File Transfer

Set up P0's File Transfer integration to move local files to AWS EC2 instances through a customer-owned S3 bucket, with just-in-time access and full auditing.

The File Transfer integration lets you copy a local file to an AWS EC2 instance through a customer-owned S3 bucket, where each file is staged only for the duration of the transfer and then removed. It supports AWS EC2 instances only. P0 grants just-in-time access for each transfer, so every file movement is requested, approved, and audited like any other P0 access request.

File Transfer is in beta. The setup and command syntax may change in future releases.

p0 file transfer or p0 scp? Use File Transfer to move large files to AWS EC2 instances: it stages the file in S3 with multipart upload and has the instance download it directly, which is faster than p0 scp streaming the bytes over the SSH tunnel. File Transfer only copies files to an instance. For small files, quick copies, copying files from an instance, or non-AWS instances, use p0 scp.

This guide has the following sections:

1. Prerequisites

2. Installation instructions

   • Option 1: Set up with Terraform

   • Option 2: Set up manually

3. Configuration reference

4. Permissions granted

5. Security

6. Transfer your first file

Prerequisites

Ensure you have the following before you continue:

• An existing P0 account at p0.app.

• The P0 AWS IAM integration installed for the AWS account that hosts your target instances.

• The P0 SSH integration for that account. File Transfer reaches instances over SSH, so the account needs the SSH integration — but you don't need to install it in advance if you set up with Terraform. See Does my account need the SSH integration? for details.

• An S3 bucket to use as the staging area. The bucket must be in the same AWS account that hosts your target instances. If you set up with Terraform, the terraform-aws-p0-file-transfer module creates this bucket for you with secure defaults.

• The P0 CLI >= v0.27.5 installed on your computer.

• curl installed on each destination instance. It's present by default on mainstream EC2 AMIs, such as Amazon Linux, Ubuntu, and RHEL.

Installation instructions

Set up File Transfer in one of two ways:

• Option 1: Set up with Terraform — recommended. The terraform-aws-p0-file-transfer module provisions and hardens the staging bucket for you.

• Option 2: Set up manually — register an existing S3 bucket through the P0 dashboard.

Does my account need the SSH integration?

Yes — File Transfer reaches instances over SSH, so the target AWS account must have the P0 SSH integration installed. How you satisfy this requirement depends on your setup path:

• Terraform: You don't need SSH installed beforehand. Include the p0_ssh_aws resource in your configuration (shown in Option 1) to install it in the same terraform apply. If SSH is already installed for the account, omit that resource.

• Manual: SSH must already be installed for the account. Only AWS accounts with the SSH integration installed appear in the dashboard dropdown. Install the SSH integration first if your account is missing.

Option 1: Set up with Terraform

We recommend installing File Transfer with the terraform-aws-p0-file-transfer module (creates the S3 bucket) and the P0 Terraform provider (installs File Transfer in P0). The module provisions the staging S3 bucket with secure defaults so you don't have to create or harden the bucket by hand, and the provider registers it with P0.

1. Install the Terraform CLI if you haven't already. See the Terraform installation guide.

2. Generate a P0 API token. The P0 provider authenticates with an API token that you create in the P0 dashboard — see Generating an API key. Export it so the provider can read it:

export P0_API_TOKEN=<your-p0-api-token>

1. Configure the providers. In a new or existing Terraform project, create a configuration file (for example, main.tf) that declares the P0 and AWS providers. The terraform-aws-p0-file-transfer module provisions AWS resources, so it needs the AWS provider configured with credentials and a region for the account that hosts your instances:

terraform {
  required_providers {
    p0 = {
      source  = "p0-security/p0"
      version = ">= 0.43.0"
    }
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.42.0"
    }
  }
}

provider "p0" {
  org = "your-p0-organization"
}

provider "aws" {
  region = "us-east-1"
}

Configure AWS credentials the same way you would for any AWS Terraform project — for example, by setting AWS_PROFILE or the standard AWS environment variables. For more provider options, see the P0 Terraform provider documentation.

1. Declare the file transfer module and resources. Add the following to your configuration. The p0_file_transfer resource requires the AWS SSH integration (p0_ssh_aws) on the same account. Include the p0_ssh_aws resource to install SSH in the same apply, or omit it if SSH is already installed for the account.

# Creates the S3 bucket and cloud resources needed for file transfer.
module "file_transfer_bucket" {
  source  = "p0-security/p0-file-transfer/aws"
  version = "0.1.1"
}

# If SSH is not already installed for this AWS account, declare it here first.
# Otherwise, feel free to skip this declaration.
resource "p0_ssh_aws" "example" {
  account_id = module.file_transfer_bucket.account_id
}

# Installs the file transfer integration in your P0 account.
resource "p0_file_transfer" "example" {
  account_id  = module.file_transfer_bucket.account_id
  bucket_name = module.file_transfer_bucket.bucket_name
  depends_on  = [module.file_transfer_bucket]
}

Argument	Required	Description
account_id	Yes	The AWS account ID. The SSH integration must be installed for this account — either already installed, or declared with the p0_ssh_aws resource earlier in this topic.
bucket_name	Yes	The staging S3 bucket, without the s3:// prefix.

1. Initialize the working directory. Run terraform init in the project directory. Terraform downloads the P0 and AWS providers and the terraform-aws-p0-file-transfer module.

terraform init

1. Preview the changes. Run terraform plan to review what Terraform creates — the staging S3 bucket, the SSH integration (if you declared p0_ssh_aws), and the File Transfer integration.

terraform plan

1. Apply the configuration. Run terraform apply. Terraform shows the plan and prompts for confirmation — enter yes to proceed.

terraform apply

After Terraform applies, File Transfer is ready to use.

For further documentation on what the Terraform module does, visit the Terraform Registry.

What Terraform provisions

When you apply this configuration, the terraform-aws-p0-file-transfer module creates the staging S3 bucket with the following settings:

Setting	Value
Bucket name	p0-transfers-<account_id>, derived automatically from the AWS account ID.
Lifecycle — uploads/ expiration	Objects under the uploads/ prefix delete automatically after 1 day.
Lifecycle — incomplete uploads	Incomplete multipart uploads abort after 1 day.
Versioning	Disabled.
Public access	Fully blocked — block_public_acls, block_public_policy, ignore_public_acls, and restrict_public_buckets are all enabled.
Bucket policy	Denies all S3 operations over non-HTTPS connections (DenyInsecureTransport).
Encryption	AES256 (SSE-S3), with S3 Bucket Keys enabled.
Object ownership	BucketOwnerEnforced (ACLs disabled).

The uploads/ lifecycle rule is a safety net: P0 deletes each file after a successful transfer, and the rule clears anything left behind by an interrupted transfer.

Option 2: Set up manually

The dashboard flow registers an existing S3 bucket with P0 — it doesn't create the bucket. Create the staging bucket first. We strongly recommend the terraform-aws-p0-file-transfer module, which provisions the bucket with the correct hardened settings automatically. Creating the bucket manually is possible but error-prone: you must replicate every setting the module applies yourself (see What Terraform provisions).

1. Go to p0.app in your browser. Select Integrations, then under the Resources section, select File transfer.

2. From the list of Available components, select File transfer access control.

3. Select + Add account.

4. From the Account identifier dropdown, select the AWS account that hosts your target instances, then select Next.

Only AWS accounts with the SSH integration installed appear in the Account identifier dropdown. If your account is missing, install the SSH integration first.

1. In the S3 bucket name field, enter the name of your customer-owned bucket, without the s3:// prefix. Use a valid S3 DNS-style name: 3–63 characters, lowercase letters, numbers, dots, and hyphens. The bucket must be in the AWS account you selected in the previous step.

   The bucket name is the only detail you enter.

If P0 can't find the bucket in the selected account, the install fails with a validation error. Confirm the bucket name and that the bucket lives in the account you selected, then try again.

1. Select Finish to complete the setup. The account now appears on the File transfer access control page.

You're now set up with File Transfer for P0 on AWS.

Configuration reference

Field	Required	Description	Example
bucketName	Yes	Customer-owned S3 bucket for staging transfers, without the s3:// prefix. Must be a valid S3 DNS-style name.	my-transfer-bucket

bucketName is the only value you provide. When you install File Transfer, P0 verifies that the bucket exists in the selected AWS account and reads its region and AWS partition directly from AWS.

P0 grants each transfer temporary read and write access scoped to your own prefix in this bucket. P0 never requires standing access to the bucket's full contents.

Permissions granted

When a File Transfer request is approved, P0 grants two scoped, temporary permissions:

• SSH access to the destination instance, through the P0 SSH integration — the same access as p0 ssh.

• S3 read/write access, through the P0 AWS integration. P0 grants the AmazonS3ReadWriteAccess permission on the staging bucket, scoped to your own uploads/<your-user-key>/ prefix.

Security

File Transfer grants the least access necessary, for the shortest time, inside your own AWS account:

• Just-in-time and audited. Each transfer is a P0 access request — requested, approved, and logged like any other access. There's no standing access to the bucket.

• File Transfer implies SSH access. A transfer downloads the file by running a command on the destination over SSH, so it grants the same access as p0 ssh to that instance. Approve requests with that in mind.

• Least privilege and short-lived. P0 grants temporary credentials scoped to your own prefix in the bucket, and both the credentials and the download URL expire automatically.

• Your bucket, cleaned up automatically. The staging bucket lives in your AWS account and is hardened with secure defaults. P0 removes each uploaded file after the transfer completes — see What Terraform provisions for the bucket's security settings.

Transfer your first file

With setup complete, use the p0 file-transfer CLI command to copy a local file to an instance. Pass the local file path and the destination instance ID or name:

p0 file-transfer ./config.yaml i-1234567890abcdef0 --reason "Deploy updated config"

P0 requests just-in-time access, uploads the file, and downloads it to your home directory on the instance.

For the full command reference, options, and troubleshooting, see Transfer a file to an instance.