AWS Transfer Family
A fully managed file transfer service supporting SFTP, FTPS, FTP, and AS2 protocols, with S3 or EFS as backend storage
Overview
AWS Transfer Family is a fully managed file transfer service supporting four protocols: SFTP, FTPS, FTP, and AS2. By replacing backend storage with S3 or EFS without changing existing file transfer workflows, it enables migration from on-premises FTP servers to the cloud. Trading partners and partner companies can continue using the protocols they are accustomed to, eliminating the need for client-side changes. Integration with custom identity providers enables access control leveraging existing authentication infrastructure, and the managed workflow feature automates post-upload processing.
Protocol Selection and Endpoint Types
Transfer Family offers four protocols to choose from based on your use case. SFTP (SSH File Transfer Protocol) provides SSH-based encrypted communication and is the most widely used, well-suited for secure file exchange with trading partners. FTPS (FTP over TLS) adds TLS encryption to traditional FTP and is chosen when compatibility with legacy systems is required. FTP transmits in plaintext without encryption and is recommended only within closed VPC networks. AS2 (Applicability Statement 2) is a standard protocol for EDI (Electronic Data Interchange), guaranteeing message encryption, signing, and receipt confirmation (MDN) at the protocol level. Three endpoint types are available: Public, VPC, and VPC_ENDPOINT. Public endpoints support internet-facing access with AWS-managed Elastic IPs. VPC endpoints place the endpoint within a VPC, enabling security group control and fixed Elastic IP assignment. When trading partners manage IP addresses through firewall whitelists, VPC endpoints with fixed Elastic IPs are essential.
Identity Provider Integration and Access Control
Transfer Family authentication offers three options: service-managed, AWS Directory Service, and custom identity providers. The service-managed option uses SSH public key authentication, registering and managing public keys per user. It is straightforward and suitable for managing a small number of users. AWS Directory Service integration uses Active Directory username/password authentication directly, ideal for enterprises with existing AD infrastructure. Custom identity providers implement authentication logic via API Gateway + Lambda or Lambda alone, offering the greatest flexibility. They can reference credentials stored in external LDAP servers, databases, or Secrets Manager for authentication decisions. The response returned on successful authentication dynamically controls per-user IAM roles, home directories, and logical directory mappings. Logical directory mapping presents a specific S3 bucket prefix as a user's root directory, preventing access to files outside their designated area. Combining session policies further narrows IAM role permissions for temporary, fine-grained access control.
Workflow-Based Post-Processing Automation
Transfer Family's managed workflow feature automatically executes a series of post-processing steps triggered by file upload completion. Workflow steps can include file copying, tagging, invoking custom Lambda functions, and file deletion. For example, you can build a pipeline that copies a CSV file received from a trading partner to a processing bucket in S3, runs validation and format conversion via a Lambda function, then moves the processed file to an archive bucket. Workflows support two tracks - a normal flow and an exception flow - so if an error occurs during a step, execution branches to the exception flow for error notification or file quarantine. Workflow execution logs are output to CloudWatch Logs, enabling tracking of each step's success or failure and processing time. In practice, common patterns include conditional branching that invokes different Lambda functions based on filename patterns, and decrypting PGP-encrypted files within the workflow. Note that workflow execution is not included in Transfer Family pricing - Lambda execution costs and S3 request charges apply separately.