StableLogic SFTP Transfer

Prerequisites:

• An EC2 key pair in the target region. This is required: the admin password is generated on the instance at first use and retrieved over SSH, so without a key pair you cannot obtain it.
• An IAM role with the following S3 permissions on your target bucket: s3:GetObject, s3:PutObject, s3:DeleteObject, s3:ListBucket
• If using SSE-KMS encryption, also add kms:GenerateDataKey and kms:Decrypt on your KMS key.
• Note: the instance role is used only when the Access Key and Secret Key fields are left empty when you create a Cloud Connection. If you enter keys, they take precedence and the role is ignored.

Launching the Instance:

• Launch an EC2 instance from this AMI (t3.medium recommended as a minimum)
• Attach the IAM role created above to the instance
• Select your EC2 key pair so you can retrieve the admin password
• Assign a security group with the ports listed below
• Ensure the instance can reach the S3 API, via a public subnet, NAT, or an S3 VPC endpoint

Security Group - Required Ports

• Port 22 - SFTP file transfer (open to SFTP client/partner IPs only)
• Port 5173 - Admin web portal, HTTP only (restrict to your office or VPN IP)
• Port 2222 - EC2 admin SSH access (restrict to your IP only)

Retrieving the Admin Password

This AMI ships with no default or preset credentials. A unique random password is generated on your own instance. To obtain it, connect over SSH and run:

The command prints the username (admin) and the generated password once. Record it in a password manager immediately. It applies to both the admin web portal and the SFTP 'admin' user.

This is a one-time operation. If you need to reset it later, run the same command with --force, which overwrites any password subsequently set via the portal.

Accessing the Admin Portal

• Open http://<instance-public-ip>:5173 in your browser
• Log in as 'admin' using the password generated above
• Set your own password after first login, as the generated value may remain in your terminal history
• Enable MFA from the MFA section for additional security

Connecting via SFTP

• Host: <instance-public-ip>
• Port: 22
• Authenticate using password or SSH public key
• Use any standard SFTP client

First Steps

• Add your S3 bucket under Cloud Connections. Leave Access Key and Secret Key empty to use the attached instance role.
• Create SFTP users under the Users section
• Assign home folders and read/write permissions under the Folders section
• Configure bandwidth throttling and IP whitelisting per user as required

Network Access

The admin web portal is intended for access from a trusted network rather than the public internet. Restrict port 5173 to your office or VPN IP range in your security group, or reach it through an SSH tunnel over port 2222. The portal is served over HTTP, so if you require access from outside your network, place it behind a load balancer or reverse proxy that terminates TLS.

Port 22 should be restricted to known partner IP ranges where possible.

Set your own admin password after first login and enable MFA on all admin accounts.

Quick Start Guide: https://public.stablelogic.com/StableLogic%20SFTP%20Transfer%20%E2%80%94%20Quick%20Start%20Guide.pdf