Skip to content

Commit 8f4453f

Browse files
oliviamelaniputriioliviamelaniputrii
authored
Merge pull request #93 from aws-ia/feature/web-apps
[Minor Release] - Transfer Family Web App Modules and Examples
2 parents 6bb5f83 + 7f8c004 commit 8f4453f

File tree

22 files changed

+2551
-66
lines changed

22 files changed

+2551
-66
lines changed

‎.header.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,16 @@ This module creates and configures AWS Transfer Family resources with the follow
99
- **Transfer Server**: SFTP server setup with protocol and security policies
1010
- **Transfer Connectors**: Automated file transfer to/from external SFTP servers
1111
- **Transfer Users**: User management with S3 bucket permissions and KMS access
12+
- **Transfer Web App**: Browser-based interface with IAM Identity Center authentication and S3 Access Grants
1213
- **Malware Protection**: GuardDuty integration for automatic file scanning,
1314
smart routing, and thread notification
1415
- Custom hostname support through AWS Route53 or other DNS providers (Optional)
1516
- CloudWatch logging configuration with a customizable retention
1617

18+
**Note**: These modules have been tested only in the `aws` partition (commercial regions).
19+
For more information about AWS partitions, see the
20+
[AWS Fault Isolation Boundaries whitepaper](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html).
21+
1722
## Quick Start
1823

1924
```hcl
@@ -177,6 +182,19 @@ This project utilizes multiple modules to create a complete AWS Transfer Family
177182
For more detailed configuration, see the
178183
[Transfer Malware Protection Module documentation](https://github.com/aws-ia/terraform-aws-transfer-family/blob/main/modules/transfer-malware-protection/README.md).
179184

185+
### Transfer Web App Module
186+
187+
- Purpose: Creates browser-based file transfer interface with Identity Center authentication
188+
- Key features:
189+
- AWS IAM Identity Center integration for authentication
190+
- S3 Access Grants for fine-grained permissions
191+
- Custom branding with logo, favicon, and title
192+
- CORS configuration support
193+
- Built-in validation for proper configuration
194+
195+
For more detailed configuration, see the
196+
[Transfer Web App documentation](https://github.com/aws-ia/terraform-aws-transfer-family/blob/main/modules/transfer-web-app/README.md).
197+
180198
## Installation
181199

182200
To use these modules in your Terraform configuration:
@@ -393,6 +411,22 @@ Key features:
393411
- Configurable destination buckets for clean, infected, and error files
394412
- Optional file cleanup from ingestion bucket
395413

414+
## Example for Sample Web App
415+
416+
This example demonstrates a complete browser-based file transfer portal with Identity Center authentication and S3 Access Grants.
417+
418+
**Example location**: `examples/sample-web-app`
419+
420+
Key features:
421+
422+
- Browser-based interface for secure file access
423+
- AWS IAM Identity Center integration for authentication
424+
- S3 Access Grants for fine-grained user and group permissions
425+
- CloudTrail audit logging with KMS encryption and SNS notifications
426+
- Custom branding with logo, favicon, and title customization
427+
- Flexible user/group management (create new or import existing)
428+
- Required S3 CORS configuration for secure web app access
429+
396430
## Key Connector Configuration
397431

398432
When using Transfer Connectors, pay attention to these critical attributes:

‎README.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,16 @@ This module creates and configures AWS Transfer Family resources with the follow
1010
- **Transfer Server**: SFTP server setup with protocol and security policies
1111
- **Transfer Connectors**: Automated file transfer to/from external SFTP servers
1212
- **Transfer Users**: User management with S3 bucket permissions and KMS access
13+
- **Transfer Web App**: Browser-based interface with IAM Identity Center authentication and S3 Access Grants
1314
- **Malware Protection**: GuardDuty integration for automatic file scanning,
1415
smart routing, and thread notification
1516
- Custom hostname support through AWS Route53 or other DNS providers (Optional)
1617
- CloudWatch logging configuration with a customizable retention
1718

19+
**Note**: These modules have been tested only in the `aws` partition (commercial regions).
20+
For more information about AWS partitions, see the
21+
[AWS Fault Isolation Boundaries whitepaper](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html).
22+
1823
## Quick Start
1924

2025
```hcl
@@ -178,6 +183,19 @@ This project utilizes multiple modules to create a complete AWS Transfer Family
178183
For more detailed configuration, see the
179184
[Transfer Malware Protection Module documentation](https://github.com/aws-ia/terraform-aws-transfer-family/blob/main/modules/transfer-malware-protection/README.md).
180185

