SFTP Gateway to S3: Build vs Buy in 2026

Every engineering team hits this moment eventually. A partner says "we can only send files over SFTP," your data lives in S3, and someone on the team says the fateful words: "I could build that in a weekend."

And honestly? They're not wrong. You can build an SFTP-to-S3 gateway in a weekend. The real question is what it costs to still be running the thing in year two. Here's the honest ledger for 2026, both sides laid out.

The Build Options

Option A: VPS + OpenSSH + Sync Script (~$5–20/month)

The classic approach: rent a VPS, configure OpenSSH with chrooted SFTP users, and shuttle uploads to S3 with rclone, s3fs, or a cron-triggered script.

Out-of-pocket: $5–20/month. Hard to beat on price alone.

What the weekend estimate misses:

• User lifecycle. Every partner you onboard means shell commands, chroot permissions (which must be root-owned in exactly the right way, as anyone who's debugged broken pipe at 11pm knows), and key management. Every offboarding is a thing someone has to remember to do.
• The sync gap. Files land on local disk, then move to S3 later. That window is where files vanish. The script dies, the disk fills up, a partial upload gets synced mid-write. Before you know it, you're rigging up lock files and completeness checks.
• Security ownership. An internet-facing SSH server is a standing target. Patching, fail2ban, SSH hardening, CVE-watching: these become recurring calendar items whether you like it or not.
• No HA. One VPS is one point of failure. Your partners will discover outages before you do, unless you also build monitoring and alerting on top.

A fair maintenance estimate is 2–5 hours a month once things settle down, and more in months where something breaks. At typical loaded engineering rates, that's $300–1,000/month of attention wrapped around a $10 server.

Option B: A Marketplace Gateway VM (~$80–150/month all-in)

Products like Thorn Technologies' SFTP Gateway package the above into an AMI. The Standard tier's software fee starts around $0.08/hour (~$58/month), Professional at $0.15/hour ($108/month), plus the EC2 instance, EBS, and bandwidth underneath.

This is a legitimate middle path. The SFTP-to-S3 plumbing is solved, streaming to S3 works properly, and everything stays in your VPC. But notice what you still own: the VM itself (sizing, patching the OS, restarting it), availability (a single instance unless you architect HA yourself), and scaling. You've bought software. You're still running a server.

Option C: AWS Transfer Family (~$220+/month)

Here's the "buy" option that's really a build option wearing a managed-service costume. AWS runs the SFTP daemon, and that part is genuinely managed. But it comes at $0.30/hour per protocol (~$219/month, billed while idle, until you delete the endpoint) plus $0.04/GB. Everything above the protocol layer is still yours to assemble: IAM roles per user, Lambda functions for password auth, CloudWatch queries for "did the file arrive?", Secrets Manager for credentials. We itemized the whole bill in AWS Transfer Family Pricing Explained.

You're not buying a solution. You're buying one very reliable component and an obligation to build the rest yourself.

The Buy Option: A Managed Pass-Through Bridge

The 2026 version of "buy" is a service where the SFTP endpoint, user management, and S3 delivery are a single product, and files stream straight through to storage you own.

That's what Rilavek is. Concretely:

• No server, anywhere. Senders connect to Rilavek over SFTP (or FTPS/FTP/resumable HTTP), and files stream directly into your S3-compatible bucket: AWS S3, Cloudflare R2, Backblaze B2, Wasabi, MinIO, RustFS, IDrive e2, or any S3-compatible endpoint. There's no sync gap because there's no intermediate disk. The pass-through architecture means nothing rests on Rilavek's servers.
• Onboarding is a UI action, not a sysadmin task. Creating a sender takes seconds and comes with per-sender identity tracking, so "who uploaded this?" is an audit-log lookup, not grep archaeology. (Here's how that plays out onboarding dozens of vendors.)
• The event layer is built in. HMAC-SHA256-signed webhooks fire the moment a transfer completes. That's the part of the DIY build (inotify scripts, S3 event wiring) that usually never gets finished.
• Fan-out replication is a checkbox. One upload delivered to a primary and secondary bucket simultaneously. That "Rule of Two" backup your cron script was never going to implement.
• Pricing scales with usage, not capacity: 10GB/month free (no credit card), $10/month for 100GB (Starter), $30/month for 1TB (Pro). No hourly meter, no per-user fees.

The Ledger, Side by Side

When Building Is the Right Call

Build if any of these ring true:

• Policy requires it. No third party may appear in the data path, full stop. Then Transfer Family (inside your AWS org) or a gateway VM in your VPC are your realistic options.
• You need exotic behavior. Custom protocol quirks, in-flight transformation, air-gapped environments. If any of those describe your situation, you're building.
• It's not production. Internal tooling, experiments, hobby projects: a $5 VPS is genuinely fine, and you'll learn things along the way.

For everyone else, the choice boils down to spending engineering hours on undifferentiated plumbing or spending $10–30/month to make it someone else's uptime problem. In 2026, with loaded engineer time running $75–150/hour, the break-even math rarely favors the weekend project. The build doesn't have to fail to be a loss; it just has to consume a few hours a month forever.

A Sensible Way to Decide

1. Count your senders and your gigabytes. A handful of partners moving under 10GB/month? That fits Rilavek's free plan. The build-vs-buy question answers itself when "buy" is $0.
2. Price your constraint, not your preference. If compliance genuinely mandates self-hosting, budget the VM and the maintenance hours honestly.
3. Prototype the buy option first. It takes minutes to connect a bucket and point an SFTP client at it. If it covers your workflow, you've saved a weekend, plus every maintenance window that weekend would have spawned.

Next Steps

• The full pricing teardown: AWS Transfer Family Pricing Explained
• The vendor landscape: AWS Transfer Family Alternatives for Small Teams (2026)
• Replacing an existing box: Replace Legacy FTP with a Cloud-Native Bridge