AWS Transfer Family

What it is

AWS Transfer Family is a fully managed service for transferring files into and out of AWS storage over standard protocols:

• SFTPSFTP (SSH File Transfer Protocol)A protocol for transferring files over an SSH connection, which encrypts both commands and data. AWS Transfer Family provides managed SFTP servers that store files in Amazon S3 or Amazon EFS.Glossary entryClose (SSH File Transfer Protocol).
• FTPS and FTP.
• AS2 (Applicability Statement 2) for business-to-business data exchange.
• Browser-based transfers through Transfer Family web apps.

Files land directly in Amazon S3 or Amazon EFS. You can migrate existing file transfer workflows without changing anything for your customers and partners: they keep their clients, authentication, and firewall settings.

Choose Transfer Family when a question describes partners, customers, or legacy systems that send or receive files over SFTP, FTPS, FTP, or AS2, and you want to retire self-managed SFTP servers and store the files in S3 or EFS.

Concepts

• Server: a managed endpoint for one or more protocols, with an S3 or EFS backend. Choose EFS when applications must use the uploaded files through a shared NFSNFS (Network File System)A protocol for sharing files over a network, used mostly by Linux and Unix systems. Amazon EFS, Amazon FSx for OpenZFS, and Amazon FSx for NetApp ONTAP provide NFS file systems.Glossary entryClose mount with POSIX ownership; S3 stores them as objects.
• Endpoint types:
  • Public: reachable over the internet.
  • VPC: inside your VPC, reachable from the VPC and connected networks. It can be internet-facing with Elastic IPIP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entryClose addresses, so outside clients connect to fixed IPs and security groupsSecurity groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entryClose control who can connect.
  • A VPC endpointVPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entryClose uses one subnetSubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entryClose in each of up to three Availability ZonesAZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entryClose, for high availabilityHA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entryClose. An internet-facing endpoint has an Elastic IP address in each subnet, which partners can add to their firewall allow lists, and supports SFTP and FTPS only.
  • FTPS and FTP need a VPC endpoint, not a public one. FTP, which is unencrypted, works only with internal access, reached from the VPC or over Direct Connect or VPNVPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entryClose; traffic that crosses the internet must use SFTP or FTPS.
• Identity providers:
  • Service-managed users, with SSHSSH (Secure Shell)A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.Glossary entryClose keys: SFTP only. FTPS and FTP need Directory Service or a custom identity provider.
  • AWS Directory Service for Active Directory.
  • A custom identity provider, through the AWS custom identity provider solution, or an Amazon APIAPI (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entryClose Gateway API backed by a Lambda function.
• Access to storage: each user gets an IAM role (optionally narrowed with a session policy) that controls which bucket or file system paths they can use. Logical directories map a user's own prefix as the root of the session, so many users can share one server and bucket without seeing each other's folders.
• Managed workflows: run steps automatically, in order, after a file arrives over SFTP, FTPS, or FTP, such as copying, tagging, decrypting, deleting, or calling a Lambda function, with an exception-handling path.
• Migrating an existing SFTP server: import the old server's host key and point the existing hostname at the new endpoint, so clients with strict host key checking connect without changes.
• SFTP connectors: send files from S3 to external SFTP servers owned by partners.
• Web apps: a simple browser interface for users to upload and download S3 files, with no client to install.
• FTP and FTPS use ports 8192–8200 for data connections.
• Users in several RegionsAWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entryClose: a server is Regional. To serve users across the world, AWS describes running a server in each Region, using Route 53 latencyLatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entryClose-based routing to send each user to the nearest one, and S3 Cross-Region Replication to gather the files into one central bucket.

Security, resilience, performance, and cost

Security

• Prefer SFTP or FTPS, since FTP is unencrypted.
• Restrict access with VPC endpoints, security groups, IAM roles scoped to each user's paths, and S3 or EFS encryption. CloudTrail records API calls.

Resilience and performance

• Transfer Family is managed and highly available; storage durability comes from S3 or EFS.

Cost

• Pay per hour for each protocol enabled on a server endpoint, plus per GB uploaded and downloaded (or per AS2 message), and for data processed by workflows and connectors. A stopped server still accrues charges, so delete idle servers.

Monitoring

• CloudWatch metrics and logs for sessions and file transfers.

Transfer Family or another option?

If the requirement is	Choose
Partners upload over SFTP or FTPS into S3	AWS Transfer Family
Business-to-business AS2 exchange	Transfer Family AS2
Send files from S3 to a partner's SFTP server	Transfer Family SFTP connector
Legacy systems send plain FTP from on premisesOn-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entryClose	Transfer Family FTP on a VPC endpoint with internal access
Uploaded files must be on a shared NFS file system	Transfer Family with an EFS backend
Move our own file shares to AWS	AWS DataSync
On-premises apps access cloud storage as files	AWS Storage Gateway

Reverse mindmap: when the question points here

• Yes, when the question says
  • Partners send files over SFTP into S3→ leads to Transfer Family
  • Replace self-managed SFTP or FTP servers→ leads to Transfer Family
  • AS2 business-to-business exchange→ leads to Transfer Family AS2
  • Browser-based uploads to S3→ leads to Transfer Family web app
• Configure it
  • Fixed IP addresses for partner allow lists→ leads to VPC endpoint with Elastic IPs
  • Plain FTP, never over the internet→ leads to VPC endpoint with internal access
  • FTPS or FTP users→ leads to Directory Service or custom identity provider
  • Each user sees only its own folder→ leads to Logical directories plus scoped role
  • EC2 fleet mounts the uploads over NFS→ leads to EFS backend
  • Clients must not notice the migration→ leads to Import the host key, keep the hostname
  • Authenticate with Active Directory→ leads to Directory Service identity provider
  • Authenticate with our own system→ leads to Custom identity provider with Lambda
  • Process each file after upload→ leads to Managed workflow
  • Push files to a partner's SFTP server→ leads to SFTP connector
• No, when the question says
  • Migrate our NFS shares→ leads to DataSync

Key takeaways

• Transfer Family provides managed SFTP, FTPS, FTP, AS2, and web app transfers into S3 or EFS.
• Endpoints can be public or in a VPC, and internet-facing VPC endpoints get Elastic IPs; security groups control access.
• FTP works only on a VPC endpoint with internal access; FTPS also needs a VPC endpoint.
• Users authenticate with service-managed keys (SFTP only), Directory Service, or a custom identity provider, with IAM roles and logical directories limiting their paths.
• Managed workflows process files after upload; SFTP connectors send files to partners.
• Pay per protocol-hour plus per GB transferred.

Sources

• AWS Transfer Family User Guide: What is AWS Transfer Family?
• AWS Transfer Family User Guide: Create a server in a virtual private cloud
• AWS Transfer Family User Guide: Create an FTP-enabled server
• AWS Transfer Family User Guide: Create an FTPS-enabled server
• AWS Transfer Family User Guide: Working with service-managed users
• AWS Transfer Family User Guide: Using AWS Directory Service for Microsoft Active Directory
• AWS Transfer Family User Guide: Working with custom identity providers
• AWS Transfer Family User Guide: Using logical directories to simplify your Transfer Family directory structures
• AWS Transfer Family User Guide: Manage host keys for your SFTP-enabled server
• AWS Transfer Family User Guide: Edit server details
• AWS Transfer Family User Guide: Managed workflows
• AWS Transfer Family User Guide: Transfer Family web apps
• AWS Transfer Family User Guide: SFTP connectors
• AWS Transfer Family User Guide: Configuring AS2
• AWS Transfer Family pricing
• AWS Storage Blog: Minimize network latency with your AWS Transfer for SFTP servers