### Terraform module for AWS Transfer Family using AWS Secrets Manager.

![alt text](https://d2908q01vomqb2.cloudfront.net/e1822db470e60d090affd0956d743cb0e7cdf113/2020/11/05/With-this-AWS-Transfer-Family-configuration-the-diagramed-workflow-authenticates-and-authorises-users..jpg.png)

1. A user attempts to log in, supplying either a user name and password (SFTP), or a user name and locally stored private SSH key (SFTP).
2. AWS Transfer Family passes these credentials along with the client protocol and source IP address to the API Gateway endpoint you provide when creating the AWS Transfer Family endpoint. If the user does not provide a password, it is assumed that they are using SSH key-based authentication. The API Gateway integrates with an AWS Lambda function.
3. The AWS Lambda function queries the custom authentication provider (which can be any datastore, and in this case AWS Secrets Manager) passing the same parameters from step 2.
4. Secrets Manager returns the key-value pairs associated with the user or secret. This contains the user’s stored password, the IAM role mapping for the user, and any public SSH key information (if you allow SSH key-based authentication for the user). It also contains source IP CIDRS for you to check, and any virtual directory mappings.
5. The AWS Lambda function validates the login and returns any user configuration.

```diff
+ Info: Code resides in lambda-code directory is what we zip and deploy to the actual lambda function.
```

##### Process of adding user to secrets manager.
```
If user needs access to the "iMusica" folder in s3
Example: s3://prod-orcd-ftp/ftp/Royalty Reports/iMusica

Stage keys values in secrets manager
 Role:                 arn:aws:iam::437795906767:role/prod-orcd-sftp-RW-role
 Password:             *********
 HomeDirectoryDetails: [{"Entry": "/", "Target": "/prod-orcd-ftp/ftp/Royalty Reports/iMusica"}]
 PublicKey:            ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/+Q4i5GirEVK+sLvcTcxGioJ4UB2UJWXE4aoX2wM0hSAkNM8Q
 SourceIP:             207.237.185.0/26

```

Save secret with the name prod/orcd-sftp/iMusica
```
Note: iMusica is the user name for the sftp server that AWS Lambda function validates the login and returns any user configuration.
```

##### Process of adding user to secrets manager with multitple directories.
```
If user needs access to the "iMusica" folder in s3
Example: s3://prod-orcd-ftp/ftp/Royalty Reports/EPSA

Stage keys values in secrets manager
 Role:                 arn:aws:iam::437795906767:role/prod-orcd-sftp-RO-role
 Password:             *********
 HomeDirectoryDetails: [ {"Entry": "/Argentina", "Target": "/prod-orcd-ftp/ftp/Royalty Reports/iMusica/Argentina"}, {"Entry": "/Paraguai", "Target": "/prod-orcd-ftp/ftp/Royalty Reports/iMusica/Paraguai"}, {"Entry": "/Uruguai", "Target": "/prod-orcd-ftp/ftp/Royalty Reports/iMusica/Uruguai"} ]
 PublicKey:            ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/+Q4i5GirEVK+sLvcTcxGioJ4UB2UJWXE4aoX2wM0hSAkNM8Q

```
Save secret with the name prod/orcd-sftp/EPSA
```
Note: EPSA is the user name for the sftp server that AWS Lambda function validates the login and returns any user configuration.
```