AWS Transfer Family Setup Guide
How to configure S3-backed SFTP, FTPS, and FTP endpoints on AWS Transfer Family, with example testing via WinSCP.
Introduction
AWS Transfer Family provides fully managed SFTP, FTPS, and FTP endpoints backed by Amazon S3 or EFS. This guide walks you through setting up an S3-backed FTPS/SFTP endpoint, creating users, configuring access, and testing with WinSCP.
Step 1: Create an S3 Bucket
- Go to the AWS Management Console → S3.
- Create a new bucket (example:
my-transfer-bucket). - Note the bucket name, as it will be mapped to Transfer Family users.
Step 2: Set Up AWS Transfer Family Server
- Navigate to AWS Transfer Family in the console.
- Click Create Server.
- Select protocols:
SFTP,FTPS, orFTP. - Choose S3 as the storage backend.
- Leave other defaults or configure custom VPC/endpoint settings.
Tip: You can enable multiple protocols (SFTP + FTPS + FTP) on the same Transfer Family server.
Step 3: Create IAM Role for Transfer Family
Transfer Family requires an IAM role that grants access to your S3 bucket.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": "arn:aws:s3:::my-transfer-bucket"
},
{
"Effect": "Allow",
"Action": ["s3:GetObject","s3:PutObject","s3:DeleteObject"],
"Resource": "arn:aws:s3:::my-transfer-bucket/*"
}
]
}Step 4: Create a Transfer Family User
- In the Transfer Family console, choose your server and click Add User.
- Enter a username (e.g.,
testuser). - Attach the IAM role created above.
- Specify the S3 bucket and home directory (optional prefix).
- Choose authentication method: Service-managed password or SSH key.
Step 5: Retrieve the Endpoint
Once the server is active, copy the generated endpoint URL (e.g., s-1234567890.server.transfer.eu-west-1.amazonaws.com).
Step 6: Test with WinSCP
- Download and open WinSCP.
- Create a new site connection.
- Select protocol (SFTP or FTPS).
- Use the AWS Transfer Family endpoint as host.
- Enter the username and password (or SSH key) you created.
- Connect and test file upload/download.
Warning: Ensure your security groups and firewall rules allow SFTP/FTPS ports (22, 21, passive port ranges).
Step 7: (Optional) Usage Plan & Monitoring
To manage costs and monitor usage:
- Enable CloudWatch metrics to track connections, uploads, and errors.
- Optionally, integrate with AWS Billing/Cost Explorer to monitor data transfer costs.