Previously, when AWS Transfer Family SFTP servers were placed behind a Network Load Balancer (NLB), the NLB replaced the client's source IP with its own private IP address, hindering IP-based auditing and access control. With the introduction of Proxy Protocol v2 support, the true client IP address is now maintained for authentication and logged events, enabling more accurate compliance and security enforcement.
This feature can be enabled per server through the AWS console, CLI, or API and is available in all AWS regions supporting Transfer Family. While AWS documented this as a new capability, independent assessments confirm the potential for improved auditing and identity provider accuracy when using custom access controls based on source IP.
Source & further reading
AWS Transfer Family now supports source IP preservation for SFTP servers behind a Network Load Balancer (NLB) ↗Source published 2026-09-17. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.