Package com.pulumi.aws.transfer
Class Server
- java.lang.Object
-
- com.pulumi.resources.Resource
-
- com.pulumi.resources.CustomResource
-
- com.pulumi.aws.transfer.Server
-
public class Server extends com.pulumi.resources.CustomResourceProvides a AWS Transfer Server resource. > **NOTE on AWS IAM permissions:** If the `endpointType` is set to `VPC`, the `ec2:DescribeVpcEndpoints` and `ec2:ModifyVpcEndpoint` [actions](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions) are used. > **NOTE:** Use the `aws.transfer.Tag` resource to manage the system tags used for [custom hostnames](https://docs.aws.amazon.com/transfer/latest/userguide/requirements-dns.html#tag-custom-hostname-cdk). ## Example Usage ### Basic
### Security Policy Namepackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.transfer.Server; import com.pulumi.aws.transfer.ServerArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new Server("example", ServerArgs.builder() .tags(Map.of("Name", "Example")) .build()); } }
### VPC Endpointpackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.transfer.Server; import com.pulumi.aws.transfer.ServerArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new Server("example", ServerArgs.builder() .securityPolicyName("TransferSecurityPolicy-2020-06") .build()); } }
### AWS Directory authenticationpackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.transfer.Server; import com.pulumi.aws.transfer.ServerArgs; import com.pulumi.aws.transfer.inputs.ServerEndpointDetailsArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new Server("example", ServerArgs.builder() .endpointDetails(ServerEndpointDetailsArgs.builder() .addressAllocationIds(exampleAwsEip.id()) .subnetIds(exampleAwsSubnet.id()) .vpcId(exampleAwsVpc.id()) .build()) .endpointType("VPC") .build()); } }
### AWS Lambda authenticationpackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.transfer.Server; import com.pulumi.aws.transfer.ServerArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new Server("example", ServerArgs.builder() .identityProviderType("AWS_DIRECTORY_SERVICE") .directoryId(exampleAwsDirectoryServiceDirectory.id()) .build()); } }
### Protocolspackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.transfer.Server; import com.pulumi.aws.transfer.ServerArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new Server("example", ServerArgs.builder() .identityProviderType("AWS_LAMBDA") .function(exampleAwsLambdaFunction.arn()) .build()); } }
### Using Structured Logging Destinationspackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.transfer.Server; import com.pulumi.aws.transfer.ServerArgs; import com.pulumi.aws.transfer.inputs.ServerEndpointDetailsArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new Server("example", ServerArgs.builder() .endpointDetails(ServerEndpointDetailsArgs.builder() .subnetIds(exampleAwsSubnet.id()) .vpcId(exampleAwsVpc.id()) .build()) .endpointType("VPC") .protocols( "FTP", "FTPS") .certificate(exampleAwsAcmCertificate.arn()) .identityProviderType("API_GATEWAY") .url(String.format("%s%s", exampleAwsApiGatewayDeployment.invokeUrl(),exampleAwsApiGatewayResource.path())) .build()); } }
## Import In Terraform v1.5.0 and later, use an `import` Block to import Transfer Servers using the server `id`. For example: Using `pulumi import`, import Transfer Servers using the server `id`. For example: ```sh $ pulumi import aws:transfer/server:Server example s-12345678 ``` Certain resource arguments, such as `hostKey`, cannot be read via the API and imported into the provider. This provider will display a difference for these arguments the first run after import if declared in the provider configuration for an imported resource.package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.cloudwatch.LogGroup; import com.pulumi.aws.cloudwatch.LogGroupArgs; import com.pulumi.aws.iam.IamFunctions; import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs; import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs; import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs; import com.pulumi.aws.iam.Role; import com.pulumi.aws.iam.RoleArgs; import com.pulumi.aws.transfer.Server; import com.pulumi.aws.transfer.ServerArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var transfer = new