Migrate from AWS to Azion

A project on AWS spreads across CloudFront distributions, Lambda functions, API Gateway routes, S3 buckets, DynamoDB tables, RDS databases, WAF rules, Route 53 zones, and CloudWatch. Over time, each one gains its own cache behaviors, dependencies, access policies, capacity settings, health checks, and alarms. Moving the project means recreating each of these on Azion, then confirming that the project answers correctly before DNS changes.

On Azion, an application and its rules take over delivery, routing, and cache, and Connectors reach the origins. Functions runs the Lambda code. KV Store, Object Storage, and SQL Database hold the data. Firewall filters traffic, a workload serves the domain, and Edge DNS answers for the zone. Real-Time Metrics, Real-Time Events, and Data Stream show what happens to each request.

Each stage of this guide moves one layer, in the order a migration runs: inventory, deployment, code and rules, data, security, monitoring, and DNS. Lambda code moves with focused changes: the handler shape, the runtime language, and how the code opens storage and calls a model. When near-zero downtime is not a requirement, migrate in phases with maintenance windows. Writes stop during each step, so the data needs no parallel synchronization.

The prerequisites and the procedures on this page switch with the interface you select:

Prerequisites

• An Azion account. To open one, sign up in Azion Console. For more information, refer to Create an account.
• The AWS account, with access to its distributions, functions, data stores, and hosted zones.
• Access to the DNS records or the registrar of each domain you move.
• curl and dig, to check responses and DNS answers.

Inventory the AWS account

Do not start with the most complex application in the portfolio. Pick a project that matters enough to test the whole path and is small enough to move quickly. A good first project has a CloudFront distribution, a few Lambda functions, an S3 bucket, and perhaps a DynamoDB table. Use it to document the process and the patterns your team reuses. Then move more cache behaviors, functions, data, observability, and security rules, in the same order. Keep the first deployment small, and prove that it builds and runs on Azion before you move domains, storage, or databases.

Before you create anything on Azion, list what the project uses:

• SAM templates, CDK apps, and CloudFormation stacks, with their build and deploy commands.
• Environment variables and secrets, from the Lambda configuration, AWS Secrets Manager, Systems Manager Parameter Store, Elastic Beanstalk environment properties, CodePipeline and CodeBuild settings, and the source code.
• Lambda functions, their runtimes, triggers, and event sources.
• API Gateway APIs, their routes, authorizers, stages, and usage plans.
• Step Functions state machines and EventBridge rules.
• CloudFront distributions: origins, cache behaviors, cache and origin request policies, response headers policies, CloudFront Functions, and Lambda@Edge triggers.
• Load balancers and their target groups.
• Image transformations and Bedrock calls.
• S3 buckets, DynamoDB tables, RDS and Aurora databases, and ElastiCache clusters.
• Route 53 hosted zones, records, routing policies, DNSSEC, and ACM certificates.
• WAF web ACLs, managed rule groups, IP sets, rate-based rules, Bot Control, Shield settings, and GuardDuty, Inspector, and Security Hub findings.
• CloudWatch dashboards, alarms, log groups, metric filters, X-Ray traces, Firehose streams, and RUM monitors.

Each item in the list maps to a stage of this guide. The table in Map each AWS product to Azion names the destination of each one.

Map each AWS product to Azion

Every AWS product in the inventory has a destination on Azion. Find the product in the first column, then move it with the stage that names its destination. A dash (-) in the last column means that Azion has no direct equivalent.

Azion holds a SOC 2 Type 2 report and a SOC 3 report, and is a PCI DSS 4.0.1 Level 1 Service Provider. For the attestations, refer to SOC 2 and SOC 3 and PCI DSS certification.

Deploy the project on Azion

On Azion, a project becomes an application, and a workload serves that application on a domain. AWS keeps the build and infrastructure in template.yaml for SAM or cdk.json for CDK. Azion keeps them in azion.config.js, which can also be azion.config.mjs or azion.config.cjs, depending on the preset.

azion logs cells and azion logs http return the logs of the last 5 minutes, and --tail keeps printing new ones. azion rollback takes the --connector-id of the storage connector that delivers the site. For the flags, refer to azion logs and azion rollback.

Azion Console imports a repository with one of six presets, and the Azion CLI asks for the preset in a picker. Neither detects the framework for you.

