Storage Gateway and Transfer Family

Deploy a managed SFTP endpoint and master hybrid storage decisions for SAA-C03.

Introduction

30 Second Summary

Every business has files that need to move between on-premises systems and the cloud. Maybe it's daily reports from a trading partner, backup tapes that need modernizing, or engineering files that must live in S3 but feel local to applications. AWS offers three services for these patterns, and the SAA-C03 exam expects you to pick the right one in seconds.

In this project, you will deploy a managed SFTP server using AWS Transfer Family, transfer a real file into Amazon S3, and build a decision framework that maps hybrid storage scenarios to the correct AWS service.

What You'll Build

You'll connect to your own AWS-managed SFTP endpoint from your terminal, upload a test file, and watch it land in your S3 bucket within seconds. Then you'll work through timed scenario exercises until you can match any hybrid storage requirement to the right service faster than the exam clock demands.

By the end of this project, you'll have:

  • A working SFTP server that accepts file uploads directly into S3, proving you can deploy and test Transfer Family end to end.
  • A hybrid storage decision framework for choosing between Storage Gateway types, Transfer Family, and DataSync in under 30 seconds per scenario.
  • Completed scenario exercises covering all four Storage Gateway types, Transfer Family protocol constraints, and identity provider options aligned with SAA-C03 exam domains 3.5 and 4.1.
  • Secret Mission: Configure a managed workflow that automatically copies and tags files after upload.

Are there any prerequisites?

This is Project 3 of 3 in the hybrid storage series. You should have an AWS account with admin access, familiarity with S3 and IAM roles, and ideally have completed Projects 1 (Snow Family + DataSync) and 2 (FSx) in this series.

Before We Start

Before any hands-on work, take a moment to commit to what you're about to build and why it matters for your exam preparation.

Set Up Your S3 Bucket and IAM Role

Your SFTP server needs two things before it can accept file uploads: a place to store the files, and permission to write them there. Without both pieces, Transfer Family has nowhere to put uploaded files.

In this step, you'll create an S3 bucket as the storage destination and an IAM role that grants Transfer Family the access it needs.

In this step, get ready to:
  • Create an S3 bucket to receive uploaded files.
  • Create an IAM role with a trust relationship that allows Transfer Family to access your bucket.
  • Verify the trust relationship in the IAM console.
Create a dedicated S3 bucket

Transfer Family stores uploaded files as objects in S3. You need a bucket ready before you build the server.

  • In the AWS Management Console, type S3 in the top search bar and select S3 from the results.
  • Click Create bucket.
  • In the Bucket name field, enter a unique name following this pattern: transfer-family-lab-[your-initials]-[today's date].
  • For example, if your initials are JD and today is July 24, your bucket name would be transfer-family-lab-jd-20260724.
  • Leave Block all public access checked (this is the default).
  • Leave Server-side encryption set to SSE-S3 (the default).
  • Leave all other settings at their defaults.
  • Scroll to the bottom and click Create bucket.

You should see a green success banner at the top of the page, and your new bucket listed in the S3 buckets table.

Why this bucket name pattern?

S3 bucket names must be globally unique across all AWS accounts. Adding your initials and the date ensures your name does not collide with any other bucket in the world.

Seeing a 'Bucket name already exists' error?

Try adding extra digits or characters to make the name unique. For example, append -01 to the end of your bucket name.

help me fix my S3 bucket naming error

Create an IAM role for Transfer Family

Transfer Family needs an IAM role to write files into your bucket on your behalf. This role uses a trust relationship that says only the Transfer Family service is allowed to assume it.

  • Type IAM in the top search bar and select IAM from the results.
  • In the left sidebar, click Roles.
  • Click Create role.
  • Under Trusted entity type, select AWS service.
  • Under Use case, open the dropdown labeled Use cases for other AWS services.
  • Type Transfer into the search field.
  • Select Transfer from the results.
  • Click Next.
  • On the Add permissions page, search for AmazonS3FullAccess.
  • Check the box next to AmazonS3FullAccess to attach it.
  • Click Next.

Why AmazonS3FullAccess?

For this lab, you're granting broad S3 permissions to keep the setup simple. In a production environment, you would scope the policy to allow only the specific actions (like s3:PutObject and s3:GetObject) on your specific bucket.

  • In the Role name field, enter transfer-family-s3-access-role.
  • Scroll down and click Create role.

You should see a green success banner confirming the role was created.

CloudWatch logging for Transfer Family

Transfer Family can log activity to CloudWatch for monitoring. You do not need to create a separate logging role right now. When you create the server in the next step, Transfer Family can auto-create one if your user has sufficient IAM permissions.

Verify the trust relationship

The trust relationship is what locks this role down so only Transfer Family can use it. Before moving on, confirm it is set correctly.

