AWS Transfer Family is a fully managed service that enables secure file transfers over SFTP, FTPS, and FTP protocols. Managing AWS Transfer Family with Terraform provides a repeatable, versioned approach to provisioning SFTP servers, SFTP connectors, identity integration, logging, and security controls without manual console configuration. The Terraform modules are community supported efforts maintained by AWS Solution Architects and are not part of an AWS service.
Overview of AWS Transfer Family
AWS Transfer Family is a fully managed file transfer service enabling secure and seamless data migration, storage, and sharing between on-premises and cloud storage. The service supports popular file transfer protocols such as SFTP, FTPS, and FTP.
Key Features
The service is good when using SFTP, FTPS, AS2, or plain FTP. Most people would default to running one on an EC2, but why bother needing to worry about OS and software patching? The managed service is also much more scalable and flexible than an EC2 server would be.
- Protocol Support: AWS Transfer Family supports three widely-used file transfer protocols — SFTP (Secure File Transfer Protocol), FTPS (File Transfer Protocol Secure), AS2 (Applicability Statement 2), and FTP (File Transfer Protocol). By supporting these protocols, the service ensures compatibility with existing file transfer workflows, making migration to the cloud straightforward.
- Integration with AWS Services: The Transfer Family integrates with other AWS services like Amazon S3 and Amazon EFS for file storage
The service can be deployed with a PUBLIC or VPC endpoint type. Integration with Amazon CloudWatch for logging and monitoring is supported, and IAM roles can be configured for access to Amazon S3 buckets where files are stored.
Terraform Modules for Transfer Family
You can use Terraform to safely deploy AWS Transfer Family SFTP servers and SFTP connectors, along with associated dependencies and customizations. For the repository that contains Terraform code to create the resources required to run AWS Transfer Family, see the Terraform Transfer Family module.
Note
The AWS Transfer Family modules for Terraform are a community supported effort. They are not part of an AWS service. Best-effort support is provided by the AWS Storage community.
The AWS Transfer Family module for Terraform is maintained by AWS Solution Architects. It is not part of an AWS service and support is provided best-effort by the AWS Storage community.
To post feedback, submit feature ideas, or report bugs, please use the Issues section of this GitHub repo.
Module Requirements
| Name | Version |
|---|---|
| terraform | >= 1.5 |
| aws | >= 5.95.0 |
| Name | Version |
|---|---|
| aws | >= 5.95.0 |
No modules.
Module Resources
| Name | Type |
|---|---|
| awscloudwatchlog_group.transfer | resource |
| awsroute53record.sftp | resource |
| awstransferserver.transfer_server | resource |
| awstransfertag.withcustomdomain_name | resource |
| awstransfertag.withcustomdomainroute53zone_id | resource |
| awsroute53zone.selected | data source |
The repository contains Terraform code which creates resources required to run a Transfer Family Server within AWS.
This module creates and configures AWS Transfer Family resources with the following features:
- Transfer Server: SFTP server setup with protocol and security policies
- Transfer Connectors: Automated file transfer to/from external SFTP servers
- Transfer Users: User management with S3 bucket permissions and KMS access
- Transfer Web App: Browser-based interface with IAM Identity Center authentication and S3 Access Grants
- Malware Protection: GuardDuty integration for automatic file scanning, smart routing, and thread notification
- Custom hostname support through AWS Route53 or other DNS providers (Optional)
- CloudWatch logging configuration with a customizable retention
Note: These modules have been tested only in the aws partition (commercial regions).
For more information about AWS partitions, see the AWS Fault Isolation Boundaries whitepaper.
SFTP Servers and SFTP Connectors
SFTP servers
This automation provides you with a customizable Terraform module and end-to-end examples to create an SFTP endpoint (PUBLIC or VPC endpoint types), integrate with Amazon CloudWatch for logging and monitoring, manage user identities for endpoint access, and configure IAM roles for access to Amazon S3 buckets where files are stored. The module supports multiple SSH public keys per user (up to 50 keys) for enhanced security and key rotation capabilities.
SFTP connectors
AWS Transfer Family Terraform module now supports deployment of SFTP connectors to transfer files between Amazon S3 and remote SFTP servers. SFTP connectors provide a fully managed and low-code capability to copy files between Amazon S3 and remote SFTP servers.