The deployment answers on a workload domain that Azion assigns under map.azionedge.net. Before you move any production domain, send a request to the root path, with that domain in place of <your-workload-domain>:

The response carries the status, the headers, and the body the project returns for /. Send the same request to each critical route. A build that passes can still behave differently at run time, so compare the responses with the ones AWS returns.

If the build fails on Azion, compare the preset with the framework of the project, and check build.preset, build.entry, and build.bundler in azion.config.js. The build block has no command field.

Move environment variables

Environment variables hold API keys, database credentials, authentication secrets, service endpoints, feature flags, and per-environment settings. A variable that does not reach Azion breaks the project at run time, even when the deployment succeeds.

On AWS, a Lambda function reads a variable from process.env, and secrets often live in AWS Secrets Manager or Parameter Store. On Azion, variables belong to the account, up to 100 of them, and a function reads them with Azion.env.get(). Each variable has a key, a value, and a flag that marks it as a secret.

Then change the code that reads the variables. A value fetched from Secrets Manager becomes a variable read:

Code that reads process.env.API_KEY keeps working on a deployed function, because Azion Runtime supports process.env for Node.js compatibility. Under azion dev, a function reads the project .env file instead of the account variables, or the whole shell environment when there is no .env file. A key that does not exist returns undefined, not an error. If a function reads a variable as undefined, confirm that the variable exists on the account.

Move Lambda functions to Functions

Lambda functions often carry the most critical logic of a project: authentication, personalization, API orchestration, and integrations with third-party services. On Azion, this code runs in Functions. A function holds the JavaScript code, a function instance runs it on an application, and a rule decides which requests reach it.

A Lambda function written in Java, Python, or another runtime has to be rewritten in JavaScript. Framework builds can also produce WebAssembly. A function makes at most 50 outbound fetch() calls in one invocation. For every limit, refer to Functions limits.

The handler receives a standard Request and returns a Response. Read the body, the query string, and the path from the request instead of from the event:

env is an empty object on a deployed function, and ctx carries args and waitUntil. The Lambda context and the API Gateway request context move to request.metadata:

request_id holds the same value as the x-azion-request-id response header. geoip_city and geoip_region hold codes. Under azion dev, request.metadata is undefined, so test code that reads it on a deployed function. For every field, refer to Metadata.

Map CloudFront triggers to rule phases

An application processes each request in two phases. The Request Phase handles what the user sent, and the Response Phase handles what the application sends back. Lambda@Edge triggers map to those phases:

A JavaScript function runs in the Request Phase. For the Response Phase, the Console function instance form states Only Lua functions can be used in the Response phase. Move response logic to Response Phase behaviors, such as Add Request Header, which adds a response header in that phase.

Code that reads KV, SQL, or a model also changes its calls. The stages on KV Store, SQL Database, and AI Inference show the new calls. For the runtime APIs, refer to Web APIs.

Route API Gateway paths to functions

API Gateway routes each method and path to a backend, with authorizers, throttling, and stages around it. On Azion, a rule of the application matches the method and the path, and its Run Function behavior runs a function instance. Run Function requires Application Accelerator and Functions on the application.

A function becomes reachable in three steps: create the function, create an instance of it on the application, and create the rule.

New rules can take a few minutes to propagate. On an unexpected response, wait and retry before diagnosing.

To route each method and path to its own function, create one function and one instance per route, as the previous procedure shows. Then give each route its own rule. A rule that matches a method joins ${request_method} to the path criterion with and:

Send each object to the request rules of the application, as the API panel shows. These two rules replace the API Gateway routes GET /users/{id} and POST /users. Add a rule of the same shape for PUT /users/{id} and DELETE /users/{id}. To declare the same functions, instances, and rules as code, refer to azion.config.js.

Move an authorizer to a firewall function

A Lambda authorizer returns an IAM policy that allows or denies the call:

On Azion, a function on a firewall decides before the application runs. Every function on a firewall must end with a finishing outcome: event.continue() lets the request proceed, and event.deny() answers 403 Forbidden. This function lets through only requests that carry the expected bearer token:

Put the verification your authorizer performs, such as a JWT check, in place of the comparison. A request without a valid token receives 403. To answer 401 instead, call event.respondWith(new Response('Unauthorized', { status: 401 })).

The function needs the firewall execution environment: execution_environment in the API, or --execution-environment in the Azion CLI. A firewall with the Functions module runs it through an instance and a rule with Run Function. For the steps, refer to Functions for Firewall and Functions instances.