LogGroup("transfer", LogGroupArgs.builder() .namePrefix("transfer_test_") .build()); final var transferAssumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder() .statements(GetPolicyDocumentStatementArgs.builder() .principals(GetPolicyDocumentStatementPrincipalArgs.builder() .type("Service") .identifiers("transfer.amazonaws.com") .build()) .effect("Allow") .actions("sts:AssumeRole") .build()) .build()); var iamForTransfer = new Role("iamForTransfer", RoleArgs.builder() .namePrefix("iam_for_transfer_") .assumeRolePolicy(transferAssumeRole.json()) .managedPolicyArns("arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess") .build()); var transferServer = new Server("transferServer", ServerArgs.builder() .endpointType("PUBLIC") .loggingRole(iamForTransfer.arn()) .protocols("SFTP") .structuredLogDestinations(transfer.arn().applyValue(_arn -> String.format("%s:*", _arn))) .build()); } }
-
-
Constructor Summary
Constructors Constructor Description Server(java.lang.String name)Server(java.lang.String name, ServerArgs args)Server(java.lang.String name, ServerArgs args, com.pulumi.resources.CustomResourceOptions options)
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description com.pulumi.core.Output<java.lang.String>arn()com.pulumi.core.Output<java.util.Optional<java.lang.String>>certificate()com.pulumi.core.Output<java.util.Optional<java.lang.String>>directoryId()com.pulumi.core.Output<java.util.Optional<java.lang.String>>domain()com.pulumi.core.Output<java.lang.String>endpoint()com.pulumi.core.Output<java.util.Optional<ServerEndpointDetails>>endpointDetails()com.pulumi.core.Output<java.util.Optional<java.lang.String>>endpointType()com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>>forceDestroy()com.pulumi.core.Output<java.util.Optional<java.lang.String>>function()static Serverget(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, ServerState state, com.pulumi.resources.CustomResourceOptions options)Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.com.pulumi.core.Output<java.util.Optional<java.lang.String>>hostKey()com.pulumi.core.Output<java.lang.String>hostKeyFingerprint()com.pulumi.core.Output<java.util.Optional<java.lang.String>>identityProviderType()com.pulumi.core.Output<java.util.Optional<java.lang.String>>invocationRole()com.pulumi.core.Output<java.lang.String>ipAddressType()com.pulumi.core.Output<java.util.Optional<java.lang.String>>loggingRole()com.pulumi.core.Output<java.util.Optional<java.lang.String>>postAuthenticationLoginBanner()com.pulumi.core.Output<java.util.Optional<java.lang.String>>preAuthenticationLoginBanner()com.pulumi.core.Output<ServerProtocolDetails>protocolDetails()com.pulumi.core.Output<java.util.List<java.lang.String>>protocols()com.pulumi.core.Output<java.lang.String>region()com.pulumi.core.Output<ServerS3StorageOptions>s3StorageOptions()com.pulumi.core.Output<java.util.Optional<java.lang.String>>securityPolicyName()com.pulumi.core.Output<java.lang.String>sftpAuthenticationMethods()com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>>structuredLogDestinations()com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>>tags()com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>>tagsAll()com.pulumi.core.Output<java.util.Optional<java.lang.String>>url()com.pulumi.core.Output<java.util.Optional<ServerWorkflowDetails>>workflowDetails()
-
-
-
Constructor Detail
-
Server
public Server(java.lang.String name)
- Parameters:
name- The _unique_ name of the resulting resource.
-
Server
public Server(java.lang.String name, @Nullable ServerArgs args)- Parameters:
name- The _unique_ name of the resulting resource.args- The arguments to use to populate this resource's properties.
-
Server
public Server(java.lang.String name, @Nullable ServerArgs args, @Nullable com.pulumi.resources.CustomResourceOptions options)- Parameters:
name- The _unique_ name of the resulting resource.args- The arguments to use to populate this resource's properties.options- A bag of options that control this resource's behavior.
-
-
Method Detail
-
arn
public com.pulumi.core.Output<java.lang.String> arn()
- Returns:
- ARN of Transfer Server
-
certificate
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> certificate()
- Returns:
- ARN of the AWS Certificate Manager (ACM) certificate. Required when `protocols` is set to `FTPS`.