  • In the IAM Roles list, search for transfer-family-s3-access-role.
  • Click the role name to open its details.
  • Select the Trust relationships tab.

Before you look, what do you expect to see listed as the trusted entity? Think about which AWS service you selected during role creation.

You should see a trust policy that lists transfer.amazonaws.com as the principal under the Trusted entities section. This confirms that only AWS Transfer Family can assume this role.

Don't see transfer.amazonaws.com?

If the trusted entity shows a different service (or your own account), you likely selected the wrong use case during role creation. Delete this role, create a new one, and make sure you search for and select Transfer under Use cases for other AWS services.

help me fix my IAM role trust relationship

Your storage destination and access permissions are ready. Next up, you'll deploy a live SFTP server and use these resources to transfer a real file into your bucket.

Deploy and Test Your SFTP Server

Your S3 bucket and IAM role are ready to receive files. Now you need an actual entry point for those files to arrive through.

The SAA-C03 exam tests your understanding of protocol, identity provider, and endpoint type combinations in Transfer Family. Deploying an SFTP server firsthand turns these abstract choices into concrete decisions you can recall under exam pressure.

In this step, get ready to:
  • Create a Transfer Family SFTP server with a public endpoint.
  • Add a service-managed user with SSH key authentication.
  • Upload a test file via SFTP and confirm it lands in S3.
Create the Transfer Family SFTP server

The Transfer Family console walks you through a wizard that maps directly to the exam's decision points: which protocol, which identity provider, and which endpoint type.

  • In the AWS Console, search for Transfer Family in the top search bar and open the service.
  • In the left sidebar, click Servers.
  • Click Create server.
  • Under Choose protocols, select SFTP.
  • Click Next.
  • Under Choose an identity provider, select Service managed.
  • Click Next.

Why service managed?

Service-managed identity uses SSH key-based authentication and only supports the SFTP protocol. This is the simplest setup for a lab. On the exam, remember that if you see FTPS or FTP in a scenario, service-managed is not an option.

  • Under Choose an endpoint, select Publicly accessible.
  • Leave Custom hostname set to None.
  • Click Next.
  • Under Choose a domain, select Amazon S3.
  • Click Next.
  • Under Configure additional details, keep the default security policy (TransferSecurityPolicy-2024-01).
  • For CloudWatch logging, select Create a new role so Transfer Family auto-creates a logging role for you.
  • Click Next.
  • On the Add tags page, click Add tag.
  • Enter Project for the Key and SAA-C03-Lab for the Value.
  • Click Next.
  • Review your settings, then click Create server.

The server takes 1-2 minutes to provision. Wait until the Status column shows Online before continuing.

What does each choice mean for the exam?

Protocol (SFTP) determines port 22 and encryption. Identity provider (Service managed) means SSH keys only. Endpoint type (Publicly accessible) means the server gets a public DNS name without needing a VPC.

On the exam, any scenario requiring FTP, FTPS, or AS2 forces a VPC endpoint. Any scenario needing password authentication forces a non-service-managed identity provider.

Server stuck in Starting state?

Provisioning can occasionally take up to 3-4 minutes. Refresh the page. If the status shows Start failed, check that your account does not have a service quota limiting Transfer Family servers in this region.

Help me troubleshoot my Transfer Family server not starting

Create a service-managed user

Before adding a user, you need an SSH key pair. The public key goes to Transfer Family. The private key stays on your machine for authentication.

  • Generate an SSH key pair by running this command in your terminal:

macOS

ssh-keygen -t rsa -b 4096 -f ~/.ssh/transfer-key
  • When prompted for a passphrase, press Enter twice to skip it (no passphrase needed for this lab).

Windows

ssh-keygen -t rsa -b 4096 -f C:\Users\[[WIN_USERNAME="your Windows username"]]\.ssh\transfer-key
  • Run this in PowerShell. When prompted for a passphrase, press Enter twice to skip it.
  • Confirm the key was created by running:

macOS

cat ~/.ssh/transfer-key.pub

Windows

Get-Content C:\Users\[[WIN_USERNAME="your Windows username"]]\.ssh\transfer-key.pub

You should see a long string starting with ssh-rsa. Copy this entire string. You will paste it in the next step.

Command not found?

On Windows, ssh-keygen is included with Windows 10 and later. Make sure you are using PowerShell, not Command Prompt. If the command is missing, install the OpenSSH optional feature from Settings > Apps > Optional features.

Help me install ssh-keygen on my machine

Now add a user to your SFTP server so you can authenticate and upload files.

