Security policies for AWS Transfer Family SFTP connectors

SFTP connector security policies in AWS Transfer Family allow you to limit the set of cryptographic algorithms (message authentication codes (MACs), key exchanges (KEXs), and cipher suites) associated with your SFTP connector. The following is a list of supported cryptographic algorithms for each SFTP connector security policy.

You can change the security policy for your connector. Select Connectors from the Transfer Family left navigation pane, and select your connector. Then select Edit in the Sftp configuration section. In the Cryptographic algorithm options section, choose any available security policy from the dropdown list in the Security Policy field.

Cryptographic algorithms

For host keys, SFTP connectors support all the algorithms that are supported for Transfer Family servers, except for ed25519:

Additionally, for host keys, we support ssh-rsa, but only for TransferSFTPConnectorSecurityPolicy-2023-07.

For authentication, SFTP connectors support the following key types:

SFTP connector security policy details

The following table shows the specific cryptographic algorithms supported by each SFTP connector security policy.