Back to Checks
aws

AWS Transfer Family server uses a FIPS security policy

transfer_server_fips_security_policy_enabled
Service: transferSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsTransferServer

AWS Transfer Family servers (SFTP, FTPS, AS2) are assessed for use of a FIPS security policy (TransferSecurityPolicy-FIPS-*, flagged Fips: true by AWS), which limits file-transfer sessions to the FIPS-enabled set of SSH and TLS algorithms.

Prowler logoProwlerprowler-provider-aws

Risk

Servers without a FIPS security policy can negotiate algorithms outside the FIPS-enabled set, which does not meet requirements to protect federal or regulated files and credentials with NIST CMVP validated cryptography.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks transfer_server_fips_security_policy_enabled

Recommendation

Use a FIPS security policy, such as TransferSecurityPolicy-FIPS-2025-03, on every Transfer Family server that exchanges federal or regulated data.

Remediation

CLI

aws transfer update-server --server-id <server_id> --security-policy-name TransferSecurityPolicy-FIPS-2025-03

Terraform

resource "aws_transfer_server" "<example_resource_name>" {
  protocols            = ["SFTP"]
  security_policy_name = "TransferSecurityPolicy-FIPS-2025-03" # FIX: FIPS security policy
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Transfer::Server
    Properties:
      Protocols:
        - SFTP
      SecurityPolicyName: TransferSecurityPolicy-FIPS-2025-03  # FIX: FIPS security policy

Other

1In the AWS Console, go to AWS Transfer Family > Servers
2Select the server and choose Edit on the Additional details panel
3Set Cryptographic algorithm options (Security policy) to a FIPS policy such as TransferSecurityPolicy-FIPS-2025-03
4Save the changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.transfer.transfer_client import transfer_client


class transfer_server_fips_security_policy_enabled(Check):
    """Ensure every AWS Transfer Family server uses a FIPS security policy."""

    def execute(self) -> list[Check_Report_AWS]:
        """Report whether each Transfer Family server uses a FIPS security policy."""
        findings = []
        unretrieved_servers = []
        for server in transfer_client.servers.values():
            policy = server.security_policy_name
            if not policy:
                unretrieved_servers.append(server.id)
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=server)
            if "FIPS" in policy.split("-"):
                report.status = "PASS"
                report.status_extended = (
                    f"Transfer Server {server.id} uses FIPS security policy {policy}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Transfer Server {server.id} uses security policy {policy}, which is not a FIPS security policy."
            findings.append(report)
        if unretrieved_servers:
            report = Check_Report_AWS(metadata=self.metadata(), resource={})
            report.resource_id = transfer_client.audited_account
            report.resource_arn = transfer_client.audited_account_arn
            report.region = transfer_client.region
            report.status = "MANUAL"
            report.status_extended = (
                "Transfer Server security policies could not be retrieved for "
                f"{', '.join(unretrieved_servers)}; verify the transfer:DescribeServer permission."
            )
            findings.append(report)
        return findings

References