Create an FTP-enabled server - AWS Transfer Family

Create an FTP-enabled server

File Transfer Protocol (FTP) is a network protocol used for the transfer of data. FTP uses a separate channel for control and data transfers. The control channel is open until terminated or inactivity timeout. The data channel is active for the duration of the transfer. FTP uses cleartext and does not support encryption of traffic.

To create an FTP-enabled server

  1. Open the AWS Transfer Family console at and choose Create server.

  2. In Choose protocols, select FTP, and then choose Next.

  3. In Choose an identity provider, do the following:

    1. For Identity provider type, choose Custom. For more information about custom identity providers, see Working with custom identity providers.

    2. For Custom provider, enter an Amazon API Gateway URL.


      Only identity provider type API Gateway is supported.

    3. For Invocation role, choose an AWS Identity and Access Management (IAM) role to access the endpoint.

    4. Choose Next.

  4. In Choose an endpoint, do the following:

    1. For Endpoint type, choose the VPC hosted endpoint type to host your server's endpoint. For information about setting up your VPC hosted endpoint, see Creating a server in a virtual private cloud.


      Publicly accessible endpoints are not supported.

    2. For FIPS Enabled, keep the FIPS Enabled endpoint check box blank.


      A FIPS-enabled endpoint is not supported.

    3. Choose Next.

  5. In Configure additional details, do the following:

    1. For CloudWatch logging, choose one of the following to enable Amazon CloudWatch logging of your user activity:

      • Create a new role to allow Transfer Family to automatically create the IAM role, as long as you have the right permissions to create a new role. The IAM role that is created is called AWSTransferLoggingAccess.

      • Choose an existing role to choose an existing IAM role from your account. Under Logging role, choose the role. This IAM role should include a trust policy with Service set to

        For more information about CloudWatch logging, see Log activity with CloudWatch.

      • You can't view end-user activity in CloudWatch if you don't specify a logging role.

      • If you don't want to set up a CloudWatch logging role, choose Choose an existing role, but don't select a logging role.

    2. For Cryptographic algorithm options, choose a security policy that contains the cryptographic algorithms enabled for use by your server.


      By default, the TransferSecurityPolicy-2020-06 security policy is attached to your server.

      For more information about security policies, see Working with security policies.

    3. (Optional) For Server Host Key, keep it blank.


      This section is only for migrating users from an existing SFTP-enabled server.

    4. (Optional) For Tags, for Key and Value, enter one or more tags as key-value pairs, and then choose Add tag.

    5. Choose Next.

  6. In Review and create, review your choices. If you:

    • Want to edit any of them, choose Edit next to the step.


      You will need to review each step after the step you chose to edit.

    • Have no changes, choose Create server to create your server. You are taken to the Servers page, shown following, where your new server is listed.

It can take a couple of minutes before the status for your new server changes to Online. At that point, your server can perform file operations for your users.

Next step

Add a user