AWS Transfer Family Server Builder

About This Tool

Build an AWS Transfer Family server supporting SFTP/FTPS/FTP protocols with VPC-scoped endpoint access and a pluggable IdentityProviderType (SERVICE_MANAGED, AWS_DIRECTORY_SERVICE, or a custom API_GATEWAY-backed identity provider), plus WorkflowDetails.OnUpload for triggering post-upload processing automatically. Choosing plain FTP in Protocols is a real security decision, not just a compatibility option, FTP transmits credentials and data unencrypted, and AWS Transfer Family itself documents that FTP should only be used within a VPC over a trusted, non-internet-routable network path, never exposed publicly, unlike SFTP/FTPS which encrypt the session.

When to Use This Tool

• •Choosing AWS_DIRECTORY_SERVICE as IdentityProviderType to authenticate SFTP users against an existing Active Directory, so file-transfer access reuses corporate identity and group membership instead of maintaining a separate, parallel user store just for file transfer.
• •Setting EndpointType to VPC with specific SubnetIds and AddressAllocationIds, so the server gets static Elastic IPs reachable only through controlled network paths (VPN, Direct Connect, or specific allowlisted public IPs), rather than a publicly-open, internet-facing endpoint.
• •Wiring WorkflowDetails.OnUpload to trigger a Transfer Family workflow the moment a file lands, automatically kicking off validation, virus scanning, or downstream processing without a separate polling mechanism watching the destination for new files.
• •Including FTP in Protocols only when the server is genuinely confined to an internal, trusted VPC-only network path, since plain FTP transmits everything (including credentials) unencrypted and should never be exposed to the public internet.

Pro Tips

How It Works Under the Hood

Frequently Asked Questions

Is it safe to expose an AWS Transfer Family server supporting plain FTP to the internet?

No, AWS explicitly documents that FTP support should be used only within a private network (VPC-internal, over VPN, or Direct Connect), never as an internet-facing endpoint, because FTP transmits credentials and file content unencrypted. If you need internet-facing file transfer, use SFTP or FTPS, both of which encrypt the session, and reserve plain FTP for legacy internal systems that can't be upgraded but are confined to a trusted network path.

What's the difference between SERVICE_MANAGED and AWS_DIRECTORY_SERVICE identity provider types?

SERVICE_MANAGED means Transfer Family maintains its own simple user store for the server, appropriate for a small number of dedicated file-transfer accounts. AWS_DIRECTORY_SERVICE authenticates against an existing Active Directory, letting the server reuse an organization's existing identity infrastructure and group-based access rather than maintaining a parallel user list; there's also a custom API_GATEWAY-backed option for integrating with an arbitrary existing identity system beyond these two.

Does WorkflowDetails.OnUpload block the upload from completing until the workflow finishes?

No, the workflow triggers after the file upload completes successfully, it's a post-upload hook, not a gate the upload has to pass through before being accepted. If you need pre-acceptance validation (rejecting a file before it's fully stored), that requires a different mechanism, OnUpload is specifically for kicking off processing on files that have already landed.

Related Learning Guides

• Lambda Performance Tuning26 min read
• SQS vs SNS vs EventBridge25 min read