A county clerk receives nightly partner permit files over SFTP into Amazon S3 and then kicks off processing. Which approach best replaces a self-managed bastion FTP server while keeping the transfer managed?
Select an answer to reveal the explanation.
Short Explanation
Think of Transfer Family as the city’s managed night drop-box—partners SFTP in, and the files land in S3 without you babysitting an FTP bastion. Self-managed FTP fleets and open anonymous buckets are the messy basement versions of the same job.
Full Explanation
AWS Transfer Family gives the county clerk a fully managed SFTP endpoint that authenticates partners and writes nightly permit files straight into the designated Amazon S3 bucket. From there, S3 event notifications or EventBridge can kick off processing without anyone patching FTP daemons, rotating bastion keys, or babysitting public EC2 FTP fleets. That managed path replaces a self-managed bastion while keeping the partner protocol familiar and the landing zone cloud-native.
An Auto Scaling group of EC2 FTP servers in a public subnet that cron-syncs into S3 fails by concept because it recreates the operational and security burden of bastion FTP—patching, certificates, firewall holes, and brittle sync scripts—instead of adopting a managed transfer service. Exposing the S3 bucket anonymously over HTTP so partners can POST without credentials fails because it abandons authentication and authorization; public write access is not an acceptable municipal transfer control. Requiring partners to VPN into an on-premises FTP appliance that still copies objects into S3 manually fails because it preserves a hybrid single point of failure and manual copy step rather than a managed cloud SFTP landing zone.
Exam caveat: When the stem asks to replace a self-managed FTP/SFTP bastion while keeping transfers managed into S3, prefer AWS Transfer Family (SFTP/FTPS/FTP) over DIY EC2 FTP, anonymous buckets, or on-prem appliances. Transfer Family is the managed drop-box pattern for partner file exchange.
Operational check: Confirm the Transfer Family server maps to the correct S3 bucket/prefix, partner identities use IAM roles or custom identity providers with least privilege, CloudWatch metrics show successful transfers, and the downstream processing trigger fires only after objects land. If operators still SSH to public FTP boxes nightly, the managed replacement is incomplete.