticationMethods()
        Returns:
        For SFTP-enabled servers with an `identityProviderType` of `API_GATEWAY` or `AWS_LAMBDA`. Valid values are `PASSWORD`, `PUBLIC_KEY`, `PUBLIC_KEY_OR_PASSWORD` and `PUBLIC_KEY_AND_PASSWORD`. Default value is: `PUBLIC_KEY_OR_PASSWORD`.
      • structuredLogDestinations

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> structuredLogDestinations()
        Returns:
        Set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs. If provided this enables the transfer server to emit structured logs to the specified locations.
      • tags

        public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
      • tagsAll

        public com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()
        Returns:
        Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
      • url

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> url()
        Returns:
        URL of the service endpoint used to authenticate users with an `identityProviderType` of `API_GATEWAY`.
      • workflowDetails

        public com.pulumi.core.Output<java.util.Optional<ServerWorkflowDetails>> workflowDetails()
        Returns:
        Workflow details. See `workflowDetails` Block below for details.
      • get

        public static Server get​(java.lang.String name,
                                 com.pulumi.core.Output<java.lang.String> id,
                                 @Nullable
                                 ServerState state,
                                 @Nullable
                                 com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.