This works because you are using PKI and are. On the Advanced tab of the WINSCP specify the sudo -s command to run the server as su. In the Logon Type dropdown, choose Key File. In the Host text box, enter or paste your instance’s public IP address.

In the Protocol dropdown, choose SFTP SSH File Transfer Protocol. Make sure to copy the entire content, starting with ssh-rsa and ending with the email address you entered at step 5. Copy to the clipboard the contents of the text box Public key for pasting into OpenSSH authorizedkeys file. Find the location of the sftp server, you will enter this into WINSCP later. Choose New site, then give your site a name. Click the Save private key button and save the private key with the name id-rsa.ppk in the same folder. It does this in conjunction with the username and password supplied via the Credentials setting, using the password in the Credentials as the passphrase for the private key. Test connecting with WINSCP using the SFTP protocol using the bitnami (low priviledge user) and your private key. If you supply values for both SFTP Public Key File and SFTP Private Key File, the adapter attempts key pair authentication. 'Once you indicate you are using SFTP, you can then configure the SFTPPublicKeyFile and SFTPPrivateKeyFile settings. Settings for the FTP Inbound Adapter > SSL Config

The need for both keys is intrinsic to SFTP and is not Caché specific. If you just have 1 or the other configured, your service will attempt username authentication instead.

To be clear, SFTP 'private key authentication' is really key pair authentication, meaning you need both a private and public key configured.

Filezilla sftp private keys create