For this post, I created a demo Okta account and a few Okta users.

The response from API Gateway authorizes the end user and grants access to your S3 bucket.

The AWS SFTP server uses the API Gateway URL backed by the Lambda function to query Okta and validate the end user’s credentials.

The API is integrated with a Lambda function.

AWS SFTP passes these credentials to the API Gateway endpoint that you provided when you created the server (step 1).

An end user attempts to log in, supplying the Okta user name and password.

Steps 1 and 2 are one-time efforts required during set up.

Next, use the API Gateway URL during AWS SFTP server creation.

Using the provided AWS CloudFormation template provided below, set up an API using API Gateway and the corresponding Lambda function for authentication with the Okta Authentication API.

The following diagram and description summarizes the overall workflow of this solution: AWS SFTP invokes this method to authenticate your SFTP users. When using the IdP mode with AWS SFTP, you supply the API Gateway method. This IdP can be Microsoft Active Directory, Okta, or any custom datastore that you use as a part of an overall access provisioning system. When you create an SFTP server, you can integrate your existing IdP into the service using an Amazon API Gateway method with a RESTful interface, backed by an AWS Lambda function. It can be used as a standalone API to provide the identity layer on top of your existing application.” Custom IdP primer In this post, I demonstrate how you can integrate Okta as your IdP for AWS SFTP, using Okta’s Authentication API.Īccording to Okta’s website, “ The Okta Authentication API provides operations to authenticate users, perform multi-factor enrollment and verification, recover forgotten passwords, and unlock accounts. Last month, we showed you how to integrate AWS Secrets Manager to enable password authentication.

Plug in an existing identity provider (IdP).

Store your users’ identities within the service.The service supports two ways of managing end users who can exchange files through your AWS managed SFTP server: Enterprises and startups across a range of industries can use AWS SFTP without needing to modify applications or manage any SFTP servers.ĭata uploaded or downloaded over SFTP is available in your Amazon S3 bucket, and can be used for archiving or processing in AWS. AWS Transfer for SFTP (AWS SFTP) is a fully managed service that enables you to move file transfer workloads to AWS when they use the Secure Shell File Transfer Protocol (SFTP).

Cyberduck amazon s3 setup