186+
### Transfer Web App Module
187+
188+
- Purpose: Creates browser-based file transfer interface with Identity Center authentication
189+
- Key features:
190+
- AWS IAM Identity Center integration for authentication
191+
- S3 Access Grants for fine-grained permissions
192+
- Custom branding with logo, favicon, and title
193+
- CORS configuration support
194+
- Built-in validation for proper configuration
195+
196+
For more detailed configuration, see the
197+
[Transfer Web App documentation](https://github.com/aws-ia/terraform-aws-transfer-family/blob/main/modules/transfer-web-app/README.md).
198+
181199
## Installation
182200

183201
To use these modules in your Terraform configuration:
@@ -394,6 +412,22 @@ Key features:
394412
- Configurable destination buckets for clean, infected, and error files
395413
- Optional file cleanup from ingestion bucket
396414

415+
## Example for Sample Web App
416+
417+
This example demonstrates a complete browser-based file transfer portal with Identity Center authentication and S3 Access Grants.
418+
419+
**Example location**: `examples/sample-web-app`
420+
421+
Key features:
422+
423+
- Browser-based interface for secure file access
424+
- AWS IAM Identity Center integration for authentication
425+
- S3 Access Grants for fine-grained user and group permissions
426+
- CloudTrail audit logging with KMS encryption and SNS notifications
427+
- Custom branding with logo, favicon, and title customization
428+
- Flexible user/group management (create new or import existing)
429+
- Required S3 CORS configuration for secure web app access
430+
397431
## Key Connector Configuration
398432

