Set up an Amazon EC2 instance

A single Amazon Elastic Compute Cloud (EC2) instance is enough for many SFTPPlus installations. Two instances are preferred for implementing high availability transfers with a load balancer, and in this case the setup is similar to a single instance.

This guide covers the basic instance, storage, addressing, and inbound port choices for that setup. It deliberately leaves out detailed firewall design, private networking, and load balancer configuration, as those depend on your AWS environment.

Choose the instance ​

Use the latest supported operating system release when possible. SFTPPlus also runs on other current Linux distributions and Windows versions. We recommend an x86_64 instance. AWS Graviton arm64 instances are also supported when running Linux.

These resources are suitable for a single SFTPPlus instance:

EC2 instance availability varies by AWS Region. You can use another instance type that meets the same CPU and memory requirements. The t3 examples use x86_64 processors, while t4g uses AWS Graviton arm64 processors.

SFTPPlus spends most of its time moving data between the network and storage, so its normal workload is not CPU-intensive. One vCPU is enough for a small installation, and a single server does not usually benefit from more than two vCPUs. On Windows, the extra memory is for the Windows graphical interface rather than SFTPPlus; the SFTPPlus process normally uses less than 500 MB.

Allow 20 GB of Amazon Elastic Block Store (EBS) storage for the operating system and SFTPPlus. If the Amazon Machine Image (AMI) requires a larger root volume, keep its default. Add a separate EBS data volume with the capacity and performance required for your users' files.

Create the instance and security group ​

In the EC2 console, launch an instance in the required Region, virtual private cloud (VPC), and subnet. Select Amazon Linux 2023 or Windows Server 2025, choose one of the instance types above, and select an EC2 key pair. The key pair authenticates SSH access on Linux and decrypts the initial Administrator password on Windows. Restrict SSH or Remote Desktop access to trusted administration addresses.

Add only the inbound rules for the SFTPPlus services you plan to enable:

Restrict port 10020 to administrator source addresses. For FTPS, allowing port 10021 alone is not enough: the security group, network access control list, and any other firewall in the path must also allow inbound TCP connections to the passive range 10090-10100.

These non-default ports reduce exposure to broad automated scans and add a small extra layer of security. They do not replace authentication, TLS, SSH, or firewall controls. SFTPPlus can instead listen on the standard ports 443 for HTTPS, 22 for SFTP, and 21 for FTPS when that fits your network policy.

An automatically assigned public IPv4 address can change when you stop and start an instance. If transfer partners need a stable address, use an Elastic IP address, a load balancer, or a DNS name that you update when the address changes. You can omit a public address when users connect through a private network, VPN, or AWS Direct Connect.

Install SFTPPlus ​

After EC2 finishes launching the instance, connect over SSH or Remote Desktop, download the SFTPPlus package for the instance's operating system and architecture, and follow the installation documentation. The installer includes the application and Web Manager; it does not require a separate database, Java runtime, or web server.

Open https://INSTANCE_ADDRESS:10020 from an allowed administrator address and sign in with the account created during installation. You can then configure users, TLS certificates, SSH keys, and the services needed by your organization. Test each enabled transfer service through its public or private address: SFTP on port 10022, HTTPS on port 10443, and FTPS on port 10021 using the passive range 10090-10100.