Authenticate an AWS Transfer file-server user

GET 
/servers/:serverId/users/:username/config

AWS Transfer Family identity-provider callback (SigV4, no role_id). Authenticates username with the Password header (Cognito) or, if Password is omitted, SSH keys from SSM. The user must have at least read on the file-server datasource. 200 returns a LOGICAL home directory for datasets they own or can edit on that server. Password auth is not idempotent.

Request

Responses

200

Transfer user config: IAM Role, LOGICAL HomeDirectoryDetails (JSON string of Entry/Target maps), HomeDirectoryType, and PublicKeys (empty list when password auth was used).

400

The datasources Lambda maps UnauthorizedUserException and InvalidInputException to HTTP 400. This path wraps those failures inside handle_sftp_server_auth as GE-1034, so clients typically see 500 instead.

500

Auth and lookup failures are GenericFailureException {"Message": "GE-1034 - User authentication failed with error: "}. Inner text includes unknown ServerId, invalid user (GE-1060), IDP+password, Cognito failure, missing datasource read access (AUTH-1012), and missing protocol/sourceIp. Uncaught errors before that try use {"Message": ""} with no code prefix.