Replace Step Functions and EventBridge

Azion has no workflow orchestration service and no event bus. A Step Functions workflow becomes code that calls each step in sequence inside one function. An EventBridge rule becomes a function route that the producer of the event calls over HTTP.

This Step Functions definition validates an order, charges it, and fulfills it, with a failure branch:

The same flow runs as one function. Each step is a function call, and the catch block takes the failure branch:

A workflow that waits for hours, or that must survive a failed invocation, does not fit in one invocation. Keep its state in KV Store or SQL Database, and let each call advance one step.

An EventBridge rule matches events by source, type, and content:

On Azion, the producer posts the events to a function route, and the function applies the pattern:

The function answers OK after it handles every event in the batch. Data Stream cannot replace the bus: it sends only Azion’s own logs, from Activity History, Applications, Functions, and WAF Events.

Recreate CloudFront distributions

A CloudFront distribution holds the origins, the cache behaviors, the certificate, and the domains in one resource. On Azion, a connector holds each origin, an application holds the rules and the cache, and a workload holds the domains and the certificate.

A new application has Cache and Functions on, and Application Accelerator and Image Processor off. A rule with Set Connector sends the requests it matches to a connector. When several matching rules carry Set Connector, only the last one runs, so keep a per-path rule after the catch-all rule.

A connector change reaches Azion’s infrastructure in several minutes, with no new deployment. To serve a bucket prefix with a one-day cache and send /api/ to a function with no cache, the distribution takes these resources:

• A connector of type storage with the bucket and the prefix, such as assets/. The build refuses a storage connector without prefix.
• A cache setting with a browser TTL of 3,600 seconds, a cache TTL of 86,400 seconds, stale cache on, Tiered Cache off, and no variation by cookie or query string.
• A request rule on ${uri} starts with / with Set Connector and Set Cache Policy.
• A request rule on ${uri} starts with /api/ with Bypass Cache and Run Function.

bypass_cache and run_function require Application Accelerator. Bypass Cache leaves the browser cache and Tiered Cache unchanged. To declare these resources as code, refer to azion.config.js.

To add the security headers or the CORS headers of a response headers policy, create a Response Phase rule with add_response_header. Its value takes the form Name: value, such as Access-Control-Allow-Origin: https://example.com or Access-Control-Allow-Methods: GET, POST. The rule adds nothing to a 404 that Azion generates with no origin.

CloudFront origin access control keeps an S3 origin private. On Azion, Origin Shield on an http connector does the same with Origin IP ACL and HMAC. HMAC signs each request with aws4_hmac_sha256, a region, a service, and a key pair. For a bucket in your Azion account, use a storage connector instead.

Recreate cache settings

On Azion, a cache setting holds how long a response stays in cache and what makes two requests share one cached copy. A rule with Set Cache Policy applies the setting to the requests it matches. The rule selects a setting, and the setting holds the TTL and the cache key.

Map each CloudFront managed cache policy to a setting or a behavior:

Max Age defaults to 60 seconds. A value below 60 requires Application Accelerator, and a cache setting with Tiered Cache on needs at least 3 seconds and Override cache behavior. Stale cache honors the stale-while-revalidate the origin sends, or keeps a 300-second window under Override cache behavior. It is on by default in Azion Console and off in the API and the CLI.

To vary the cache by query string, cookie, or device, use the Cache vary by controls of the cache setting: Cache vary by Query String, Cache vary by Cookies, and Cache vary by Devices. They require Application Accelerator on the application. In azion.config.js, a cache setting that varies only by the version and lang parameters carries cacheByQueryString: { option: 'allowlist', list: ['version', 'lang'] }. The options are ignore, all, allowlist, and denylist. For the controls, refer to Cache variation.

A CloudFront invalidation names a distribution and paths:

On Azion, purge is a top-level endpoint, not nested under an application. A wildcard purge takes one expression, so each path pattern is its own request:

Send a second request with https://example.com/css/*. A URL purge, at /v4/workspace/purge/url, takes up to 50 items. Only a cache key purge, at /v4/workspace/purge/cachekey, reaches Tiered Cache with "layer": "tiered_cache". A URL or wildcard purge with that layer fails with 30001. A purge takes time to propagate, and it appears in the purge history when it is complete. To check a purged object, request it with curl -I and read the response headers. For the purge types, refer to Real-Time Purge.

