Skip to main content

Delivering reports to SFTP and Amazon S3

TRES delivers scheduled reports automatically to a Secure File Transfer Protocol (SFTP) server or an Amazon S3 bucket, so you do not need to download files manually.

Delivery options

Automatic delivery is useful when another system, such as an enterprise resource planning (ERP) system, bank statement tooling (e.g., MT940 and MT942 files), or an internal reconciliation process, needs your reports as files. Choose the option that matches where your systems read files from.

Option Where the file lands Who operates it Best when
TRES-hosted SFTP An SFTP server operated by TRES. Your systems download the files. TRES You do not have an SFTP server, or your systems prefer to fetch files.
Your SFTP server An SFTP server you operate. TRES uploads the files. You Your ERP or bank tooling already monitors an SFTP folder.
Your Amazon S3 bucket A bucket in your Amazon Web Services (AWS) account. TRES uploads the files. You You work in AWS and want files delivered into your own account.

TRES can also export report data to Snowflake. Set that up under Integrations.

How delivery works

Delivery is attached to a recurring report. When a recurring report runs, TRES generates the file and delivers it to your destination. Each recurring report has one destination.

Delivered files use the format you select for the report, e.g., XLSX, CSV, MT940, or MT942.

For intra-day reports such as MT942, TRES can skip a run with no activity or deliver a statement with no movements. Ask TRES Support which behavior fits your process.

TRES Support sets up destinations. Once your destination is ready, you can select it in the Export Destination section when you create a recurring report. See Get started.

Option 1: TRES-hosted SFTP

TRES hosts a secure SFTP server and a private folder for your organization. TRES places each report in your folder, and your systems connect to download it.

What TRES needs from you

  • Secure Shell (SSH) public key: Generate an SSH key pair on your side and send TRES the public key only. Keep the private key secret. Your systems use it to sign in.
  • Source IP addresses: The public IP addresses or ranges your systems connect from. TRES restricts access to these addresses.
  • Pretty Good Privacy (PGP) public key (optional): If you want encrypted files, send a PGP public key. TRES encrypts each file before placing it in your folder and adds a .pgp extension.
  • Separate folders (optional): If you have more than one TRES organization, such as sandbox and production, and want one SFTP sign-in, let us know. We can deliver each organization into its own subfolder, for example TEST/ and PROD/.

What you receive from TRES

  • The SFTP host name and port (22).
  • Your username.

Connect to your folder

Connect with any SFTP client that supports key authentication:

sftp -i <PATH_TO_YOUR_PRIVATE_KEY> <USERNAME>@<SFTP_HOST>

You land in the root of your folder, or in your organization's subfolder if one is configured. Access is read-only by default. You can list and download files, but you cannot upload or delete them.

File names

TRES names files <report name>_<YYYY-MM-DD>.<format>, e.g. mt940-daily_2026-06-10.mt940.

MT942 (intra-day) files include the full time, <report name>_<YYYY-MM-DDTHHMMSSZ>.mt942, so several deliveries on the same day never overwrite each other.

Option 2: Your SFTP server

TRES connects to your SFTP server and uploads each report.

What TRES needs from you

  • Host name: The address of your SFTP server. TRES connects over the internet, so the server must accept connections from TRES's IP addresses.
  • Port: Usually 22.
  • Username: A dedicated account for TRES with permission to write files.
  • Remote folder: The directory for the files, e.g. /inbound. The folder must already exist, and the account must be able to write to it.
  • File name pattern (optional): If your system expects a specific file name, tell TRES the pattern. It can include the report type and the delivery date and time, e.g. MT940_<YYYYMMDD_HHMMSS>.txt. Without a pattern, TRES names files report_<YYYY>_<MM>_<DD>.txt.

What you do on your side

  • Add the TRES public key to the authorized keys of the account above. TRES provides the key.
  • Allow TRES's IP addresses through your firewall to your SFTP port. TRES provides the list. Make sure TRES has a contact on your side to notify if the addresses change.
  • Tell TRES when you finish, so TRES can run a test delivery.

Option 3: Your Amazon S3 bucket

TRES uploads reports to a bucket in your AWS account. TRES never receives long-lived access keys. Instead, TRES assumes a role that you create and control, and you can revoke access at any time by changing or deleting that role.

What TRES needs from you

  • Bucket name and AWS region: The destination bucket.
  • Identity and Access Management (IAM) role Amazon Resource Name (ARN): The role TRES assumes to write to the bucket.
  • External ID (recommended): A shared secret that protects the role from being assumed by an unintended party. Send it through the secure channel TRES Support agrees with you, not by plain email or chat.
  • Object key pattern (optional): The folder structure and file name inside the bucket. It can include the report name, report type, file extension, and the delivery date and time, e.g. tres/<report name>/<YYYY>/<MM>/<DD>/<report name>.<extension>. Without a pattern, TRES names objects <report name>_<YYYY-MM-DDTHHMMSSZ>.<extension>.

What the role needs

Create a role in AWS. For setup steps, see the AWS IAM documentation. The role needs the following:

  • Permissions: s3:PutObject on arn:aws:s3:::<BUCKET>/<PREFIX>/*. If your bucket is encrypted with a customer-managed AWS Key Management Service (KMS) key, the role also needs permission to use that key.
  • Trust policy: Allow the TRES AWS principal, which TRES provides, to assume the role. If you use an external ID, require it in the condition:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "<TRES_PRINCIPAL_ARN>" },
      "Action": "sts:AssumeRole",
      "Condition": { "StringEquals": { "sts:ExternalId": "<YOUR_EXTERNAL_ID>" } }
    }
  ]
}

TRES does not need permission to read, list, or delete anything in your bucket.

Get started

  1. Contact TRES Support, using Contact Us in the dashboard or your Customer Success contact. Tell TRES which option you want and which reports to deliver.
  2. Send the information listed for your option.
  3. TRES configures the destination and runs a test delivery with you.
  4. When the destination is active, select it in the Export Destination section as you create a recurring report. For Amazon S3, TRES sets up the recurring report with you.

Security and changes

Never send private keys or passwords. TRES asks for public keys, source IP addresses, host name, port, username, remote folder, bucket name and AWS region, IAM role ARN, External ID, and the optional file name pattern, object key pattern, and separate folders.

To change a key, IP range, host, bucket, or role, contact TRES Support. If you rotate a key, send the new public key before you remove the old one to avoid a gap in delivery.

If a delivery does not arrive, contact TRES Support.

Related articles

Powered by Zendesk