Bring your own bucketSFTP to Amazon S3, at a flat monthly price
Partners log in over SFTP, FTPS or FTP. Their files land in your own S3 bucket, one folder per user, written with an IAM key that can only reach that bucket. No Transfer Family endpoint billed by the hour.
Amazon S3 with CloudFile, at a glance.
| Endpoint | https://s3.<region>.amazonaws.com, filled in from the region |
|---|---|
| URL style | Virtual-hosted (bucket.s3.<region>.amazonaws.com) |
| Credentials | Access key of an IAM user with an inline policy for one bucket |
| Regions | Any S3 region. The form suggests Frankfurt, Ireland, London, Paris, Stockholm, US and Asia-Pacific regions. |
| Pricing model | Storage per GB-month, plus requests. Data in is free; the first 100 GB a month out to the internet is free across AWS, then billed per GB. |
| Object Lock | Supported, on versioned buckets, in governance or compliance mode |
Amazon S3 prices are from their public website as of October 2026, excluding taxes. Your bucket is billed by Amazon S3, not by us, and doesn't count toward your plan's storage.
Why pair SFTP with Amazon S3.
Files stay in your AWS account
Your bucket policy, default encryption and lifecycle rules apply to partner uploads like to anything else in S3, and you can move old files to cheaper storage classes as usual.
S3 events still work
Uploads are ordinary S3 objects, so S3 Event Notifications to Lambda, SQS or EventBridge keep working. CloudFile's signed webhooks are there if you'd rather not wire those up.
No hourly endpoint fee
AWS Transfer Family bills each enabled protocol by the hour. CloudFile runs SFTP, FTPS, FTP and WebDAV on one server for a flat monthly price.
WORM backups with Object Lock
Pair a versioned, Object Lock bucket with an SFTP user that can't delete or overwrite, and a compromised backup client can't destroy old backups.
How it works, in three steps.
- Step 1
Create a bucket and an IAM key
Keep Block Public Access on. Create an IAM user with an inline policy for s3:ListBucket on the bucket and Get/Put/Delete/AbortMultipartUpload on its objects.
arn:aws:s3:::acme-sftp arn:aws:s3:::acme-sftp/* - Step 2
Connect it in CloudFile
Storage → Add bucket → Amazon S3. Pick the region, paste the key and run Test connection, then select the bucket on a server.
Amazon S3 eu-central-1 acme-sftp ✓ test passed - Step 3
Partners upload, S3 receives
Each SFTP user writes to its own prefix. A signed webhook with a presigned S3 link fires on every upload.
acme → s3://acme-sftp/partners/acme/PO-4821.xml
Every click and field is in the Amazon S3 setup guide.
What your partners see, and where it lands in Amazon S3.
$ sftp -P 22000 [email protected]
sftp> put invoice-2026-10.pdf
sftp> ls
invoice-2026-10.pdfYour Amazon S3 bucket<bucket>/<folder>/acme/invoice-2026-10.pdf
<bucket>/<folder>/_shared/inbox/…Any SFTP, FTPS or FTP client: FileZilla, WinSCP, Cyberduck, the sftp command or their own system. WebDAV too, if you turn it on.
Their own home folder as /, and nothing else. They never see the bucket name, other users' folders or your keys.
A password, an SSH key or both, with the permissions you pick: full access, read only or upload only.
Shared folders at /shared/<name> when several users need the same files. They live under _shared/<name>/ in your Amazon S3 bucket.
Get these right in Amazon S3.
Leave Object Lock off on a bucket for normal file exchange: it stops SFTP users from deleting or replacing files. Use it only for backup buckets.
With versioning on, deleted and overwritten files stay as old versions and keep being billed. Add a lifecycle rule that expires noncurrent versions if you turn it on.
If the test fails with a region error, the message names the region AWS expected. The bucket's region must match.
Questions about SFTP on Amazon S3.
How is this different from AWS Transfer Family?
Transfer Family is an AWS service billed per enabled protocol per hour, plus per GB transferred. CloudFile is a separate managed service with a flat monthly price that writes into the same kind of S3 bucket. If you need AS2, EFS, VPC-only endpoints or IAM-based user identities, Transfer Family is the better fit.
Which IAM permissions does the key need?
s3:ListBucket on the bucket ARN, and s3:GetObject, s3:PutObject, s3:DeleteObject and s3:AbortMultipartUpload on the bucket ARN with /*. Nothing account-wide.
Can I trigger a Lambda function when a file arrives?
Yes, either way. Configure an S3 Event Notification on the bucket as usual, or add a CloudFile listener that POSTs to a function URL with an HMAC signature and a presigned download link.
Does the bucket need to be public?
No. Keep Block Public Access on. Download links in webhooks are presigned and expire after one hour.
More in the docs: Amazon S3 setup · Your own bucket · Webhooks
