Back to Checks
aws

Transfer Family server has encryption in transit enabled

transfer_server_in_transit_encryption_enabled
Service: transferSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

AWS Transfer Family servers are evaluated for presence of the unencrypted FTP protocol among enabled protocols, as opposed to encrypted options like SFTP, FTPS, or AS2.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing FTP exposes credentials and file contents in cleartext, breaking confidentiality. Adversaries can sniff or perform MITM to read or alter files, compromising integrity and enabling credential theft that can be reused for broader unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks transfer_server_in_transit_encryption_enabled

Recommendation

Remove FTP; permit only SFTP, FTPS, or AS2 to enforce encryption in transit.

Apply defense in depth: restrict by network location (allowlists/VPC), enforce strong cryptographic policies, and use least-privilege roles with monitoring.

Remediation

CLI

aws transfer update-server --server-id <server-id> --protocols SFTP

Terraform

# Ensure FTP is not enabled
resource "aws_transfer_server" "<example_resource_name>" {
  protocols = ["SFTP"]  # CRITICAL: Excludes FTP to enforce encryption in transit
}

NativeIaC

# CloudFormation: ensure FTP is not enabled
Resources:
  <example_resource_name>:
    Type: AWS::Transfer::Server
    Properties:
      Protocols:
        - SFTP  # CRITICAL: Use SFTP only; excludes FTP (unencrypted)

Other

1Open AWS Console > AWS Transfer Family
2Go to Servers and select the server (<example_resource_id>)
3Click Edit next to Protocols
4Uncheck FTP and ensure at least SFTP (or FTPS/AS2) is selected
5Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.transfer.transfer_client import transfer_client
from prowler.providers.aws.services.transfer.transfer_service import Protocol


class transfer_server_in_transit_encryption_enabled(Check):
    """Check if Transfer Servers have encryption in transit enabled.

    This class checks if Transfer Servers have encryption in transit enabled.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """Execute the server in transit encyption check.

        Iterate over all Transfer Servers and check if they have FTP as one of the valid protocols.

        Returns:
            List[Check_Report_AWS]: A list of reports for each Transfer Server.
        """
        findings = []
        for server in transfer_client.servers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=server)
            report.status = "PASS"
            report.status_extended = (
                f"Transfer Server {server.id} does have encryption in transit enabled."
            )

            if Protocol.FTP in server.protocols:
                report.status = "FAIL"
                report.status_extended = f"Transfer Server {server.id} does not have encryption in transit enabled."

            findings.append(report)

        return findings

References