Migrate from Fastly to Azion

A Fastly service collects years of delivery logic: several origins, VCL snippets, conditions, Compute packages, dictionaries, and cache overrides. Around it sit TLS automation, WAF policies, logging endpoints, and inspector dashboards. Moving it means recreating each layer on Azion and confirming the behavior before the domain changes.

On Azion, an application and its rules take over delivery, routing, and cache, and connectors hold the origins. Functions runs the Compute code. KV Store and Object Storage hold the data. Firewall filters traffic, and a workload serves the domain. Real-Time Metrics, Real-Time Events, and Data Stream replace the inspectors and the logging endpoints.

Each stage of this guide moves one layer, in the order a migration runs: inventory, delivery, code and rules, data, security, monitoring, and the domain. Origins, cache policies, redirects, headers, and data access move with focused configuration changes. When near-zero downtime is not a requirement, migrate in phases with maintenance windows. Writes stop during each step, so the data needs no parallel synchronization.

The prerequisites and the procedures on this page switch with the interface you select:

Prerequisites

• An Azion account. To open one, sign up in Azion Console. For more information, refer to Create an account.
• The Fastly account, with access to its services, service versions, Compute packages, data stores, and TLS settings.
• Access to the DNS records or the registrar of each domain you move.
• curl and dig, to check responses and DNS answers.

Inventory the Fastly account

Move one service first, not the most complex one in the account. Pick a service that tests the whole path and still moves quickly. A good first service has one or two domains, a few origins, cache rules, redirects, and headers. It may also have one Compute package and one logging destination. Use it to document the process and find the patterns your team reuses. Then expand: more complex VCL, more Compute services, the stored data, the observability, and the security rules.

Before you create anything on Azion, list what the service uses:

• Active services and their service versions.
• Domains and TLS certificates.
• Origins, shielding, health checks, and failover logic.
• Cache settings, cache keys, stale behavior, and purge workflows.
• Conditions, VCL snippets, custom VCL, and request and response settings.
• Compute packages and their language runtimes, with fastly.toml and the CI/CD settings that deploy them.
• Dictionaries, Config Store data, Secret Store values, and Edge Data Storage.
• Object Storage buckets, image optimization, streaming, WebSocket, and AI Accelerator traffic.
• WAF policies, bot controls, DDoS protections, and rate limits.
• Logging endpoints, inspector dashboards, and the alerts that depend on them.

Each item in the list maps to a stage of this guide. The table in Map each Fastly product to Azion names the destination of each one.

Map each Fastly product to Azion

Every Fastly product in the inventory has a destination on Azion. Find the product in the first column, then move it with the stage that names its destination. A dash (-) in the last column means that Azion has no direct equivalent.

Recreate the service on Azion

On Azion, a Fastly service splits into three resources. A connector holds the origin, an application holds the rules and the cache, and a workload serves the application on its domains.

Both azion logs subcommands return the logs of the last 5 minutes. For their flags, refer to Azion CLI logs.

Deliver an origin through an application

A service that fronts an origin becomes the chain connector, application, rule, and workload. The rule sends every request to the connector with Set Connector.

Deploy a project from its repository

A Compute project or a framework site deploys from its repository. Azion supports 19 frameworks and 5 generic presets. Azion Console imports a repository with one of six presets, and the Azion CLI asks for the preset in a picker.

Check the deployment

The deployment answers on a workload domain that Azion assigns under map.azionedge.net, such as xxxxxxxxxx.map.azionedge.net. Before you move any production domain, send a request to the root path, with that domain in place of <your-workload-domain>:

The response carries the status, the headers, and the body the service returns for /. Send the same request to each critical route, such as a /health endpoint. A first 200 proves little on its own: cache behavior, redirects, headers, and origin routing can still differ from Fastly.

If the build fails on Azion, compare the preset with the framework of the project, and check build.preset, build.entry, and build.bundler in azion.config.js. The build block has no command field.

