AWS public SFTP supports up to three ports: check the handshake mode first

Which SFTP servers does this change apply to?

On October 12, 2026, AWS announced custom ports and per-port communication modes for Transfer Family public SFTP servers. SFTP transfers files securely over SSH and is commonly used to exchange files with business partners. This capability applies specifically to SFTP servers using PUBLIC endpoints.

AWS says the capability is available in every AWS Region that offers Transfer Family public SFTP servers, rather than only US Regions. The announcement does not provide an exact launch time or a separate custom-port charge. Port counts and announcement wording do not establish the cost.

The current user guide's introduction still broadly says SFTP uses port 22. Its new SFTP custom ports section, the ProtocolDetails API entry and the announcement explicitly describe the expanded range for PUBLIC endpoints. Do not read the older introduction as a port-22-only restriction, or apply the new range to VPC endpoints.

Plan the host, port and mode, with up to three port configurations

A PUBLIC SFTP endpoint can have up to three configured ports. Each must be 22 or an integer from 2000 to 65535; the range does not include every possible port. Gather your partners' network requirements and client behavior before choosing the configurations. There is no need to fill all three slots.

The API represents these settings in the SftpPorts list within ProtocolDetails. Each entry contains SftpPort and CommunicationMode: the listening port and which side sends data first when a connection starts. One server can offer different combinations for different clients.

If you omit the configuration during CreateServer, the service uses port 22 with SERVER_TALK_FIRST. Record the server hostname, port and corresponding mode given to each partner. A client still connecting to the old port is not testing your new settings.

When a handshake stalls, identify which side is waiting

With SERVER_TALK_FIRST, the server responds to the initial TCP connection first. Many older SFTP clients wait for the server's identification string before starting SSH negotiation. Assign those clients a port whose behavior matches that expectation.

With CLIENT_TALK_FIRST, the server waits for a data packet before responding to the initial connection. The API says most modern clients support sending their identification string first. The user guide specifically recommends this mode for clients that require TCP piggy-back ACKs, which carry data in the final acknowledgment of TCP's three-way handshake.

Matching the mode can reduce stalls caused by a client and server waiting for each other. The API also describes client-first mode as more resilient to retransmissions during the initial TCP connection. It is not a fix for every timeout. AWS recommends SERVER_TALK_FIRST if you are unsure of the client's behavior or it does not depend on that ACK behavior.

A hypothetical example: two partners, two handshake behaviors

This example is hypothetical and was not executed. Partner A has an older client that waits for the server's identification string; Partner B's client is known to require sending data first. A team could retain port 22 with SERVER_TALK_FIRST for A and use port 2222 with CLIENT_TALK_FIRST for B on the same PUBLIC SFTP server. Port 2222 is an example within the permitted range, not a prescribed default.

Give each partner its corresponding hostname and port, and confirm that its authorized network permits that destination. A client's age alone does not establish the correct mode. Avoid moving both partners to a new port before discovering that the older client still expects the server to speak first.

Configure, verify and retain a working combination for recovery

First, record the working hostname, port, communication mode and corresponding client. Verify the SSH host key and user authentication through your established trust process. Confirm each partner's requirements and your permission to make the change. A port change is not a reason to reset the host key or broaden file access.

Second, configure the ports through the current AWS Transfer Family console or an AWS SDK that supports these fields. For a new server, the guide places SFTP custom ports under Configure additional details; select SFTP and a Publicly accessible endpoint first. For an existing server, use its currently supported configuration interface and your change process. This guide does not supply an unverified migration command.

Third, verify with the intended client and a small file without sensitive information in an authorized, non-production environment. Confirm the recorded hostname and port, the SSH identity check and the user's intended permissions, then test an upload or download as authorized. An established TCP connection alone does not prove a successful file transfer.

Finally, record the results and retain the previous working combination. If the new combination fails, restore the former host, port and mode through your approved change process and verify again, using client errors and available service logs to investigate. These are suggested reader steps. No server creation, transfer or recovery was performed for this article, and a change without downtime is not guaranteed.

A different port can reduce scans, but security and protocol limits remain

AWS says a port other than 22 can reduce unwanted connection attempts from automated scanners targeting port 22. It does not make a public service private or guarantee freedom from scans or attacks. Retain SSH host verification, user authentication, least privilege and authorized file access.

The user guide explicitly says PUBLIC endpoints cannot restrict traffic through security groups. If you need security groups, assess the separate VPC-hosted endpoint approach. Do not apply VPC port rules or protections directly to this PUBLIC endpoint capability.

SFTP runs over SSH; it is not an HTTP or SOCKS proxy protocol. Choosing a port number commonly used by a proxy does not convert the protocol. The client, endpoint, authentication and permitted business use still need to match.