  • Return to the Transfer Family console and click on your server's Server ID to open its details page.
  • Note the Endpoint value at the top of the page. It follows the format s-[serverid].server.transfer.[region].amazonaws.com. You will need this shortly.
  • Scroll down to the Users section and click Add user.
  • Enter sftpuser for the Username.
  • For Role, select transfer-family-s3-access-role (the IAM role you created in Step 1).
  • For Home directory, select your S3 bucket (transfer-family-lab-[initials]-[date]).
  • Check the Restricted checkbox.
  • In the SSH public keys section, paste the entire public key string you copied earlier.
  • Click Add.

You should see sftpuser listed under the Users section of your server.

Why restrict the home directory?

When Restricted is checked, the user sees only their designated folder and cannot navigate above it. This prevents users from listing other users' files or browsing the bucket root. On the exam, restricted home directories appear in multi-tenant scenarios.

Test the file transfer

With the server online and a user configured, you can now test an end-to-end file transfer. This is the moment that proves everything works together.

  • Create a small test file by running:

macOS

echo "SAA-C03 Transfer Family test" > test-upload.txt

Windows

echo "SAA-C03 Transfer Family test" > test-upload.txt
  • Connect to your SFTP server by running:

macOS

sftp -i ~/.ssh/transfer-key sftpuser@[[SERVER_ENDPOINT="s-serverid.server.transfer.region.amazonaws.com"]]

Windows

sftp -i C:\Users\[[WIN_USERNAME="your Windows username"]]\.ssh\transfer-key sftpuser@[[SERVER_ENDPOINT="s-serverid.server.transfer.region.amazonaws.com"]]

What should I see?

After a few seconds, you should see a prompt that says sftp>. This means you are connected and authenticated. If you are prompted to accept the host key fingerprint, type yes and press Enter.

  • Upload the test file by running this inside the SFTP session:
put test-upload.txt
  • Exit the SFTP session:
exit

Before you check S3, what do you expect to see? Think about where the file should land given the restricted home directory you configured for sftpuser.

  • In the AWS Console, navigate to S3 and open your transfer-family-lab-[initials]-[date] bucket.
  • Look inside the sftpuser folder (Transfer Family creates this path based on the username).
  • Confirm that test-upload.txt appears in this folder.

Your file made it from your local machine, through the managed SFTP endpoint, and into S3. The entire transfer was handled by Transfer Family without you managing any server infrastructure.

File not appearing in S3?

Check these common causes:

  • Make sure you ran put test-upload.txt and saw a transfer confirmation in the SFTP session. If you saw a permission error, verify the IAM role transfer-family-s3-access-role has the AmazonS3FullAccess policy attached.
  • Confirm you selected the correct S3 bucket when setting the user's home directory.
  • If the SFTP connection itself failed, verify you used the private key (transfer-key), not the public key (transfer-key.pub).

Help me troubleshoot my Transfer Family file upload

You now have a working SFTP endpoint backed by S3. Next up, you will dive deep into Storage Gateway's four types and build the mental model for choosing between them under exam pressure.

Explore Storage Gateway Types

Your SFTP server is live and you've proven that Transfer Family can move files into S3. Now it's time to tackle the other half of the hybrid storage picture.

The SAA-C03 exam presents scenarios requiring you to pick the correct Storage Gateway type. Without understanding the protocol, storage backend, and caching behavior of each type, you'll confuse them under exam pressure.

In this step, get ready to:
  • Learn all four Storage Gateway types, their protocols, and storage backends.
  • Map deployment options to real-world exam scenarios.
  • Complete a 6-scenario matching exercise and score at least 5/6.
Study the four Storage Gateway types

AWS Storage Gateway has four types: Amazon S3 File Gateway, Amazon FSx File Gateway, Volume Gateway, and Tape Gateway. Each one connects on-premises applications to AWS storage in a different way.

Study the characteristics below. Focus on three things for each type: the protocol it exposes, where it stores data, and what caching behavior it uses.

S3 File Gateway
  • Protocol: NFS or SMB (file-level access).
  • Storage backend: Files are stored as individual S3 objects (1:1 file-to-object mapping).
  • Caching: Frequently accessed data is cached locally on the gateway for low-latency reads.
  • Use cases: Data lakes, backups, on-premises applications that need file access to S3.
Volume Gateway (two modes)

Volume Gateway presents iSCSI block storage volumes to on-premises applications. It has two modes that the exam loves to test.

  • Cached mode: Primary data lives in Amazon S3. A copy of frequently accessed data subsets is retained locally. Point-in-time snapshots are stored as EBS snapshots.
  • Stored mode: The full dataset stays on-premises for low-latency access. The gateway asynchronously backs up point-in-time snapshots to Amazon S3, stored as EBS snapshots.

