https://www.cloudkaramchari.com/tags/source-ip/Recent content in Source IP on CloudkaramchariHugo -- gohugo.ioencloudkaramchariTue, 08 Sep 2026 11:00:00 +0530https://www.cloudkaramchari.com/blog/find-source-ip-addresses-aws-transfer-family-sftp-cloudwatch-logs-insights/Tue, 08 Sep 2026 11:00:00 +0530https://www.cloudkaramchari.com/blog/find-source-ip-addresses-aws-transfer-family-sftp-cloudwatch-logs-insights/ <h1 id="find-source-ip-addresses-connecting-to-aws-transfer-family-sftp-with-cloudwatch-logs-insights">Find Source IP Addresses Connecting to AWS Transfer Family SFTP with CloudWatch Logs Insights</h1> <p>If your AWS Transfer Family SFTP server has CloudWatch logging turned on, every connection, login attempt, and file operation is already sitting in a log group — you just need the right query to pull the source IPs out of it. This comes up in three situations: someone reports failed logins and you need to know where they're coming from, you're building an IP allowlist and need a baseline of who's actually connecting today, or an audit asks &quot;who accessed this SFTP server and from where&quot; and the honest answer is &quot;let me go check.&quot;</p>