Move environment variables

Environment variables hold API keys, origin credentials, feature flags, third-party endpoints, and operational settings. A variable that does not reach Azion breaks the service at run time, even when the deployment succeeds.

Look for variables in fastly.toml and the Compute project, the dictionaries and Config Store entries, the Secret Store, the CI/CD settings, and the source code. On Azion, each variable has a key, a value, and a flag that marks it as a secret. Data that changes per request, such as a routing table, fits KV Store better. A value that belongs to one function instance goes in its arguments, which the code reads from ctx.args.

A deployed function reads a variable with Azion.env.get(), and process.env keeps working:

Under azion dev, a function reads the project .env file instead of the account variables, or the whole shell environment when there is no .env file. If a function reports a variable as not found, confirm that the variable exists on the account and that the code reads it with Azion.env.get(). For the instance arguments, refer to Functions instances.

Move Compute services to Functions

Compute services carry request handling, API orchestration, personalization, authentication, and integration logic. On Azion, this code runs in Functions. A function holds the code, a function instance runs it on an application, and a rule decides which requests reach it.

On a deployed function, env is an empty object, and ctx carries args and waitUntil. Azion also runs the Service Worker shape, addEventListener('fetch', ...), but the ES Modules object is the recommended handler:

For a Compute project in another language, azion list presets includes rustwasm for Rust and emscripten for C++. A language with no preset, such as Go, is rewritten in JavaScript. Either way, code that calls Fastly platform APIs changes. Separate the business logic from those calls, and map each area to its Azion API:

For the presets, refer to Azion CLI presets. For the handler shapes, refer to Handlers, and for the runtime APIs, to Web APIs.

Translate VCL and service conditions

Business-critical behavior often lives in VCL snippets, conditions, and request or response settings. Most of it moves to Rules Engine for Applications. Keep Functions for logic that needs code, such as external lookups, signed tokens, or custom algorithms.

Convert each condition on the path to a rule criterion. Move each header that a response setting adds to a Response Phase rule, and each request header normalization to a Request Phase rule. Rebuild the backend selection as one connector per origin, chosen by Set Connector in the rule that matches. In azion.config.js, these behaviors are redirect_to_301, add_request_header, filter_request_header, add_response_header, and set_connector. To keep a path out of cache, add Bypass Cache, bypass_cache, to its rule.

When the application answers differently from the Fastly service, compare the active service version with the rules and the connectors of the application. The usual causes are a rule, a VCL branch, a cache key, or an origin selection that was not mapped. To see which rules run on a request, refer to Debug rules.

Recreate redirects and rewrites

Redirects protect search rankings, campaign links, backlinks, and bookmarks. When a redirect breaks, the result is lost traffic and broken user journeys. Azion keeps redirects in the rules of the application, which you write in Azion Console, the API, or azion.config.js.

A VCL redirect becomes a rule with a criterion, a capture, and a redirect:

The criteria of a rule select the requests, but they capture nothing. To reuse part of the path in the target, add a Capture Match Groups behavior before the redirect, in the same rule. Capture Match Groups requires Application Accelerator on the application. The array is local, so only the rule that captures it can read it.

To check the redirect, request an old path:

The response carries 301 Moved Permanently and a location header that ends in /new/post. A new rule can take a few minutes to propagate. On an unexpected response, wait and retry before diagnosing. If the redirect still fails, test the regular expression and its capture groups against the old paths.

To serve content from another path without a redirect, use Rewrite Request with the same captures. For SEO-sensitive moves, prefer permanent redirects, avoid redirect chains, keep canonical paths consistent, and test the paths with and without a trailing slash.

Recreate custom headers

Headers control caching, security, and browser behavior. On Fastly, VCL and response settings change them. Azion adds them with rules in either phase: Add Request Header changes the request sent to the origin, and Add Response Header changes the response sent to the user.

This azion.config.js adds two security headers to every response of the application:

The value takes the form Name: value, and the Console refuses any other shape with Header must follow the header-name: value format. A workload must serve the application for the headers to reach a domain. Run azion deploy, then check a response:

The response carries x-frame-options: SAMEORIGIN and x-content-type-options: nosniff. A header that depends on logic no rule can express goes in a function.