Balance traffic across origins

On Azion, Load Balancer is a module of a connector, not a separate resource. One connector of type http holds every origin as an address, up to 15 addresses with Load Balancer on, and one address without it. A rule with Set Connector sends the requests of the application to the connector.

An ALB target group becomes one connector. Its health check path, interval, and healthy and unhealthy thresholds have no equivalent field.

Each address has a Weight from 1 to 100, which sets its share of the traffic. IP Hash refuses Backup addresses, with 28005 in the API. Max Retries takes 0 to 20, Connection Timeout 1 to 300 seconds, and Read/Write Timeout 1 to 600 seconds. These fields exist only with Load Balancer on. When you turn it on in Azion Console, the form fills in Round Robin, 3, 30, and 60. The API defaults are 0, 60, and 120.

A connector without Load Balancer has no configurable timeout. If an origin times out, check the address and its ports, and turn on Load Balancer to set the timeouts. For the connector fields, refer to Connector settings.

Serve optimized images

On AWS, image transformations usually need Lambda@Edge or a custom origin. Image Processor resizes, crops, converts, and filters images on request, with no code. It stores nothing: it reads the source image from the origin of the application, which can be an Object Storage bucket behind a connector.

Image Processor works in two steps: turn on the module on the application, then create a rule with the Optimize Images behavior. A request that no such rule matches is delivered unprocessed.

Image Processor reads the transformation from the ims query parameter:

Image Processor converts to WebP when the Accept header of the client allows it. AVIF needs ?ims=filters:format(avif) and a client that accepts image/avif. To cache one copy for each ims value, turn on Application Accelerator and vary the cache by query string. For every parameter, refer to URL parameters.

Move Bedrock to AI Inference

AI Inference runs a catalog of open-source models: large language models, vision language models, an embedding model, and a reranker. A model is not an object you create, and Azion hosts no inference endpoint for it. A function calls a model by its ID with Azion.AI.run(), and needs no credential.

A Bedrock call names a model and sends a provider-specific body:

On Azion, the function passes the model ID and a chat body:

answer holds the text of the reply. Fields such as max_tokens and temperature shape the output. Under azion dev, Azion.AI is undefined, so test the call on a deployed function. For the request fields, refer to Model invocation and the AI runtime API.

For an OpenAI-compatible /v1/chat/completions endpoint, deploy the AI Inference Starter Kit template. It creates an application and a function that serve that endpoint. To deploy it, access Azion Console > Create, select the template, and select Deploy. The Azion CLI has no template flag.

Move DynamoDB key-value data to KV Store

DynamoDB serves key-value and document data. Key lookups, sessions, feature flags, and configuration move to KV Store. Queries with filters, secondary indexes, aggregations, and joins move to SQL Database, in the stage Move DynamoDB queries and RDS databases to SQL Database.

DynamoDB global tables resolve conflicts with last writer wins and charge for each replicated write. KV Store has no Region to choose: a write applies where it arrives, and other parts of the infrastructure converge within 60 seconds.

A function opens a namespace with Azion.KV.open(), a runtime global that needs no import line:

put serializes an object to JSON, and get with 'json' parses it back. Azion.KV.open() is the only entry point, and it is asynchronous. The namespace must exist first, or open() throws NotFound. get() returns null for a missing key, the same as for an expired one.

KV Store has no bulk import, and no API, CLI command, or Console screen reads or writes keys. To move the data:

1. Export the table from AWS:

   Shell

   01aws dynamodb export-table-to-point-in-time \

   02 --table-name Users \

   03 --s3-bucket my-export-bucket \

   04 --export-format DYNAMODB_JSON

2. Transform each item into a key and a value.

3. Create the namespace with a POST request to https://api.azion.com/v4/workspace/kv/namespaces, with {"name": "my-namespace"}. The name takes 3 to 63 characters, is case-sensitive, and is permanent: a namespace cannot be renamed or deleted. For the fields and the errors, refer to Namespaces.

4. Write the keys from a deployed function with kv.put().

The function writes a key at most once per second. A value takes up to 25 MB, a key up to 512 bytes, and the metadata up to 1,024 bytes. Map each DynamoDB TTL to the expiration option, in Unix seconds, or to expirationTtl, in seconds with a minimum of 60. A write becomes visible everywhere within 60 seconds, or within the cacheTtl of the read. Before the import, review the key prefixes, the value formats, and the code that handles a missing key. For the client, refer to KV Store runtime API.

