SFTP for Amazon S3

Put SFTP in front of your S3 bucket.

Your data already lives in S3. Your trading partners connect with SFTP. S3 doesn't speak SFTP, and your partners don't speak S3.

SFTP.cloud closes that gap without moving the bucket, without a copy of your files on our side, and without giving us your AWS credentials. Partners keep the client they already use. The bucket stays exactly where it is.

Start your free trial See how it works

14 days. No credit card. No feature locks.

Path of one uploadPartner to bucket
1Your partner's SFTP clientFileZilla, WinSCP, OpenSSH or a script. Nothing new to install.
2SFTP.cloudAuthenticates the user and applies policy. Stores nothing.
Your AWS account
3Your Storage ConnectorIn your VPC, next to the bucket. Dials out, never accepts inbound.
4Your S3 bucketUnchanged. Same bucket, same policies, same lifecycle rules.

Inbound rules in your security group0

01Cost

What AWS charges for this, and what we charge.

AWS Transfer Family is the obvious answer, and it is a competent product. It is billed by the hour for every protocol you turn on, and again for every gigabyte that passes through it.

AWS Transfer Family

$0.30per hour, per protocol

Billed from the moment the endpoint exists, before a single byte moves.

$2,628a year for one SFTP endpoint
$5,256a year once you add FTPS
  • Each protocol is its own hourly charge
  • Data transfer at $0.04 per GB in each direction, on top of your S3 costs
  • AWS's own worked example: $217.20 a month for one SFTP endpoint moving 1 GB a day

SFTP.cloud Shared

$2,400per year

Every protocol and every feature, at one flat price.

15transfer accounts included
$0per GB, in either direction
  • SFTP, FTPS, FTPES and an HTTPS web client, all on the same plan
  • 3 Storage Connectors included
  • No per-gigabyte or per-hour charge of any kind
See full pricing

AWS prices are list prices for US East (N. Virginia). With either option, AWS still bills your S3 storage, requests and standard data transfer out at its usual rates, and the Connector runs on compute you choose.

02How it works

Leave the bucket where it is. Add one small Connector next to it.

  1. 01

    You deploy a Storage Connector.

    As a container or a small instance, in the same AWS account and region as your bucket. A free-tier instance is often enough.

  2. 02

    It reaches S3 with an IAM identity you own.

    You create it, you scope it to the bucket and prefixes you choose, and it never leaves your account.

  3. 03

    Your partners connect to SFTP.cloud.

    Files stream through the Connector's own outbound channel, straight to and from the bucket. They are never written to a disk we own.

Runs on
EC2, ECS, Fargate or EKS. Anything that runs a container or a Linux or Windows service.
Network
Outbound connections only. Your security group stays closed inbound.
Region
Place it in the bucket's region so traffic between the two never crosses regions.
Objects
Stored as ordinary S3 objects. Your bucket policies, versioning, lifecycle rules and replication keep working.
IAM policyScoped to one bucket
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::partner-exchange"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload"
      ],
      "Resource": "arn:aws:s3:::partner-exchange/*"
    }
  ]
}
Attach it to the role or user your Connector runs as. Narrow the resource to a prefix, or drop the write actions for read-only access.

03Security

We never hold your AWS credentials.

Nothing in our infrastructure can reach your bucket, so nothing in our infrastructure could be stolen and used against it.

  • 0Access keys or secret keys
  • 0Roles assumed from our account
  • 0Cross-account trust policies to review
  • 01

    Credentials stay on your Connector.

    The IAM identity is configured on the Connector inside your account. It is never sent to us, and we have no way to ask for it.

  • 02

    Rotate whenever you like.

    Change or revoke the IAM credentials on your own schedule. You don't need to tell us, and nothing on our side notices.

  • 03

    Optional encryption of the objects themselves.

    Encrypt with a key that lives on your Connector and that we never receive. Anyone who reaches the bucket by another route finds only ciphertext. How we're built

04What you get

Everything in the product, on top of the bucket you already have.

Point it at a bucket and try it today.

Deploy a Connector, attach an IAM policy and send your first file over SFTP in an afternoon. Fourteen days, no credit card, and nothing to cancel if it is not for you.

Start your free trial

Want to see the moving parts first? See how it works or talk to an engineer. The person who answers builds the product.