Cached vs Stored: the exam's favourite trick

Think of it this way. Cached mode expands storage capacity without buying hardware. Your primary data is in S3, and only the hot subset lives locally.

Stored mode keeps the entire dataset on-prem for guaranteed low-latency access. S3 is the backup destination, not the primary store. When the scenario says "low-latency access to the entire dataset" plus cloud backup, the answer is Stored mode.

Tape Gateway
  • Protocol: iSCSI-based virtual tape library (VTL).
  • Storage backend: Virtual tapes stored in Amazon S3. Archives to S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive.
  • Use case: Replace physical tape infrastructure without changing your existing backup software (Commvault, Veritas NetBackup, etc.).

Glacier tier exam signal

When a scenario says "cheapest possible storage" for tape archives, the answer is S3 Glacier Deep Archive. When it just says "archive" without emphasising cost, S3 Glacier Flexible Retrieval is the default.

FSx File Gateway
  • Protocol: SMB (Windows file shares).
  • Storage backend: Provides low latency and efficient access to in-cloud FSx for Windows File Server file shares from on-premises. Requires VPN or Direct Connect.
  • Caching: Local cache on the gateway for frequently accessed data.
  • Use case: Branch offices running Windows workloads that need low-latency access to centralized FSx file shares.

Is FSx File Gateway still on the exam?

FSx File Gateway is no longer available to new customers as of October 28, 2024. However, it was available when the SAA-C03 exam was released and is still tested. Know its use case and how it differs from S3 File Gateway.

Confirm the gateway types in the AWS console
  • In the AWS Console search bar, type Storage Gateway and select the service.
  • Click Create gateway to see the gateway type selection page.
  • Confirm that the page lists the gateway types you just studied. Notice which types are available for creation versus which are documented for existing customers only.
  • Click Cancel to exit without creating anything.
Map deployment options to exam scenarios

Storage Gateway can be deployed in three ways. The exam tests whether you know which deployment option fits a given infrastructure constraint.

  • On-premises VM: Runs on VMware ESXi, Microsoft Hyper-V, or Linux KVM. This is the most common deployment for data centres with existing virtualization.
  • Hardware appliance: A physical device for sites without virtualization infrastructure. No longer offered to new customers as of May 12, 2025, but still supported for existing customers and still appears in exam scenarios.
  • Amazon EC2 instance: A cloud-based gateway. Use for disaster recovery, data mirroring, or cloud-hosted applications that need gateway functionality.

When does the exam mention the hardware appliance?

Look for scenarios that say "the site has no virtualization infrastructure" or "no hypervisor available." That's the signal for the hardware appliance answer. If the scenario mentions an EC2-based DR solution, the answer is the EC2 deployment option.

Test yourself with the scenario matching exercise

Time to put your knowledge to the test. Below are six scenarios you might see on the SAA-C03 exam. For each one, identify the correct Storage Gateway type (and mode, where applicable).

  • Read all six scenarios below.
  • Write down your answers before checking the answer key.

Scenario A: A hospital needs to replace aging tape backup infrastructure but cannot change their Commvault backup software. Which gateway type?

Scenario B: An engineering firm needs their on-prem CAD application to read/write files that are durably stored in S3, with local caching for performance. Which gateway type?

Scenario C: A financial services company needs iSCSI block storage with the full dataset available locally for low-latency trading analytics, plus automated offsite backups. Which gateway type and mode?

Scenario D: A media company wants to archive 500TB of video to the cheapest possible storage class using their existing tape-based workflow. Which gateway type and which archive tier?

Scenario E: A company with branch offices running Windows workloads needs low-latency SMB access to centralized file shares in AWS. They already use FSx for Windows File Server. Which gateway type?

Scenario F: A manufacturing plant needs to expand SAN storage capacity for their ERP system without purchasing new hardware. Frequently accessed data must be fast, but the total dataset exceeds local capacity. Which gateway type and mode?

Before you reveal the answers, how many of the six do you think you got right?

✔️ I'll give it a go!

Write down your answer for each scenario (A through F), then switch to the other tab to check your work. Target: at least 5 out of 6 correct.

ⓧ Let me check my work

Here is the answer key with explanations:

  • A = Tape Gateway. The signal is "replace tape" + "cannot change backup software." Tape Gateway presents a VTL interface that existing backup tools recognise.
  • B = S3 File Gateway. The signal is "read/write files" + "stored in S3" + "local caching." NFS/SMB file access with S3 backend and a local cache.
  • C = Volume Gateway Stored mode. The signal is "full dataset available locally" + "low-latency" + "offsite backups." Stored mode keeps everything on-prem with async backup to S3.
  • D = Tape Gateway with S3 Glacier Deep Archive. The signal is "cheapest possible" + "existing tape-based workflow." Deep Archive is the lowest-cost archival tier.
  • E = FSx File Gateway. The signal is "Windows workloads" + "SMB" + "FSx for Windows File Server already in use." FSx File Gateway caches FSx shares on-premises.
  • F = Volume Gateway Cached mode. The signal is "expand capacity without new hardware" + "total dataset exceeds local capacity." Cached mode stores primary data in S3, caching only hot data locally.

