Connector Improvement: Enable SSH Key Rotation for SFTP Connectors
AnsweredWe urgently require the ability to rotate SSH keys for SFTP connectors to meet enterprise security standards. Currently, Fivetran generates a key pair once, and this key persists indefinitely. There is no UI or API mechanism to regenerate this key.
Support suggested that creating a brand-new connector would generate a fresh key pair. However, our testing confirms that Fivetran assigns the exact same public key even to new connectors after the previous ones are deleted.
Current Issues:
- Security Compliance: Inability to rotate keys violates standard enterprise policies requiring regular credential rotation.
- Persistence Bug: New connectors recycle old keys, making it impossible to manually cycle credentials by recreating resources.
Feature Request:
Please implement a feature to force-regenerate the SSH key pair for a specific connector via the Dashboard or API. Additionally, ensure that creating a new connector always results in a unique key pair.
-
Official comment
Hi Mohsen,
This is a valuable feature request. The ability to rotate SSH key pairs for SFTP connectors to meet enterprise security standards is noted, and I have added this to our feature improvements backlog.
To better understand your needs, could you provide more detail on your security and compliance requirements? For example, are there specific rotation intervals mandated by your organization? What keystores would you require? If you are using Azure Key Vault or Hashicorp Vault we might have a faster route to a solution.
We will keep this thread updated with any progress or changes regarding this request.
Thanks,
Pieter -
Also, can you let me know the support case number? perhaps we can assist with rotation, I can investigate.
-
Hi team, we have a similar requirement around SSH key rotation. Our organisation requires a rotation interval of x days.
If implementing this feature more broadly will take some time, is there any way for Fivetran to perform a key rotation for a specific connector in the interim?
Please sign in to leave a comment.
Comments
3 comments