AWS Transfer Family pricing: what an SFTP server or web app for S3 really costs

The two things Transfer Family sells

Transfer Family has two front doors to the same S3 data. The first is a server endpoint that speaks SFTP, FTPS, FTP or AS2, for partners who already use a file transfer client or an automated job. The second is a web app: a browser portal, built on Storage Browser for Amazon S3, where signed-in users can browse, upload and download without installing anything.

They are billed differently, and many teams end up paying for both: an SFTP endpoint for the partner's nightly job and a web app for the people who just want to drag a file into a page.

When to use Storage Browser for Amazon S3Access Amazon S3 files without the AWS console

Endpoint hours: the fixed part of the bill

Each protocol you enable on a server endpoint costs $0.30 an hour. AWS's own worked example multiplies that by 24 hours and 30 days to get $216 a month for a single SFTP endpoint. Enable SFTP and FTPS on the same server and the hourly charge applies to each, so the fixed cost doubles to $432 before a single byte moves.

The charge does not depend on traffic. A server that receives one file a week costs the same $216 as one that receives a thousand a day. Up to three Availability Zones per server are included at no extra cost, so high availability does not add to it.

SFTP only:            $0.30 x 24 x 30 = $216 a month
SFTP + FTPS:          2 x $216        = $432 a month
Plus data (SFTP/FTPS): $0.04 per GB uploaded or downloaded

• One endpoint, one protocol: about $216 a month.
• Each extra protocol on that endpoint: another $216.
• Three Availability Zones per server are included.

Stopping a server does not stop the bill

This is the line item that catches people. The StopServer API reference says stopping a server has no effect on endpoint billing, and that you must delete the server to stop being billed. A server left stopped after a pilot or a finished migration keeps costing $216 a month per protocol, which is over $2,500 a year for nothing.

Deleting is not free of side effects either. Deleting a server deletes all of its users, so you will be re-creating SSH keys and home directories if you bring it back. The files themselves stay in S3, since the bucket is not part of the server.

aws transfer list-servers --query "Servers[].{id:ServerId,state:State}"
aws transfer delete-server --server-id s-1234567890abcdef0

• List servers in every Region you have used; idle ones are easy to forget.
• Delete, do not stop, a server you no longer need.
• Export user names, home directories and public keys first if you may need them again.

Per-GB and per-message charges

On top of the endpoint hours, data uploaded or downloaded over SFTP, FTPS or FTP costs $0.04 per GB. For most business file exchange this is the small part: 100 GB a month adds $4. Normal S3 request and storage charges apply as well, as they would for any upload.

The add-ons have their own meters. SFTP connectors, which let Transfer Family pull from or push to a partner's SFTP server, cost $0.001 per call and $0.40 per GB sent or retrieved. AS2 messages are $0.01 each for the first 100,000 a month in each direction. A workflow step that decrypts PGP files costs $0.10 per GB processed.

• Data over SFTP, FTPS or FTP: $0.04 per GB.
• SFTP connectors: $0.001 per call plus $0.40 per GB.
• AS2: $0.01 per message for the first 100,000 sent and received.
• PGP decryption step: $0.10 per GB.

Web apps: priced by capacity, not by user

A Transfer Family web app is billed in units at $0.50 an hour each. One unit supports up to 250 unique sessions in any five-minute period, and you choose how many units to provision when you create the app. One unit running all month is $360. Uploads and downloads through the web app have no Transfer Family data charge, although S3 requests and data transfer still apply.

AWS's own web app example provisions two units for a peak of 400 sessions and arrives at $720 a month. For a team of twenty that is plenty of headroom; the cost is the hourly floor, not the users.

1 web app unit:  $0.50 x 24 x 30 = $360 a month  (up to 250 sessions per 5 minutes)
2 web app units: $720 a month                     (AWS example: 400 peak sessions)

What a web app needs before anyone signs in

Web apps do not have their own user list. Sign-in goes through AWS IAM Identity Center, either its built-in directory or a connected provider such as Okta, and permissions come from Amazon S3 Access Grants, which hands each user temporary credentials for the locations they have been granted. You create an Identity Center instance, an S3 Access Grants instance with a registered location and an IAM role, the grants themselves, two IAM roles for the web app, and CORS rules on every bucket the app uses.

The documentation lists a few hard limits worth checking against your setup. Buckets must be in the same AWS account as the web app; cross-account buckets are not supported. Uploads are capped at 160 GB per file, copies at 5 GiB, and searches at 10,000 results. Folder names that start or end with a dot are not supported.

For an external client this means adding them to your Identity Center directory, which is a reasonable thing for a long-term partner and a heavy one for a client who needs to send three PDFs.

S3 access points for team file accessS3 CORS configuration examples

• Identity: IAM Identity Center users or groups.
• Authorization: S3 Access Grants, per location.
• Buckets: same account as the web app only.
• File limits: 160 GB per upload, 5 GiB per copy.

When SFTP is the right answer

Keep Transfer Family when the other side is a machine. A bank, a logistics partner or an ERP export that already speaks SFTP or AS2 will not change for you, and Transfer Family gives you a managed, multi-AZ endpoint that writes straight into S3, with workflows for steps such as PGP decryption. The $216 a month is cheap compared with running and patching your own SFTP host.

It is also the right answer when the partner's security team mandates SFTP with key-based authentication, or when files are large and transfers are scheduled. In those cases, budget the endpoint hours as a fixed cost and make sure only the protocols you use are enabled.

S3 event notifications: run code when a file is uploaded

When a browser workspace fits better

When the other side is a person, a file transfer server is often more machinery than the job needs. Clients rarely have an SFTP client installed, and the files they send usually need to be opened, checked and discussed by your team, which Transfer Family does not do.

BucketDesk connects to the buckets you already own, including buckets in other AWS accounts, through an IAM role rather than access keys. Your team previews PDFs, Office files, images and video in the browser, and on the Standard plan can send secure file and folder share links to people outside the company and revoke them centrally. Uploads into a bucket are part of the Ultra plan at $350 a month with 10 operators and unlimited viewers. On the same plan, BucketDesk Document AI lets someone open a file a client just sent and ask it a question, with the answer citing the passage it came from. It runs on Amazon Bedrock in your own AWS account, using Amazon Nova Pro by default.

That is not an SFTP replacement. If a partner's system has to connect over SFTP or AS2, use Transfer Family for that and point both at the same bucket.

Secure file sharing for business and clientsHow to create S3 presigned URLs for downloads and uploadsConnecting customer AWS accounts without access keys

How the AI options compare for files that arrive this way

Teams that receive documents through Transfer Family often ask next how to ask questions about them. Amazon Q Business, the AWS assistant that used to fill that role, is closed to new customers, and AWS now points people at Amazon Quick Suite, whose S3 knowledge bases index a bucket on a schedule, daily by default. That suits a question across thousands of files. For a question about the file that arrived this morning, a per-document tool answers immediately because there is nothing to sync.

Amazon Quick Suite for documents in S3: pricing and setup

• Amazon Quick Suite: indexes the bucket, answers across many files, lags by up to a sync interval, Enterprise plan required for S3.
• Amazon Q Business: not available to new customers.
• BucketDesk Document AI: answers about the open file with a citation, reads the current object, runs on Bedrock in your account.