Recreate cache settings

On Fastly, the cache depends on service settings, VCL, surrogate keys, cache overrides, and the purge APIs. On Azion, a cache setting holds how long a response stays in cache and what makes two requests share one copy. A rule with Set Cache Policy applies the setting to the requests it matches. The rule selects a setting, and the setting holds the TTL and the cache key.

Max Age defaults to 60 seconds. A value below 60 requires Application Accelerator, and a cache setting with Tiered Cache on needs at least 3 seconds and Override cache behavior. Stale cache honors the stale-while-revalidate the origin sends, or keeps a 300-second window under Override cache behavior. It is on by default in Azion Console and off in the API and the CLI.

To vary the cache by query string, cookie, or device, use the Cache vary by controls of the cache setting: Cache vary by Query String, Cache vary by Cookies, and Cache vary by Devices. They require Application Accelerator on the application. Cache vary by Devices with the Allowlist behavior keeps one copy for each device group you select. The groups come from the Device Groups tab of the application. For the controls, refer to Cache variation.

When fewer requests come from cache after the move, compare the cache setting with the Fastly service. Check the Cache vary by controls against the cache keys, Max Age against the TTLs, and Tiered Cache against the shielding.

Azion has no surrogate key purge. Replace a fastly purge with the purge endpoint of its type:

Purge is a top-level endpoint, not nested under applications. A URL purge takes up to 50 items, and a wildcard purge takes one expression. Only a cache key purge, at /v4/workspace/purge/cachekey, reaches Tiered Cache with "layer": "tiered_cache". A URL or wildcard purge with that layer fails with 30001.

The Azion CLI purges the same way:

The command answers Purge carried out successfully. In a script, always pass --urls, --cachekey, or --wildcard: without a flag and without a terminal, the command fails with Error: EOF. For the purge types, refer to Real-Time Purge and azion purge.

Balance traffic across origins

On Azion, Load Balancer is a module of a connector, not a separate resource. One connector of type http holds every origin as an address, up to 15 addresses with Load Balancer on, and one address without it. A rule with Set Connector sends the requests of the application to the connector.

No method steers by location or by measured response time, and there is no cookie affinity: IP Hash maps each client IP address to one address. Each address has a Weight from 1 to 100, which sets its share of the traffic. IP Hash refuses Backup addresses, with 28005 in the API. Max Retries takes 0 to 20, Connection Timeout 1 to 300 seconds, and Read/Write Timeout 1 to 600 seconds. These fields exist only with Load Balancer on. When you turn it on in Azion Console, the form fills in Round Robin, 3, 30, and 60. The API defaults are 0, 60, and 120.

For the connector fields, refer to Connector settings and Connectors.

Serve optimized images

Image Processor resizes, crops, converts, and filters images on request. It stores nothing: it reads the source image from the origin of the application. That origin can be an HTTP server or an Object Storage bucket behind a connector.

Image Processor works in two steps: turn on the module on the application, then create a rule with the Optimize Images behavior. A request that no such rule matches is delivered unprocessed. Image Processor has no default quality or format setting: the URL of each request carries them.

Image Processor reads the transformation from the ims query parameter:

Image Processor converts to WebP when the Accept header of the client allows it. AVIF needs ?ims=filters:format(avif) and a client that accepts image/avif. To cache one copy for each ims value, turn on Application Accelerator and vary the cache by query string. Check representative image URLs on the workload domain before the cutover. For every parameter, refer to URL parameters.

Move streaming, WebSockets, and Fanout

Streaming, Media Shield, WebSocket, and Fanout traffic is bandwidth-heavy or long-lived. Move each one by its traffic model: cacheable media, long-lived connections, or publish-subscribe messaging.

A live stream that Azion ingests reaches it through a connector of type live_ingest. It takes the stream over RTMP and converts it to HLS, and an application delivers it to viewers. For the flow, refer to Ingestion and delivery.