How to read exam signal words

Each scenario contains signal words that map directly to one gateway type. "Replace tape" always means Tape Gateway. "File access to S3" always means S3 File Gateway. "Full dataset on-prem" always means Volume Gateway Stored mode. "Expand capacity" always means Volume Gateway Cached mode.

Scored lower than 5/6?

Review the gateway type that tripped you up. Focus on the protocol (NFS/SMB vs iSCSI vs iSCSI-VTL) and where primary data lives (S3 vs on-prem vs virtual tapes). Those two dimensions disambiguate every scenario.

Help me understand the difference between the Storage Gateway types.

You now have the four Storage Gateway types locked in. Next up, you'll apply the same deep-dive approach to Transfer Family's protocol and identity provider matrix.

Master Transfer Family Protocols and Identity Providers

In the previous step, you built a mental model for choosing between Storage Gateway types based on protocol and storage backend. Transfer Family has its own constraint matrix that the SAA-C03 exam tests just as heavily.

Exam questions present a scenario with specific protocol, authentication, and compliance requirements, and you need to pick the right combination of protocol, identity provider, and endpoint type. In this step, you will internalize those constraints by studying the decision matrix and then testing yourself with scenario exercises.

In this step, get ready to:
  • Map Transfer Family protocol and endpoint constraints.
  • Study identity provider options and managed workflow capabilities.
  • Complete a 5-scenario decision exercise and score at least 4/5 correct.
Map protocol and endpoint constraints

Transfer Family supports multiple protocols, but each protocol restricts which endpoint type and identity provider you can use. This constraint matrix is a high-value exam target.

  • Study the four protocols and their endpoint requirements below.
  • SFTP: Port 22, encrypted. Supports both Public and VPC endpoints. The only protocol that works with a public endpoint.
  • FTPS: TLS encryption. Requires a VPC endpoint. Requires an ACM certificate. Cannot use service-managed identity.
  • FTP: Unencrypted. Requires a VPC endpoint (internal only). Cannot use service-managed identity. Never use for sensitive data.
  • AS2: B2B structured data exchange. Requires a VPC endpoint. Domain must be Amazon S3.

What is the key constraint to remember?

Service-managed identity only supports SFTP. If a scenario mentions FTPS or FTP, the identity provider must be AWS_DIRECTORY_SERVICE, AWS_LAMBDA, or API_GATEWAY.

Public endpoints only support SFTP. If a scenario needs FTPS, FTP, or AS2, the answer always involves a VPC endpoint.

Can a public endpoint restrict by source IP?

No. Public endpoints do not support security groups for IP restriction. To restrict traffic by source IP, you need a VPC endpoint with an associated security group or Elastic IP.

Study identity providers and managed workflows

Transfer Family offers four identity provider types, each suited to different authentication requirements.

  • Service managed: Simplest setup. SSH key-based auth only (no password). SFTP only. Good for small teams and internal automated transfers.
  • AWS Managed Microsoft AD: Password auth (no key). Integrates with existing Active Directory. Good for enterprises already running AD.
  • Custom (API Gateway): Supports both key and password auth. Integrates with any IdP (Okta, Cognito). Supports AWS WAF integration. Good for complex auth requirements.
  • Custom (Lambda): Same flexibility as API Gateway but simpler invocation. Supports both key and password auth. Good for custom auth logic or Azure AD/Entra ID integration.

WAF integration is provider-specific

AWS WAF integration is only available with the API Gateway identity provider. If an exam scenario mentions WAF for SFTP, the answer is Custom (API Gateway).

Transfer Family also supports managed workflows that trigger automatically after a file upload completes.

  • Study the predefined workflow step types:
  • COPY: Copy the uploaded file to another S3 location.
  • TAG: Add key-value tags to the file in S3.
  • DECRYPT: Decrypt PGP-encrypted files after upload.
  • DELETE: Remove the original file after processing.
  • CUSTOM: Invoke an AWS Lambda function for custom processing (malware scanning, format conversion, notifications).

What are the workflow constraints?

Workflows support a maximum of 8 steps. COPY and TAG steps currently only work with S3 (not EFS).

You can use dynamic variables in copy and decrypt steps: ${transfer:UserName} and ${transfer:UploadDate} for dynamic destination paths.

