Transfer Family server has encryption in transit enabled

Check ID: transfer_server_in_transit_encryption_enabled
Provider: AWS
Service: transfer
Severity: HIGH
Categories: encryption
Resource type: Other

What this check verifies

AWS Transfer Family servers are evaluated for presence of the unencrypted FTP protocol among enabled protocols, as opposed to encrypted options like SFTP, FTPS, or AS2.

Risk

Allowing FTP exposes credentials and file contents in cleartext, breaking confidentiality. Adversaries can sniff or perform MITM to read or alter files, compromising integrity and enabling credential theft that can be reused for broader unauthorized access.

Recommendation

Remove FTP; permit only SFTP, FTPS, or AS2 to enforce encryption in transit. Apply defense in depth: restrict by network location (allowlists/VPC), enforce strong cryptographic policies, and use least-privilege roles with monitoring.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws transfer update-server —server-id <server-id> —protocols SFTP

# Ensure FTP is not enabled
resource "aws_transfer_server" "<example_resource_name>" {
  protocols = ["SFTP"]  # CRITICAL: Excludes FTP to enforce encryption in transit
}

# CloudFormation: ensure FTP is not enabled
Resources:
  <example_resource_name>:
    Type: AWS::Transfer::Server
    Properties:
      Protocols:
        - SFTP  # CRITICAL: Use SFTP only; excludes FTP (unencrypted)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = transfer_server_in_transit_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS Storage Gateway gateway is not hosted on EC2 Trusted Advisor check has no errors or warnings

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires