AWS Transfer Family adds custom ports for public SFTP servers

AWS announced custom ports and per-port communication modes for Transfer Family public SFTP servers on October 12, 2026. The change lets operators accommodate clients with different port requirements or connection-start behavior on one server, according to AWS’s announcement.

Three ports with independent communication modes

According to AWS, public SFTP servers previously accepted connections only on port 22 and used server-first communication. Operators can now configure up to three ports, choosing port 22 or any port from 2000 through 65535. Each configured port can use either client-first or server-first communication.

AWS says some SFTP clients initiate communication themselves, and their connections can occasionally stall on a server-first port. Directing those clients to a client-first port provides a compatibility option. The important distinction is that communication mode is selected per port, allowing different client behaviors to coexist on the same server. AWS’s announcement describes both the port limits and the communication options.

Availability and configuration

AWS says the capability is available in all AWS Regions where Transfer Family public SFTP servers are offered. Operators can configure it through the AWS Transfer Family console, AWS CLI or AWS SDKs. The announced availability is specific to public SFTP servers.

Plan around clients and network rules

For engineering teams, a useful starting point is an inventory of client connection behavior and permitted network ports. Where appropriate, retain port 22 for existing integrations and introduce another port for clients requiring different behavior. Before redirecting production jobs, validate connection setup and a complete transfer, and check that network rules permit the selected port.

AWS also says using a port other than 22 can reduce unwanted connection attempts from automated scanners targeting port 22. Treat that potential reduction as an operational benefit, not a reason to relax authentication or other security controls.