-
directoryId
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> directoryId()
- Returns:
- Directory service ID of the directory service you want to connect to with an `identityProviderType` of `AWS_DIRECTORY_SERVICE`.
-
domain
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> domain()
- Returns:
- Domain of the storage system that is used for file transfers. Valid values are: `S3` and `EFS`. The default value is `S3`.
-
endpoint
public com.pulumi.core.Output<java.lang.String> endpoint()
- Returns:
- Endpoint of the Transfer Server (e.g., `s-12345678.server.transfer.REGION.amazonaws.com`)
-
endpointDetails
public com.pulumi.core.Output<java.util.Optional<ServerEndpointDetails>> endpointDetails()
- Returns:
- VPC endpoint settings that you want to configure for your SFTP server. See `endpointDetails` Block below for details.
-
endpointType
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> endpointType()
- Returns:
- Type of endpoint that you want your SFTP server connect to. If you connect to a `VPC` (or `VPC_ENDPOINT`), your SFTP server isn't accessible over the public internet. If you want to connect your SFTP server via public internet, set `PUBLIC`. Defaults to `PUBLIC`.
-
forceDestroy
public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> forceDestroy()
- Returns:
- Boolean that indicates all users associated with the server should be deleted so that the Server can be destroyed without error. The default value is `false`. This option only applies to servers configured with a `SERVICE_MANAGED` `identityProviderType`.
-
function
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> function()
- Returns:
- ARN for a lambda function to use for the Identity provider with an `identityProviderType` of `AWS_LAMBDA`.
-
hostKey
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> hostKey()
- Returns:
- RSA, ECDSA, or ED25519 private key (e.g., as generated by the `ssh-keygen -t rsa -b 2048 -N "" -m PEM -f my-new-server-key`, `ssh-keygen -t ecdsa -b 256 -N "" -m PEM -f my-new-server-key` or `ssh-keygen -t ed25519 -N "" -f my-new-server-key` commands).
-
hostKeyFingerprint
public com.pulumi.core.Output<java.lang.String> hostKeyFingerprint()
- Returns:
- Message-digest algorithm (MD5) hash of the server's host key. This value is equivalent to the output of the `ssh-keygen -l -E md5 -f my-new-server-key` command.
-
identityProviderType
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> identityProviderType()
- Returns:
- Mode of authentication enabled for this service. The default value is `SERVICE_MANAGED`, which allows you to store and access SFTP user credentials within the service. `API_GATEWAY` indicates that user authentication requires a call to an API Gateway endpoint URL provided by you to integrate an identity provider of your choice. Using `AWS_DIRECTORY_SERVICE` will allow for authentication against AWS Managed Active Directory or Microsoft Active Directory in your on-premises environment, or in AWS using AD Connectors. Use the `AWS_LAMBDA` value to directly use a Lambda function as your identity provider. If you choose this value, you must specify the ARN for the lambda function in the `function` argument.
-
invocationRole
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> invocationRole()
- Returns:
- ARN of the IAM role used to authenticate the user account with an `identityProviderType` of `API_GATEWAY`.
-
ipAddressType
public com.pulumi.core.Output<java.lang.String> ipAddressType()
- Returns:
- Type of IP addresses for the AWS Transfer Family endpoint. Valid values are `IPV4` and `DUALSTACK`. The default value is `IPV4`. When `ipAddressType` is set to `DUALSTACK`, `addressAllocationIds` cannot be specified in the `endpointDetails` block. Updating `ipAddressType` stops the server and then restarts it with the new `ipAddressType` value.
-
loggingRole
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> loggingRole()
- Returns:
- ARN of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
-
postAuthenticationLoginBanner
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> postAuthenticationLoginBanner()
- Returns:
- Specify a string to display when users connect to a server. This string is displayed after the user authenticates. The SFTP protocol does not support post-authentication display banners.