You can now use Terraform to programmatically provision your SFTP connectors, associated dependencies and customizations in a single deployment
Additional connector capabilities include:
- Automated file transfer to/from external SFTP servers
- Support for scheduled file retrieval
Identity Provider Integration
AWS Transfer Family Terraform module now supports Okta and Microsoft Entra ID integration examples.
AWS Transfer Family Terraform module now includes end-to-end examples for deploying Transfer Family endpoints integrated with Okta and Microsoft Entra ID as custom identity providers (IdP) for authentication and access control. This allows enterprises already using these platforms to automate and streamline the deployment of Transfer Family servers with their existing identity infrastructure.
The Terraform module and examples are based on the open source Custom IdP solution, which provides standardized integration with widely used identity providers and includes built-in security controls such as multi-factor authentication, audit logging, and per-user IP allowlisting. The Okta example supports password-based authentication flows, time-based one-time password (TOTP)-based MFA, and attribute retrieval, while the Entra ID example demonstrates password-based authentication for organizations standardized on Microsoft's identity platform.
Customers can get started by using the new module from the Terraform Registry. To learn more about the Transfer Family Custom IdP solution, visit the user guide. To see all the AWS Regions where Transfer Family is available, visit the AWS Capabilities table.
Module parameters for custom identity providers include:
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| apigatewayinvocation_role | IAM role ARN for API Gateway invocation (required when identityprovider is APIGATEWAY) | string | null | no |
| apigatewayurl | API Gateway URL for custom identity provider (required when identityprovider is APIGATEWAY) | string | null | no |
| custom_hostname | The custom hostname for the Transfer Family server | string | null | no |
| dns_provider | The DNS provider for the custom hostname | string | null | no |
Configuration Example
A typical SFTP server module usage is:
hcl
module "transfer_sftp" {
source = "aws-ia/transfer-family/aws//modules/transfer-server"
identity_provider = "SERVICE_MANAGED"
protocols = ["SFTP"]
domain = "S3"
tags = {
Environment = "Dev"
Project = "File Transfer"
}
}
Figure 1: High-level architecture of AWS Transfer Family deployment using this Terraform module
Figure 2: Architecture using VPC endpoints of the AWS Transfer Family deployment using this Terraform module
The module will warn but not fail deployment if conditions aren't met.
Logging, Monitoring and Security Features
The Terraform module enables:
- CloudWatch logging configuration with a customizable retention
- Transfer Web App: Browser-based interface with IAM Identity Center authentication and S3 Access Grants
- Malware Protection: GuardDuty integration for automatic file scanning, smart routing, and thread notification
- Custom hostname support through AWS Route53 or other DNS providers (Optional)
User management is handled through Transfer Users with S3 bucket permissions and KMS access. Security policies can be applied at the server level and IAM roles are configured for bucket access.
Protocol and Service Integration Summary
| Protocol | Support Status |
|---|---|
| SFTP | Supported |
| FTPS | Supported |
| FTP | Supported |
| AS2 | Supported |
Storage Integration
- Amazon S3
- Amazon EFS
The service ensures compatibility with existing file transfer workflows, making migration to the cloud straightforward.
Conclusion
AWS Transfer Family combined with Terraform provides a production-ready pattern for secure, scalable file transfer without operating system patching or server maintenance. The community Terraform module delivers end-to-end examples for SFTP endpoints with PUBLIC or VPC options, CloudWatch logging, user identity management, and IAM roles for S3 access. Support for up to 50 SSH public keys per user enables enhanced security and key rotation.
SFTP connectors extend the model to automated, scheduled file movement between Amazon S3 and remote SFTP servers with low-code provisioning. Identity integration has expanded to include Okta and Microsoft Entra ID via the Custom IdP solution, bringing password-based authentication, TOTP-based MFA, attribute retrieval, audit logging, and per-user IP allowlisting into Terraform workflows.
The module covers Transfer Server setup with protocol and security policies, Transfer Connectors, Transfer Users with S3 and KMS permissions, Transfer Web App with IAM Identity Center, GuardDuty malware protection, custom hostname support via Route53, and customizable CloudWatch retention. The modules are tested only in the aws partition and are maintained best-effort by the AWS Storage community with feedback via GitHub Issues.