Set Up a Secure SFTP-to-S3 Bridge for Client File Drops

Why this pattern

Clients love SFTP; you love S3. A secure bridge lets clients upload with SFTP while your systems consume files from S3—without emailing server passwords or leaving long-lived folders open.

Principles

• Per-user accounts (no shared logins) with chroot/jail.
• Least privilege on S3 (write-only where possible).
• Ephemeral delivery for any secrets—never in email threads.

Option A — Managed: AWS Transfer Family

1. Create an S3 bucket (e.g., client-drops) and a per-client prefix (/acme/).
2. Set an IAM role that maps each SFTP user to their prefix (no cross-tenant reads).
3. Provision an SFTP server in AWS Transfer Family and attach the IAM role.
4. Disable password auth where possible; prefer SSH public keys.

Option B — DIY: SFTP server + sync tool

1. Run sshd or an SFTP daemon with per-user chroot.
2. Use a sync tool like rclone 🔗 or s5cmd 🔗 to push drops to S3.
3. Grant the sync user an IAM policy scoped to the target prefixes only.

Secret delivery (don’t email credentials)

• If you must share a one-off credential, use a one-time, expiring link with a separate access code. How-to: The Safe Way to Share Passwords in 2025 (No Email).
• Prefer SSH keys. Share only the public key via a one-time link. SSH tips: Share SSH Access the Right Way.

Rotation & hygiene

• Rotate passwords/keys on handoffs and departures. Playbook: Employee Offboarding.
• Audit access logs; if anything looks off, follow: The Simple Incident Playbook for Leaked Passwords.
• Avoid permanent shared folders—deliver results back with expiring links. See: Share Sensitive Photos and Documents Safely.

Useful external references

• AWS Transfer Family overview 🔗
• S3: Example bucket policies 🔗
• rclone (multi-cloud sync) 🔗

Related reading

Secure SFTP/FTP Handoffs for Clients · Share API Keys and .env Files (Safely) · Verify Links Like a Pro

Bottom line

Per-user SFTP in, least-privilege S3 out—and secrets shared ephemerally. That’s a secure bridge clients can use without training wheels.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.