-
preAuthenticationLoginBanner
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> preAuthenticationLoginBanner()
- Returns:
- Specify a string to display when users connect to a server. This string is displayed before the user authenticates.
-
protocolDetails
public com.pulumi.core.Output<ServerProtocolDetails> protocolDetails()
- Returns:
- Protocol settings that are configured for your server. See `protocolDetails` Block below for details.
-
protocols
public com.pulumi.core.Output<java.util.List<java.lang.String>> protocols()
- Returns:
- File transfer protocol or protocols over which your file transfer protocol client can connect to your server's endpoint. This defaults to `SFTP`. The available protocols are `AS2` (file transfer over Applicability Statement 2), `SFTP` (file transfer over SSH), `FTPS` (file transfer with TLS encryption), and `FTP` (unencrypted file transfer).
-
region
public com.pulumi.core.Output<java.lang.String> region()
- Returns:
- Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
-
s3StorageOptions
public com.pulumi.core.Output<ServerS3StorageOptions> s3StorageOptions()
- Returns:
- Whether performance for your Amazon S3 directories is optimized. This is disabled by default. See `s3StorageOptions` Block below for details.
-
securityPolicyName
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> securityPolicyName()
- Returns:
- Name of the security policy that is attached to the server. Default value is: `TransferSecurityPolicy-2018-11`. The available values are `TransferSecurityPolicy-2018-11`, `TransferSecurityPolicy-2020-06`, `TransferSecurityPolicy-2022-03`, `TransferSecurityPolicy-2023-05`, `TransferSecurityPolicy-2024-01`, `TransferSecurityPolicy-2025-03`, `TransferSecurityPolicy-FIPS-2020-06`, `TransferSecurityPolicy-FIPS-2023-05`, `TransferSecurityPolicy-FIPS-2024-01`, `TransferSecurityPolicy-FIPS-2024-05`, `TransferSecurityPolicy-FIPS-2025-03`, `TransferSecurityPolicy-PQ-SSH-Experimental-2023-04`, `TransferSecurityPolicy-PQ-SSH-FIPS-Experimental-2023-04`, `TransferSecurityPolicy-Restricted-2018-11`, `TransferSecurityPolicy-Restricted-2020-06`, `TransferSecurityPolicy-Restricted-2024-06`, `TransferSecurityPolicy-SshAuditCompliant-2025-02`, and `TransferSecurityPolicy-AS2Restricted-2025-07`. See [Security policies for AWS Transfer Family servers](https://docs.aws.amazon.com/transfer/latest/userguide/security-policies.html) for details.
-
sftpAuthenticationMethods
public com.pulumi.core.Output<java.lang.String> sftpAuthenticationMethods()
- Returns:
- For SFTP-enabled servers with an `identityProviderType` of `API_GATEWAY` or `AWS_LAMBDA`. Valid values are `PASSWORD`, `PUBLIC_KEY`, `PUBLIC_KEY_OR_PASSWORD` and `PUBLIC_KEY_AND_PASSWORD`. Default value is: `PUBLIC_KEY_OR_PASSWORD`.
-
structuredLogDestinations
public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> structuredLogDestinations()
- Returns:
- Set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs. If provided this enables the transfer server to emit structured logs to the specified locations.
-
tags
public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>> tags()
- Returns:
- Map of tags to assign to the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
-
tagsAll
public com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>> tagsAll()
- Returns:
- Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
-
url
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> url()
- Returns:
- URL of the service endpoint used to authenticate users with an `identityProviderType` of `API_GATEWAY`.
-
workflowDetails
public com.pulumi.core.Output<java.util.Optional<ServerWorkflowDetails>> workflowDetails()
- Returns:
- Workflow details. See `workflowDetails` Block below for details.
-
get
public static Server get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, @Nullable ServerState state, @Nullable com.pulumi.resources.CustomResourceOptions options)
Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.- Parameters:
name- The _unique_ name of the resulting resource.id- The _unique_ provider ID of the resource to lookup.state-options- Optional settings to control the behavior of the CustomResource.
-
-