Say you have a number of EC2 instances in an auto-scaling group & you need to be able to connect to them via SFTP. Maybe they’re web servers sharing an EFS & you need to get to that mounted EFS via SFTP. Or maybe you just want to download tons of application logs by SFTP-ing to the instances directly.

The problem here is that since the instances are in an auto-scaling group, they could die & get recreated at any time & when they do, they change their IPs. Not to mention that they’re most likely not publicly accessible & you’ll need a bastion host to SFTP to them anyway.

Wouldn’t it be great if you could target your SFTP connection to a load balancer in front of the auto-scaling group, instead of individual instances in the group itself? The LB won’t change its DNS name, unlike the private IP of the EC2s behind it. And you also don’t need to pay for a bastion host!

This can be achieved by creating a listener in the network load balancer as shown below. An application load balancer cannot be used here because it only supports HTTP(S) listeners.

Next, ensure that stickiness is enabled in the target group’s settings, otherwise, every time your SFTP client makes a request to the LB, it’ll connect you to a different EC2 instance!

Now you can use any SFTP client like FileZilla to connect to the NLB’s DNS name & that’ll get you an SFTP session with one of the web servers: