AWS.Transfer reference

DeleteSshPublicKey

Source: src/AWS/Transfer/DeleteSshPublicKey.ts

Runtime binding for transfer:DeleteSshPublicKey.

Removes an SSH public key from the bound User by SshPublicKeyId (returned by ImportSshPublicKey or listed via DescribeUser) — the revocation half of key rotation. The ServerId and UserName are injected from the binding. Deleting a key that no longer exists fails with the typed ResourceNotFoundException. Provide the implementation with Effect.provide(AWS.Transfer.DeleteSshPublicKeyHttp).

DeleteSshPublicKey: Managing SSH Keys at Runtime

// init — bind the operation to the user
const deleteSshPublicKey = yield* AWS.Transfer.DeleteSshPublicKey(user);

// runtime
yield* deleteSshPublicKey({ SshPublicKeyId: keyId }).pipe(
  Effect.catchTag("ResourceNotFoundException", () => Effect.void),
);

DescribeServer

Source: src/AWS/Transfer/DescribeServer.ts

Runtime binding for transfer:DescribeServer.

Reads the bound Server’s live configuration and state — the ServerId is injected from the binding. Useful for checking whether the server is ONLINE/OFFLINE before a StartServer/StopServer call or surfacing endpoint details to an admin portal. Provide the implementation with Effect.provide(AWS.Transfer.DescribeServerHttp).

DescribeServer: Observing the Server

// init — bind the operation to the server
const describeServer = yield* AWS.Transfer.DescribeServer(server);

// runtime
const { Server } = yield* describeServer();
yield* Effect.log(`server is ${Server.State}`);

DescribeUser

Source: src/AWS/Transfer/DescribeUser.ts

Runtime binding for transfer:DescribeUser.

Reads the bound User’s live configuration — home directory, role, POSIX profile, and the SSH public keys currently registered (including their SshPublicKeyIds, which DeleteSshPublicKey needs). The ServerId and UserName are injected from the binding. Provide the implementation with Effect.provide(AWS.Transfer.DescribeUserHttp).

DescribeUser: Managing Users at Runtime

// init — bind the operation to the user
const describeUser = yield* AWS.Transfer.DescribeUser(user);

// runtime
const { User } = yield* describeUser();
const keyIds = (User.SshPublicKeys ?? []).map((k) => k.SshPublicKeyId);

ImportSshPublicKey

Source: src/AWS/Transfer/ImportSshPublicKey.ts

Runtime binding for transfer:ImportSshPublicKey.

Registers an additional SSH public key on the bound User — the key-rotation half of a self-service credential portal. The ServerId and UserName are injected from the binding; only the public key body is passed at runtime. Returns the new SshPublicKeyId for later DeleteSshPublicKey. Importing a key that is already registered fails with the typed ResourceExistsException. Provide the implementation with Effect.provide(AWS.Transfer.ImportSshPublicKeyHttp).

ImportSshPublicKey: Managing SSH Keys at Runtime

// init — bind the operation to the user
const importSshPublicKey = yield* AWS.Transfer.ImportSshPublicKey(user);

// runtime
const { SshPublicKeyId } = yield* importSshPublicKey({
  SshPublicKeyBody: "ssh-ed25519 AAAA…",
});

ListUsers

Source: src/AWS/Transfer/ListUsers.ts

Runtime binding for transfer:ListUsers.

Lists the users attached to the bound Server — the ServerId is injected from the binding. Pass MaxResults/NextToken to page through large user sets. The building block for self-service user portals over a service-managed server. Provide the implementation with Effect.provide(AWS.Transfer.ListUsersHttp).

ListUsers: Managing Users at Runtime

// init — bind the operation to the server
const listUsers = yield* AWS.Transfer.ListUsers(server);

// runtime
const { Users } = yield* listUsers();
yield* Effect.log(`users: ${Users.map((u) => u.UserName).join(", ")}`);

SendWorkflowStepState

Source: src/AWS/Transfer/SendWorkflowStepState.ts

Runtime binding for transfer:SendWorkflowStepState.

Reports a custom workflow step’s outcome back to Transfer Family. A managed workflow’s custom step invokes a Lambda with the workflow id, execution id, and a callback token; the Lambda MUST call this operation with SUCCESS or FAILURE or the step hangs until its timeout. The action authorizes on the workflow’s own ARN, which arrives at runtime inside the step event, so the grant is on *. Provide the implementation with Effect.provide(AWS.Transfer.SendWorkflowStepStateHttp).

SendWorkflowStepState: Custom Workflow Steps

// init — account-level binding, no resource argument
const sendWorkflowStepState = yield* AWS.Transfer.SendWorkflowStepState();

// runtime — inside the Lambda invoked by the workflow's custom step
yield* sendWorkflowStepState({
  WorkflowId: event.serviceMetadata.executionDetails.workflowId,
  ExecutionId: event.serviceMetadata.executionDetails.executionId,
  Token: event.token,
  Status: "SUCCESS",
});

Server

Source: src/AWS/Transfer/Server.ts

An AWS Transfer Family server — a managed SFTP/FTPS/FTP/AS2 endpoint in front of S3 or EFS storage. A running server is billed hourly (plus data transfer), so create it only when needed and destroy it promptly.

Server: Creating a Server

const server = yield* Server("Sftp", {
  protocols: ["SFTP"],
  domain: "S3",
  endpointType: "PUBLIC",
  identityProviderType: "SERVICE_MANAGED",
});

Server: Adding Users

const server = yield* Server("Sftp", {
  protocols: ["SFTP"],
  identityProviderType: "SERVICE_MANAGED",
});

// Role Transfer Family assumes to access the S3 storage backend
const role = yield* AWS.IAM.Role("TransferUserRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Service: "transfer.amazonaws.com" },
        Action: ["sts:AssumeRole"],
      },
    ],
  },
  inlinePolicies: {
    s3: {
      Version: "2012-10-17",
      Statement: [
        {
          Effect: "Allow",
          Action: ["s3:ListBucket", "s3:GetObject", "s3:PutObject"],
          Resource: [bucket.bucketArn, Output.interpolate`${bucket.bucketArn}/*`],
        },
      ],
    },
  },
});

const user = yield* User("Alice", {
  serverId: server.serverId,
  userName: "alice",
  role: role.roleArn,
  homeDirectory: Output.interpolate`/${bucket.bucketName}/alice`,
  sshPublicKeyBody: "ssh-ed25519 AAAA...",
});

StartServer

Source: src/AWS/Transfer/StartServer.ts

Runtime binding for transfer:StartServer.

Brings a stopped Server from OFFLINE back to ONLINE so it can accept file transfers again — the ServerId is injected from the binding. Paired with StopServer this enables runtime schedules that park the endpoint outside business hours. The call is asynchronous: the server passes through STARTING; observe progress with DescribeServer. Starting a server that is not OFFLINE fails with the typed InvalidRequestException. Provide the implementation with Effect.provide(AWS.Transfer.StartServerHttp).

StartServer: Controlling Server Availability

// init — bind the operation to the server
const startServer = yield* AWS.Transfer.StartServer(server);

// runtime
yield* startServer();

StopServer

Source: src/AWS/Transfer/StopServer.ts

Runtime binding for transfer:StopServer.

Takes the bound Server from ONLINE to OFFLINE so it stops accepting file transfers — the ServerId is injected from the binding. Server and user configuration are unaffected. Note stopping does NOT pause billing; only deleting the server does. The call is asynchronous: the server passes through STOPPING; observe progress with DescribeServer. Stopping a server that is not ONLINE fails with the typed InvalidRequestException. Provide the implementation with Effect.provide(AWS.Transfer.StopServerHttp).

StopServer: Controlling Server Availability

// init — bind the operation to the server
const stopServer = yield* AWS.Transfer.StopServer(server);

// runtime
yield* stopServer();

TestIdentityProvider

Source: src/AWS/Transfer/TestIdentityProvider.ts

Runtime binding for transfer:TestIdentityProvider.

Exercises the bound Server’s custom identity provider (API_GATEWAY, AWS_LAMBDA, or AWS_DIRECTORY_SERVICE) with a user name and optional password, returning the provider’s raw response and status code — the ServerId is injected from the binding. The password is Redacted end-to-end (distilled marks UserPassword sensitive). Calling it on a SERVICE_MANAGED server fails with the typed InvalidRequestException. Provide the implementation with Effect.provide(AWS.Transfer.TestIdentityProviderHttp).

TestIdentityProvider: Diagnosing Authentication

import * as Redacted from "effect/Redacted";

// init — bind the operation to the server
const testIdentityProvider = yield* AWS.Transfer.TestIdentityProvider(server);

// runtime
const result = yield* testIdentityProvider({
  UserName: "alice",
  UserPassword: Redacted.make("secret"),
  ServerProtocol: "SFTP",
});
yield* Effect.log(`identity provider replied ${result.StatusCode}`);

User

Source: src/AWS/Transfer/User.ts

A user of an AWS Transfer Family server (service-managed identity provider). Users are free configuration objects attached to a Server; the server itself is what incurs hourly cost.

User: Creating a User

const user = yield* User("Alice", {
  serverId: server.serverId,
  userName: "alice",
  role: transferRole.roleArn,
  homeDirectory: "/my-bucket/alice",
  sshPublicKeyBody: "ssh-ed25519 AAAA...",
});