Replace ElastiCache

ElastiCache keeps data in memory, behind Redis or Memcached. On Azion, HTTP responses stay in Cache, and the values a function reads and writes move to KV Store.

put refuses a Map, a Set, a WeakMap, a WeakSet, a RegExp, and a SharedArrayBuffer with INVALID_VALUE_TYPE. Convert them to arrays first.

Redis commands become KV Store calls:

delete resolves whether or not the key existed. For HTTP caching, refer to Recreate cache settings and to Cache settings.

Move S3 buckets to Object Storage

Object Storage holds images, documents, static assets, media, uploads, and generated files. It speaks the S3 protocol, so S3 tools and SDKs reach it with a new endpoint, a region, and a key pair.

The key pair comes from an Object Storage credential. The secret_key comes back only in the create response, so store it then. To migrate, the credential needs at least listBuckets, listFiles, and writeFiles, plus listAllBucketNames to list the buckets. deleteFiles requires writeFiles.

A Node.js migration script reaches Object Storage with the AWS SDK. Only the region, the endpoint, and the keys change:

Create the destination bucket before you copy, in Azion Console, the API, or the CLI. S3 tools cannot create or remove a bucket on Azion: s3cmd mb and s3cmd rb are refused with 403 AccessDenied. A bucket name takes 6 to 63 characters, is unique across all accounts, and cannot start with azion.

To copy the data with s3cmd:

1. Run s3cmd --configure -c ~/.s3cfg-azion, and enter these values:

   • Access Key and Secret Key: the key pair of the credential.
   • Default Region: us-east-005.
   • S3 Endpoint: s3.us-east-005.azionstorage.net.
   • DNS-style bucket+hostname
     template: %(bucket).s3.us-east-005.azionstorage.net.
   • Use HTTPS protocol: true.

2. Configure a second file, ~/.s3cfg-aws, with the keys of the AWS account. One s3cmd configuration holds one endpoint.

3. Download the S3 objects:

   s3cmd -c ~/.s3cfg-aws sync s3://aws-bucket/ ./export/

4. Upload them to Azion:

   s3cmd -c ~/.s3cfg-azion sync ./export/ s3://azion-bucket/

The objects are in the Azion bucket. To check, list them with s3cmd -c ~/.s3cfg-azion ls s3://azion-bucket/. s3cmd ls with no bucket lists every bucket, which needs listAllBucketNames. s3cmd put file.png s3://my-bucket/ uploads an object, and s3cmd get s3://my-bucket/file.png downloads one.

The AWS CLI reaches Azion through a profile and --endpoint-url. One command reaches one endpoint, so the copy also goes through a local folder:

In aws configure, enter the Azion access key, the secret key, and us-east-005 as the region. The last command uploads the folder to the Azion bucket.

rclone holds one remote for each provider, so it copies from S3 to Azion in one command. Create the remotes with rclone config:

• aws-s3: storage s3, provider AWS, and env_auth set to true.
• azion: storage s3, provider Other, endpoint https://s3.us-east-005.azionstorage.net, and acl set to private.

Then sync:

--progress prints the transfer as it runs. Azion Console refuses a single upload over 300 MB. The API and S3 tools are not bound by that limit. Before the move, map the buckets, the object prefixes, the public and private assets, the access patterns, and the signed URL logic. Bucket access to workloads is read_only, read_write, or restricted, and a credential works independently of it. For the S3 operations, refer to S3 compatibility and Use S3-compatible tools.

Serve a bucket through an application

Public delivery goes through a connector and an application, not through the S3 endpoint. A connector of type storage reads a bucket of your account, narrowed to a prefix.

For the buckets and their objects, refer to Create and modify a bucket, Upload and download objects, Use a bucket as origin, and the Storage library.

Move DynamoDB queries and RDS databases to SQL Database

SQL Database uses the SQLite dialect and is fully ACID-compliant. One main instance takes every write, and read replicas answer reads. SQL Database is in Preview on every plan.

A function reads the database through a read-only replica connection. Azion.Sql is a global, and the azion:sql import fails the build. A query parameter must be a number: a JavaScript string is refused with TypeError: unknown variant `String` . Write a text value as a literal in the SQL instead: