Partners, banks, payroll providers and old integrations still send files over SFTP. AWS Transfer Family gives you a managed SFTP, FTPS, FTP or AS2 endpoint that writes straight to S3 or EFS, for $0.30 an hour per protocol plus $0.04 per GB. What you get for about $219 a month, the setup choices that matter, and the cheaper options when the volume is small.
SFTP refuses to die because the other side controls it. A bank sends statements at 2 a.m., a payroll provider drops files nightly, a customer's ERP exports a CSV. They will not call your API. They want a hostname, a username and a key, and the files to land somewhere your code can pick them up.
A managed endpoint for SFTP (version 3), FTPS, FTP and AS2, plus browser-based web apps, that reads and writes directly to Amazon S3 or Amazon EFS. Partners keep their clients and keys; you get files in S3 with no server to patch, across up to three Availability Zones.
S3 storage and requests are billed as usual on top. The fixed hourly charge is the number to plan around: an SFTP-only endpoint is about $219 a month whether one file arrives or a million.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
The host key is the server's identity. Partners pin its fingerprint; if you recreate the server, import the old key or every partner's client refuses to connect.
Fixed IPs need the VPC endpoint type with Elastic IPs. Partners behind strict firewalls will ask for them on day one.
FTP and FTPS need the data port range 8192–8200 open as well as the control port. Use SFTP when the partner allows it.
Scan before processing: route uploads through a malware scan (GuardDuty Malware Protection for S3 is a common pattern) before anything parses them.
Log and alert on failed logins, and on files that should have arrived and didn't. A missing nightly file is the most common failure, and nothing errors when it happens.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Legal Holds and Records Retention on AWS: S3 Object Lock, Versioning and Getting Deletion Right
Retention is two opposite duties: keep what you must, delete what you should. S3 Object Lock gives you write-once storage with retention periods and legal holds that even administrators cannot bypass in compliance mode. How the modes work, how a legal hold differs from a retention period, and a design that keeps both duties straight.
Read
File Uploads Done Right: Presigned URLs, Limits, and Not Proxying Through Your Server
Uploading through your API runs into payload limits (6 MB for synchronous Lambda, 10 MB for API Gateway), ties up servers and pays for the bytes twice. Letting the browser upload straight to S3 with a presigned URL avoids all three. How it works, enforcing size and type, scanning for malware, and serving files back privately.
Read
As of November 2, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.