A company currently serves files via an internet-accessible SFTP server running on a single EC2 instance with an attached Elastic IP. Customers connect using that Elastic IP and SSH. The EC2 instance’s security group allows access from all customer IP addresses. The solutions architect must improve availability, reduce infrastructure management complexity, and minimize disruption for customers — without changing how customers connect. Which solution meets these constraints?

The correct solution leverages AWS Transfer Family, a fully managed service for SFTP, which inherently improves availability and reduces management complexity. By creating a VPC-hosted, internet-facing endpoint and associating the existing Elastic IP, customer connectivity remains unchanged, minimizing disruption. Using an S3 bucket for storage provides high durability and scalability, and syncing existing files ensures data continuity. Attaching the security group with customer IPs maintains the required access control. The first incorrect option uses a publicly accessible endpoint without specifying a VPC, which might not offer the same level of network control or security as a VPC-hosted endpoint, and doesn't explicitly mention attaching the security group. The third option introduces Fargate, EFS, and an NLB, which adds more components and management overhead compared to Transfer Family, and EFS is not designed for direct internet access in this manner. The fourth option uses multi-attach EBS and an Auto Scaling group, which is complex to manage for SFTP and multi-attach EBS has specific limitations that might not suit this use case.