Workflows cannot be edited after creation. If you need to change a workflow, you must delete it and create a new one. Workflows are not triggered by 0-byte files.

Test your knowledge with the scenario exercise

Now put your knowledge to the test. Read each scenario below and decide which protocol, identity provider, or endpoint configuration is the correct answer before checking the answer key.

  • Read all five scenarios and write down your answers on paper or in a notes app.
  • Try to answer each one in under 30 seconds, simulating exam time pressure.

Scenario A: A healthcare company needs HIPAA-compliant file exchange with insurance partners using existing SFTP workflows. Partners authenticate with passwords managed in the company's Active Directory. Which protocol and identity provider?

Scenario B: A SaaS vendor distributes nightly data exports to 200 customers. Each customer authenticates with API keys against a custom database. Files must be scanned for malware after upload. Which identity provider and what post-upload mechanism?

Scenario C: A retail company exchanges EDI documents with suppliers using AS2. Where must the endpoint be hosted?

Scenario D: An internal team needs the simplest possible SFTP endpoint for automated scripts. No existing AD infrastructure. Which identity provider?

Scenario E: A fintech company needs SFTP with source IP restrictions. Can they use a public endpoint?

Before revealing the answers, predict how many you got right out of five.

✔️ I'll give it a go!

Great. Write down all five answers, then switch to the other tab to check your work.

ⓧ Let me check my work

Here is the answer key. Compare each answer against yours.

  • Scenario A: SFTP + AWS Managed Microsoft AD. The scenario specifies SFTP workflows and password auth via Active Directory.
  • Scenario B: Custom identity provider (Lambda or API Gateway) + managed workflow with a custom Lambda step for malware scanning. Custom auth is needed for the API-key database, and a CUSTOM workflow step invokes Lambda for scanning.
  • Scenario C: VPC endpoint. AS2 requires a VPC endpoint and the domain must be Amazon S3.
  • Scenario D: Service managed. It is the simplest option, uses SSH keys, and supports SFTP without needing AD or custom auth.
  • Scenario E: No. Public endpoints do not support security groups for IP restriction. They need a VPC endpoint with security groups or Elastic IPs to filter by source IP.

Target: at least 4 out of 5 correct. If you scored below that, review the protocol constraints and identity provider options above before moving on.

Scored below 4/5?

The most common confusion is between service-managed (SFTP only, keys only) and AWS Managed Microsoft AD (password auth, integrates with AD). If a scenario mentions passwords and Active Directory together, it is always AWS Managed Microsoft AD.

If you need help remembering the constraint matrix, help me build a mnemonic for Transfer Family protocol and identity provider constraints.

You now have the Transfer Family constraint matrix locked in. Next up, you will build a unified decision framework that ties together Storage Gateway, Transfer Family, and DataSync so you can pick the right service for any hybrid storage scenario in under 30 seconds.

Build Your Hybrid Storage Decision Framework

You now have deep knowledge of all four Storage Gateway types and Transfer Family's protocol and identity provider matrix.

The SAA-C03 exam frequently presents scenarios where multiple services could work, and you must pick the best fit. In this step, you will build the decision tree that lets you select the right service in under 30 seconds, connecting everything back to DataSync from Project 1.

In this step, get ready to:
  • Build a decision framework that maps data flow patterns to the correct AWS service.
  • Differentiate sub-decisions within Storage Gateway, Transfer Family, and DataSync.
  • Complete a timed 6-scenario capstone exercise scoring at least 5/6 correct.
Build the decision framework by data flow pattern

The three services (Storage Gateway, Transfer Family, DataSync) each serve a distinct data flow pattern. When an exam question describes a scenario, your first job is to identify which pattern it matches.

  • Read through these five data flow patterns and their matching services:
  • Ongoing on-prem access to cloud storage (applications read/write continuously): Storage Gateway.
  • One-time or scheduled bulk data migration/sync: DataSync.
  • External parties transferring files to/from your AWS storage: Transfer Family.
  • Backup modernization (replace tape/disk with cloud): Storage Gateway (Tape or Volume).
  • B2B file exchange with compliance requirements: Transfer Family.

Why this framework works for the exam

SAA-C03 exam domains 3.5 and 4.1 test your ability to determine high-performing data ingestion solutions and design cost-optimized storage. Both domains explicitly list DataSync, Storage Gateway, and Transfer Family as required knowledge.

The key word in each scenario is the direction of data flow. Is the data flowing continuously from on-prem apps? Is it a one-time migration? Are external partners sending files? Identify the pattern first, then narrow down the service.

Differentiate within each service

Once you have identified the right service, you still need to pick the right type or configuration within that service. Here is the sub-decision tree for each.