399433
When using Transfer Connectors, pay attention to these critical attributes:

‎examples/sample-web-app/.header.md‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
# Sample Web App Example
2+
3+
This example demonstrates a complete deployment of AWS Transfer Family Web App with IAM Identity Center authentication, S3 Access Grants, CloudTrail audit logging, and CORS configuration.
4+
5+
## What This Example Demonstrates
6+
7+
- **Complete end-to-end setup** from IAM Identity Center users/groups to web-app deployment
8+
- **CloudTrail integration** with KMS encryption and SNS notifications for audit logging
9+
- **CORS configuration** restricted to the web app endpoint for security
10+
- **Flexible user/group management** supporting both test user and/or creation and imported existing users/groups
11+
- **Automatic path prefixing** demonstrating how to construct full S3 paths from bucket names
12+
- **Custom branding** with logo and favicon support
13+
14+
## What Gets Deployed
15+
16+
### Identity Center Resources (Optional)
17+
18+
- Users and groups (when `create_test_users_and_groups = true`)
19+
- Group creation and group memberships for created users
20+
- OR references to existing Identity Center users/groups (default mode)
21+
22+
### Transfer Web App
23+
24+
- Web app with Identity Center authentication and custom branding
25+
- S3 Access Grants instance with default location scope ("s3://")
26+
- Access grants for configured users and/or groups
27+
28+
### Storage and Audit
29+
30+
- S3 bucket with encryption, versioning, and public access blocking
31+
- CORS configuration restricted to web app endpoint
32+
- CloudTrail with KMS encryption and SNS notifications
33+
- Dedicated S3 bucket for CloudTrail logs
34+
35+
## Usage
36+
37+
1. **Configure users/groups**: Choose between creating test users and/or groups or configuring existing ones
38+
2. **Email addresses**: If creating new users, provide real email addresses for user activation
39+
3. **Deploy**: Run `terraform apply`
40+
4. **User Activation**: If creating new users, they receive activation emails to set up accounts
41+
5. **Access**: Log in through the web app endpoint URL
42+
43+
## User and Group Management Options
44+
45+
This example supports two approaches for managing users and groups:
46+
47+
### Option 1: Create Test Users and Groups (Default: Disabled)
48+
49+
Set `create_test_users_and_groups = true` to have Terraform create new Identity Center users and groups:
50+
51+
- Creates users with email activation required
52+
- Creates groups with specified descriptions and member assignments
53+
- Automatically handles group memberships
54+
- Ideal for demo environments or new Identity Center setups
55+
- **Note**: When enabled, any configurations in `imported-users.tf` and `imported-groups.tf` will be ignored
56+
57+
### Option 2: Import Existing Users and Groups (Default: Enabled)
58+
59+
Configure existing Identity Center users/groups via `imported-users.tf` and `imported-groups.tf`:
60+
61+
- **imported-users.tf**: Reference existing users by username and assign individual access grants
62+
- **imported-groups.tf**: Reference existing groups by name and assign group-level access grants
63+
- Users and groups must already exist in Identity Center before deployment
64+
- Ideal for production environments with established Identity Center configurations
65+
66+
S3 paths are automatically prefixed with the bucket name:
67+
68+
```hcl
69+
s3_path = "/*" # Becomes "bucket-name/*" in the module call
70+
```
71+
72+
To switch modes, modify the `create_test_users_and_groups` variable and update the respective configuration files.
73+
74+
## Configuration Variables
75+
76+
### Required Variables
77+
78+
None - all variables have defaults
79+
80+
### Optional Variables with Defaults
81+
82+
#### AWS Configuration
83+
84+
- `aws_region` (default: `"us-east-1"`) - AWS region for deployment
85+
- `identity_center_instance_arn` (default: `null`) - ARN of Identity Center instance (required if create_identity_center_instance is false)
86+
- `identity_store_id` (default: `null`) - ID of Identity Center identity store (required if create_identity_center_instance is false)
87+
- `create_identity_center_instance` (default: `false`) - Whether to create a new Identity Center instance (required if identity_center_instance_arn and identity_store_id are null)
88+
- `s3_access_grants_instance_id` (default: `null`) - ID of existing S3 Access Grants instance, creates new if not specified
89+
90+
#### User and Group Configuration
91+
92+
- `create_test_users_and_groups` (default: `false`) - Whether to create new users/groups or use existing ones
93+
- `test_users` (default: admin and analyst users) - Map of users to create when `create_test_users_and_groups = true`
94+
- `test_groups` (default: admins and analysts groups) - Map of groups to create when `create_test_users_and_groups = true`
95+
96+
#### Web App Customization
97+
98+
- `logo_file` (default: `"anycompany-logo-small.png"`) - Path to logo file for web app branding
99+
- `favicon_file` (default: `"favicon.png"`) - Path to favicon file for web app
100+
- `custom_title` (default: `"AnyCompany Financial Solutions"`) - Custom title for the web app
101+
102+
#### Resource Tagging
103+
104+
- `tags` (default: Name="Demo Web App File Transfer Portal", Environment="Demo", Project="Web App File Transfer Portal") - Tags to organize, search, and filter your web apps.
105+
106+
### Example Test User Configuration
107+
108+
```hcl
109+
test_users = {
110+
"admin" = {
111+
display_name = "Admin User"
112+
user_name = "admin"
113+
first_name = "Admin"
114+
last_name = "User"
115+
email = "admin@example.com"
116+
}
117+
}
118+
# Note: Only used when create_test_users_and_groups = true
119+
```
120+
121+
### Example Test Group Configuration
122+
123+
```hcl
124+
test_groups = {
125+
"admins" = {
126+
group_name = "Admins"
127+
description = "Read and write access to files"
128+
members = ["admin"]
129+
access_grants = [{
130+
s3_path = "/*" # Auto-prefixed with bucket name
131+
permission = "READWRITE"
132+
}]
133+
}
134+
}
135+
# Note: Only used when create_test_users_and_groups = true
136+
```
137+
138+
## S3 Path Examples
139+
140+
Supported path patterns (auto-prefixed with bucket name in this example):
141+
142+
- `/*` - All objects in the bucket
143+
- `/reports*` - Prefix within bucket
144+
- `/data/logs*` - Prefix within prefix
145+
- `/data/file.txt` - Specific object
146+
147+
## Important Notes
148+
149+
- **Email Addresses**: Must be real for user activation when creating new users
150+
- **Identity Center**: Requires existing instance in your account with `identity_center_instance_arn` and `identity_store_id` provided, or set `create_identity_center_instance = true` to create a new one
151+
- **User/Group Management**: Choose between creating test users or importing existing ones via configuration files
152+
- **CloudTrail**: Logs all S3 data events on the web app bucket
153+
- **CORS**: Restricted to web app endpoint only (no wildcards)
154+
- **Custom Branding**: Logo and favicon files should be placed in the example directory
155+
- **Production Warning**: This example uses `force_destroy = true` on the CloudTrail logging S3 bucket for easy cleanup.
156+
This is NOT suitable for production as it will delete all audit logs when running `terraform destroy`.
157+
Remove this setting for production deployments.
158+
- **Costs**: Creates billable AWS resources
159+
- **Cleanup**: Run `terraform destroy` to remove all resources

0 commit comments

Comments
 (0)