Secure SFTP document ingestion architecture using AWS Transfer Family with public endpoint, Route 53 DNS resolution, and firewall-protected WAN edge routing. Client connections flow through DNS sftp.carepathrx.net, traverse the firewall and access layer switch, then reach AWS Transfer Family's public SFTP endpoint authenticated via Service Managed Identity Provider. Uploaded files land in S3 bucket sftp.carepathrx.net, triggering EventBridge rules that invoke Lambda for automated file processing. This design isolates external SFTP traffic in a DMZ, enforces least-privilege identity management, and decouples ingestion from processing via event-driven architecture. Fork and customize this diagram on Diagrams.so to adapt firewall rules, add multi-region failover, or integrate additional Lambda workflows. The VPN Gateway trunk uplink and Load Balancer distribution layer support high-availability internal routing for large-scale document volumes.