  • Review these sub-decision rules for Storage Gateway:
  • Need file access (NFS/SMB) to objects stored in S3? S3 File Gateway.
  • Need iSCSI block storage with primary data in cloud, hot data cached locally? Volume Gateway Cached mode.
  • Need iSCSI block storage with full dataset on-prem, async backup to S3? Volume Gateway Stored mode.
  • Need to replace physical tape infrastructure without changing backup software? Tape Gateway.
  • Review the sub-decision rules for Transfer Family:
  • Protocol choice is driven by what the client already uses (SFTP, FTPS, FTP, or AS2).
  • Identity provider is driven by the existing auth infrastructure (service managed for simple SSH key auth, AD for enterprise password auth, Lambda/API Gateway for custom IdP).
  • Post-upload automation uses managed workflows (step types: COPY, TAG, DECRYPT, DELETE, or custom Lambda).
  • Review the sub-decision rules for DataSync:
  • Online agent-based transfer service for bulk data moves.
  • Supports NFS, SMB, HDFS, S3, EFS, and FSx as sources and destinations.
  • Can run as one-time transfers or on a schedule (e.g., every 6 hours for ongoing replication).

How does DataSync differ from Storage Gateway?

Storage Gateway provides an ongoing access layer. Your on-prem apps connect to it like a local file server or SAN, and it handles syncing data to AWS behind the scenes.

DataSync moves data in bulk from point A to point B. It does not provide ongoing access. Think of it as a moving truck, while Storage Gateway is a permanent bridge.

Complete the timed capstone exercise

Time to put your decision framework to the test. You will read six scenarios and select the correct service and type for each one. Try to answer each in under 30 seconds, just like the exam.

  • Read each scenario below and write down your answer before checking the key.
  • Set a timer for 3 minutes total (30 seconds per scenario).

Scenario 1: A company's on-premises NAS is running out of capacity. Applications use NFS to access files. They want to tier cold data to S3 while keeping hot data locally. Which service and type?

Scenario 2: A company needs to migrate 50TB from on-premises NFS to S3 as a one-time transfer. Which service?

Scenario 3: A company's trading partners send daily CSV files via SFTP. The company needs these files in S3 for processing by Athena. Which service?

Scenario 4: A company wants to replace physical tape backups with cloud storage but keep using Veritas NetBackup. Which service and type?

Scenario 5: A company needs ongoing replication of their on-premises file server (SMB) to S3 for disaster recovery, running every 6 hours. Which service?

Scenario 6: After files arrive via SFTP from business partners, they must be automatically copied to an archive bucket and tagged for compliance. Which service and feature?

Before you reveal the answers, how many do you think you got right? Which scenarios felt the hardest to decide?

✔️ I'll try it first

Write down your answers for all six scenarios before switching to the answer key tab. Focus on identifying the data flow pattern first, then narrowing to the specific type.

ⓧ Let me check my work

Here is the answer key with explanations:

  • Scenario 1: Storage Gateway S3 File Gateway. The pattern is ongoing on-prem NFS access with cloud tiering. S3 File Gateway presents NFS protocol with a local cache for hot data and stores everything in S3.
  • Scenario 2: DataSync. The pattern is a one-time bulk migration. DataSync is built for moving large datasets from point A to point B.
  • Scenario 3: Transfer Family (SFTP server with S3 domain). The pattern is external parties sending files. Trading partners use SFTP, and Transfer Family puts those files directly into S3.
  • Scenario 4: Storage Gateway Tape Gateway. The pattern is backup modernization without changing existing software. Tape Gateway presents an iSCSI-VTL interface that works with Veritas NetBackup.
  • Scenario 5: DataSync (scheduled task). The pattern is scheduled replication. DataSync supports running on a schedule for ongoing sync. This is NOT Storage Gateway because the scenario says replication for DR, not continuous app access.
  • Scenario 6: Transfer Family managed workflows. The pattern is post-upload automation on files arriving from external partners. Managed workflows trigger on file upload and support COPY and TAG steps.

Your target is at least 5 out of 6 correct. If you scored below that, review the decision framework above and identify which data flow pattern you missed.

The exam trick to watch for

Scenario 5 is the trickiest. Ongoing replication sounds like Storage Gateway, but the key phrase is "for disaster recovery" with a schedule. The applications are not reading from S3 day-to-day. DataSync with a scheduled task handles periodic sync without providing a continuous access layer.

Scored below 5/6?

Go back to the decision framework and re-read the data flow patterns. For each scenario you missed, identify which pattern keyword you overlooked ("one-time", "ongoing access", "external partners", "scheduled").

Help me understand the difference between DataSync and Storage Gateway for replication scenarios.