Carry WebSocket connections

WebSocket Proxy and the WebSocket API are available with Business, Enterprise, or Mission-Critical support, or with a Reserved Capacity or Saving Plan contract. To request access, contact Technical Support.

An application with WebSocket Proxy treats every request that carries both upgrade headers as a WebSocket connection, whatever its path:

Before the cutover:

1. Confirm that the client and the origin both support WebSocket natively, and that the origin accepts Upgrade: websocket and Connection: upgrade.
2. Send the upgrade headers only on the requests that open a connection, and keep cache and image rules off those paths.
3. Test an upgrade: a connection that opens returns 101 Switching Protocols. Any other status, even a 2xx or a 3xx, means the upgrade did not complete.
4. Make the client reopen a closed connection. Azion recycles keepalive connections about every 15 minutes, which can close an active WebSocket connection.

The firewall rules can inspect a WebSocket request before the upgrade completes. After the cutover, watch the websocket.connection.accepted, message.sent, and message.received events in Real-Time Metrics and Data Stream.

Serve WebSockets from a function

When a function is the WebSocket server, upgradeWebSocket(request) accepts the upgrade and returns a response and a socket. The runtime also provides helpers that broadcast a message to every connected client, which covers a Fanout pattern:

A request without the upgrade header receives 400 with Expected WebSocket upgrade. Under azion dev, upgradeWebSocket is not defined, so test the function deployed. For the API, refer to WebSocket.

Move AI Accelerator patterns

Fastly AI Accelerator caches and accelerates traffic to generative AI APIs. On Azion, the destination depends on the goal: running inference, controlling traffic, observing it, or caching responses.

A function can keep calling the external AI provider, with the key in an environment variable:

The function returns the answer of the provider to the client. To run the model on Azion instead, call it by its ID with Azion.AI.run(). AI Inference runs a catalog of open-source models, and the call needs no credential:

Under azion dev, Azion.AI is undefined. Test the call on a deployed function. For the request fields, refer to Model invocation and the AI runtime API. For an OpenAI-compatible /v1/chat/completions endpoint on Azion, deploy the AI Inference Starter Kit template from Azion Console > Create.

Move Edge Data Storage to KV Store

KV Store holds configuration, feature flags, personalization, authorization metadata, and lightweight state. Keys live in a namespace. A function opens the namespace with Azion.KV.open(), a runtime global that needs no import line.

Azion.KV.open() is the only entry point, and it is asynchronous. The namespace must exist first, or open() throws NotFound. get() returns the value as text by default, and null for a missing key, the same as for an expired one. It also returns json, arrayBuffer, or stream when the second argument names that type.

KV Store has no bulk import. No Azion Console screen, CLI command, API call, or Terraform resource reads or writes keys. To move the data:

1. Export the keys, the values, the metadata, and the expiration rules from Fastly.

2. Create the namespace through the API:

   Shell

   01curl --request POST \

   02 --url https://api.azion.com/v4/workspace/kv/namespaces \

   03 --header 'Authorization: Token [TOKEN VALUE]' \

   04 --header 'Content-Type: application/json' \

   05 --data '{ "name": "fastly-migration-kv" }'

   The namespace exists, and a function can open it by name. The name takes 3 to 63 characters, is case-sensitive, and is permanent: a namespace cannot be renamed or deleted.

3. Write the keys from a deployed function with kv.put().

The function writes a key at most once per second. A value takes up to 25 MB, a key up to 512 bytes, and the metadata up to 1,024 bytes. Map each expiration to the expiration option, in Unix seconds, or to expirationTtl, in seconds with a minimum of 60. Before the import, keep the key prefixes, and check the value encoding of text, JSON, and binary data. Review the code that handles a missing key. Test the read and write paths before production traffic moves. If keys are missing after the import, export them again, check the namespace name, and check the encoding.

For the namespace operations and their errors, refer to Namespaces. For the client, refer to KV Store runtime API and Manage KV Store with Functions.

