title: Cannot connect to AWS Transfer S3 SFTP server - might need to set security group
body: <p>I'm trying to set up an SFTP server managed by AWS that has a fixed IP address which external clients can whitelist in a firewall. Based on <a href="https://aws.amazon.com/aws-transfer-family/faqs/" rel="nofollow noreferrer">this FAQ</a> this is what I should do:</p>
  <blockquote>
  <p>You can enable fixed IPs for your server endpoint by selecting the VPC endpoint for your server and choosing the internet-facing option. This will allow you to attach Elastic IPs (including BYO IPs) to your server’s endpoint, which is assigned as the endpoint’s IP address</p>
  </blockquote>
  <p>So I followed the <a href="https://docs.aws.amazon.com/transfer/latest/userguide/create-server-in-vpc.html#create-internet-facing-endpoint" rel="nofollow noreferrer">official instructions here</a> under &quot;Creating an Internet-Facing Endpoint for Your SFTP Server&quot;. The creation settings look like this:</p>
  <p><a href="https://i.stack.imgur.com/RKUTO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RKUTO.png" alt="Server configuration 1" /></a></p>
  <p><a href="https://i.stack.imgur.com/ZoIRQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZoIRQ.png" alt="Server configuration 2" /></a></p>
  <p>The result looks like this:</p>
  <p><a href="https://i.stack.imgur.com/sRRBv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sRRBv.png" alt="Server result" /></a></p>
  <p>Compare with the result screenshot from the docs:</p>
  <p><a href="https://i.stack.imgur.com/0AMnU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0AMnU.png" alt="docs" /></a><br />
  <sub>(source: <a href="https://docs.aws.amazon.com/transfer/latest/userguide/images/server-config-internet-facing.png" rel="nofollow noreferrer">amazon.com</a>)</sub></p>
  <p>My result is almost the same, except that under the table &quot;Endpoint Configuration&quot; the last column says &quot;Private IPv4 Address&quot; instead of 'Public'. That's the first red flag. I have no idea why it's a private address. It doesn't look like one, it's the IP address of the Elastic IP that I created, and the endpoint DNS name <code>s-******.server.transfer.eu-west-1.amazonaws.com</code> resolves to that IP address on my local machine.</p>
  <p>If I ping the endpoint or the IP address, it doesn't work:</p>
  <pre><code>451 packets transmitted, 0 received, 100% packet loss, time 460776ms
  </code></pre>
  <p>If I try connecting with <code>sftp</code> or <code>ssh</code> it hangs for a while before failing:</p>
  <pre><code>ssh: connect to host 34.****** port 22: Connection timed out
  Connection closed
  </code></pre>
  <p>The other potential problem is security groups:</p>
  <blockquote>
  <p>At this point, your endpoint is assigned with the selected VPC's default security group. To associate additional or change existing security groups, visit the Security Groups section in the <a href="https://console.aws.amazon.com/vpc/" rel="nofollow noreferrer">https://console.aws.amazon.com/vpc/</a>.</p>
  </blockquote>
  <p>These instructions don't make sense to me because there's nowhere in the Security Groups interface that I can assign a group to another entity such as a transfer server. And there's nowhere in the transfer server configuration that mentions security groups. How do I set a new security group?</p>
  <p>I tried changing the security group of the Network Interface of the Elastic IP, but I got a permission error even though I'm an administrator. Apparently I don't actually own ENIs? In any case I don't know if this is the right path.</p>