You now have a complete decision framework for hybrid storage on the SAA-C03 exam. Given any scenario involving on-premises applications, file transfers, backup modernization, or B2B exchange, you can select the right service and configuration in under 30 seconds. Next up, you will clean up your AWS resources to keep your bill under a dollar.

Secret mission

Add a Managed Workflow for Post-Upload Processing

Your SFTP server accepts files, but what happens next? In a real enterprise environment, uploaded files need automatic processing: copying to archive folders, tagging for compliance, scanning for malware. Configure a managed workflow that automatically copies and tags files the moment they land in your bucket.

Clean Up Your Resources

Clean Up Your Resources

If you followed Step 6, your AWS resources are already deleted and you have no ongoing cloud costs. This section covers any remaining items and provides a final cost check.

Cost warning

If you skipped Step 6, your Transfer Family SFTP server is still billing at $0.30 per hour per protocol enabled. That adds up to $7.20 per day. The server incurs charges even when stopped. Delete it immediately using the instructions in the Delete tab below.

Resources you used:

  • AWS Transfer Family SFTP server ($0.30/hour while it exists, even when offline).
  • S3 bucket (minimal storage cost for test files).
  • IAM roles (free).
  • CloudWatch Logs log group (minimal cost for log entries).
  • SSH key pair (local files, no cost).

Keep everything running

Choose this only if you plan to continue experimenting with Transfer Family immediately. Be aware of the ongoing cost.

  • Your Transfer Family server costs $0.30/hour ($7.20/day) while it exists.
  • Your SSH key pair at ~/.ssh/transfer-key remains on your machine for future use.
  • Your S3 bucket incurs minimal storage charges (pennies for small test files).
  • CloudWatch Logs retain your workflow execution history at minimal cost.

Pause - I'll come back to this later

Transfer Family does not offer a true pause. You can stop the server, but AWS still bills for its existence. The only way to stop charges is to delete the server entirely.

  • If you want to stop charges but keep your S3 bucket and IAM roles for later, delete only the Transfer Family server (see the Delete tab for instructions).
  • Re-creating a server later takes 1-2 minutes. Your S3 data and IAM role will still be there.
  • Your local SSH key pair stays on your machine and can be reused.

Delete - I don't want to use this again

Remove all project resources to ensure zero ongoing charges. If you already completed Step 6, confirm each item is gone.

  • Delete the Transfer Family server: navigate to AWS Transfer Family > Servers. Select your server, choose Actions > Delete. Confirm the deletion. If no servers are listed, this is already done.
  • Empty and delete the S3 bucket: navigate to S3. Select your lab bucket, choose Empty, confirm. Then select the bucket again, choose Delete, and confirm. If the bucket is not listed, this is already done.
  • Delete IAM roles: navigate to IAM > Roles. Search for and delete transfer-family-s3-access-role, transfer-family-workflow-execution-role, and any AWSTransferLoggingAccess role. If none appear in search, they are already deleted.
  • Delete the CloudWatch Logs log group: navigate to CloudWatch > Log groups in the left navigation. Select the Transfer Family log group (its name contains aws/transfer). Choose Actions > Delete and confirm.
  • Delete local SSH keys: remove the key pair you generated for this project.

macOS

rm ~/.ssh/transfer-key ~/.ssh/transfer-key.pub

Windows

Remove-Item C:\Users\$env:USERNAME\.ssh\transfer-key, C:\Users\$env:USERNAME\.ssh\transfer-key.pub
  • Delete the local test file if it still exists.

macOS

rm ~/test-upload.txt

Windows

Remove-Item ~\test-upload.txt
  • Verify zero charges: navigate to Billing > Bills in the AWS Console. Confirm no Transfer Family line items are accruing beyond the time you had the server running.

That's a Wrap!

That's a Wrap!

Nice work! You've built a hybrid storage decision toolkit by deploying a real SFTP endpoint, transferring a file to S3, and mastering the decision framework that maps directly to SAA-C03 exam questions.

You've learned how to:

  • Deploy an AWS Transfer Family SFTP server with service-managed authentication, create a user with an SSH key pair, and transfer a file that lands in your S3 bucket within seconds.
  • Differentiate all four Storage Gateway types (S3 File Gateway, FSx File Gateway, Volume Gateway cached/stored, and Tape Gateway) by protocol, storage backend, and use case, and match them to real-world scenarios under exam pressure.
  • Build a decision framework for choosing between Storage Gateway, Transfer Family, and DataSync based on data flow patterns, connecting this project to Project 1 (Snow Family + DataSync) and Project 2 (FSx) to complete your hybrid storage knowledge for SAA-C03 domains 3.5 and 4.1.
  • Secret Mission: Configured a managed workflow with copy and tag steps that automatically processes uploaded files after they arrive via SFTP.

Ready to quiz yourself?