How to allow access to EFS from SFTP using lambda as Identity Provider?

0

'm trying to build an SFTP server for an EFS that uses a lambda function to check username and password provided against a Secret in AWS.

I followed this article but changed it a bit, I'm not using an API Gateway, I use the lambda function directly as identity provider which fetches the following data from secret Manager :

 "Role" : "arn:aws:iam::xxxxxxxxxxx:role/my-transfer-role",
"PosixProfile": {
    "Uid": 1001,
    "Gid": 1001,
    "SecondaryGids": []
 },
 "HomeDirectory": "/"

so far I can only connect to the SFTP server, but can't read or write what's on the EFS Message="Unable to list directory: permission denied for /"

I created a role and a policy attached to Transfer with permissions on my EFS as explained in this guide

Is there something I'm missing in this configuration please? Thanks

  • Hello Hicham, Sagar,

    Could you please attach the Lambda code and secret manager POSIX format that you are using? I am trying to deploy the same configuration but it always returns the error 'Missing POSIX profile' even though secrets manager has a PosixProfile.

    Regards, Nitesh D

1 Risposta
0
Risposta accettata

HichamZouarhi@,

Considering you are able to connect to the server and authenticate, the overall Lambda IDP configuration seems to be working. In regards to your error, I believe you need to provide the EFS id within the HomeDirectory to be able to access. Right now with HomeDirectory: / , it assumes root of EFS and probably attempts to list available EFS resources. Unless you have permissions for the same, the error would be expected behavior.

Could you update the HomeDirectory to the EFS resource that you are trying to access? Example: HomeDirectory: /fs-000000/user. Further, you need to ensure that the folder you are trying to access is accessible using the POSIX configuration you specified: (1001, 1001) in your case.

References:

Let me know if you have follow up questions.

-- Sagar

AWS
ESPERTO
con risposta 2 anni fa
profile picture
ESPERTO
verificato 5 mesi fa
  • Thanks Sagar, I thought at first that my SFTP would be linked directly to the efs for which I gave permission on the policy. by adding the file system id to HomeDirectory it worked. Have a nice day :)

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande