{TransferFamily}チュートリアル: AWS Transfer Family で開始

AWS

 


https://engineer.retty.me/entry/aws-transfer-for-sftp

https://docs.aws.amazon.com/ja_jp/transfer/latest/userguide/getting-started.html

 


-- 1. コマンド等のインストール

-- 1.1 aws cli version 2 インストール

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

 

-- 1.2 jqインストール
sudo yum -y install jq


-- 2. S3 バケットを作成する

aws s3 ls

aws s3 mb s3://bucket123

-- 3. IAMポリシー作成
vim policy01.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::bucket123"
            ]
        },
        {
            "Sid": "HomeDirObjectAccess",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObjectVersion",
                "s3:DeleteObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::bucket123/*"
        }
    ]
}

aws iam create-policy \
--policy-name policy01 \
--policy-document file://policy01.json

-- 4. IAMロール作成
vim role01.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "transfer.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

aws iam create-role \
--role-name role01 \
--assume-role-policy-document file://role01.json

-- 5. ポリシーをロールにアタッチ
aws iam attach-role-policy \
--policy-arn arn:aws:iam::999999999999:policy/policy01 \
--role-name role01

 

 

-- 6. SFTP 対応サーバーの作成

 

aws transfer create-server \
--domain S3 \
--endpoint-type PUBLIC \
--identity-provider-type SERVICE_MANAGED \
--protocols SFTP \
--security-policy-name TransferSecurityPolicy-2020-06

 

aws transfer list-servers

aws transfer describe-server \
--server-id s-11111111111111111

 


-- 7. サービスマネージドユーザーの作成

ssh-keygen
cat  /home/ec2-user/.ssh/id_rsa.pub


aws transfer create-user \
--home-directory "/bucket123" \
--home-directory-type PATH \
--role arn:aws:iam::999999999999:role/role01 \
--server-id s-11111111111111111 \
--ssh-public-key-body 'ssh-rsa CCCCB3NzaC1yc2EAAAADAQABAAABAQCnik9e8RqUSDPmlbNPKsKgQmdQ6qDHZGiRxPE+A/6Hb8G9JCvT+AFOno4uY7lShquiAQ69P3UxF0ONLWv1sP5XyiY1vkiRF1uFFrSWRRyFADRdibzmiV3TUoZakyGTLc75SbZ0voN7MQ7Y5pEYWbe4wxfSTDGePlFIs1zgB9LCpKE9N9iTbl+uQto3k5hjoC3RBht5YmmLOkLq6h+NEuG6irfsuK35k8e4BVjUoPux2cgCmNumBTiB0mighpn/qcNoKdnZ9+qDSNaL8G+q+TFvg3XBkHZ5mAtDPJkbiiKlAXq2ErGXLdDJ5zKztPENMtLct1xgD5PaZ6WWzk6GbGB7 ec2-user@ip-172-31-29-37.ap-northeast-1.compute.internal' \
--user-name user01

 

aws transfer list-users \
--server-id s-11111111111111111

aws transfer describe-user \
--server-id s-11111111111111111 \
--user-name user01

 

-- 8. 動作確認


echo test > test.txt

sftp -i /home/ec2-user/.ssh/id_rsa user01@s-11111111111111111.server.transfer.ap-northeast-1.amazonaws.com

lls
ls
put test.txt
lls
ls
quit

 

aws s3 ls s3://bucket123 --recursive

 

-- 9. クリーンアップ

-- サービスマネージドユーザーの削除


aws transfer list-users \
--server-id s-11111111111111111

aws transfer describe-user \
--server-id s-11111111111111111 \
--user-name user01

aws transfer delete-user \
--server-id s-11111111111111111 \
--user-name user01

 

-- SFTP 対応サーバーの削除


aws transfer list-servers

aws transfer describe-server \
--server-id s-11111111111111111

aws transfer delete-server \
--server-id s-11111111111111111


-- IAMロールの削除
aws iam list-roles | grep role01

aws iam detach-role-policy \
--role-name role01 \
--policy-arn arn:aws:iam::999999999999:policy/policy01

aws iam delete-role --role-name role01


-- IAMポリシーの削除
aws iam list-policies | grep policy01

aws iam delete-policy \
--policy-arn arn:aws:iam::999999999999:policy/policy01


-- バケットの削除
aws s3 ls

aws s3 rb s3://bucket123 --force