Move Fastly Object Storage to Object Storage

Object Storage holds images, documents, static assets, media, uploads, and generated files. It speaks the S3 protocol, so S3 tools and SDKs reach it with a new endpoint, a region, and a key pair.

The key pair comes from an Object Storage credential. Create it in Azion Console or with a POST request to https://api.azion.com/v4/workspace/storage/credentials. The secret_key comes back only in the create response. To migrate, the credential needs at least listBuckets, listFiles, and writeFiles, plus listAllBucketNames to list the buckets. When access is denied, check the key pair and the endpoint first.

A Node.js migration script reaches Object Storage with the AWS SDK:

To copy the data with s3cmd, create the destination bucket first in Azion Console, the API, or the CLI. s3cmd cannot create or remove a bucket on Azion: s3cmd mb and s3cmd rb are refused with 403 AccessDenied. A bucket name takes 6 to 63 characters, is unique across all accounts, and cannot start with azion.

1. Run s3cmd --configure -c ~/.s3cfg-azion, and enter these values:

   • Access Key and Secret Key: the key pair of the credential.
   • Default Region: us-east-005.
   • S3 Endpoint: s3.us-east-005.azionstorage.net.
   • DNS-style bucket+hostname
     template: %(bucket).s3.us-east-005.azionstorage.net.
   • Use HTTPS protocol: true.

2. Configure a second file, ~/.s3cfg-fastly, with the endpoint and the keys of the Fastly bucket. One s3cmd configuration holds one endpoint.

3. Download the Fastly objects:

   s3cmd -c ~/.s3cfg-fastly sync s3://fastly-bucket/ ./export/

4. Upload them to Azion:

   s3cmd -c ~/.s3cfg-azion sync ./export/ s3://azion-bucket/

The objects are in the Azion bucket. To check, list them with s3cmd -c ~/.s3cfg-azion ls s3://azion-bucket/. s3cmd ls with no bucket lists every bucket, which needs listAllBucketNames on the credential. s3cmd sync s3://source-bucket/ s3://dest-bucket/ copies between two buckets of the same provider only. Other commands work the same way: s3cmd put file.png s3://my-bucket/ uploads an object, and s3cmd get s3://my-bucket/file.png downloads one. rclone, the AWS CLI, and other S3 tools also work.

Azion Console refuses a single upload over 300 MB. The API and S3 tools are not bound by that limit. Use the S3 endpoint to manage objects. Serve them to users through an application and a connector, so the traffic gets cache, security, and your domain. Bucket access to workloads is read_only, read_write, or restricted, and a credential works independently of it. For the S3 operations, refer to S3 compatibility and Use S3-compatible tools. For the buckets and their objects, refer to Create and modify a bucket, Upload and download objects, and Use a bucket as origin.

Protect the application with WAF

Web Application Firewall scores requests against eight threat families: cross-site scripting, directory traversal, evading tricks, file upload, identified attack, remote file inclusion, SQL injection, and unwanted access. A WAF rule set holds a sensitivity for each family, and a firewall rule applies it with Set WAF.

mode is required on every Set WAF behavior, and it has no default. Start in Logging to check what the rule set would block, then switch to Blocking. Compare the false positives, the top matched rules, and the exceptions the application needs before you enforce. In Blocking mode, a request the rule set blocks receives 400. To keep a legitimate request from matching, add a WAF exception or use the Tuning tab.

Convert each Fastly WAF rule to firewall criteria. Firewall variables differ from application variables: the path is ${request_uri}, and an address range goes in a Network List matched with ${network}.

The ${network} criterion requires Network Shield on the firewall. For the variables and operators, refer to Rules Engine for Firewall. For the rule set fields, refer to WAF rule sets, and for code on a firewall, to Functions for Firewall.

Rely on DDoS Protection

DDoS Protection is on for every workload, with nothing to create and nothing to configure. It mitigates volumetric, protocol, and application-layer attacks on layers 3, 4, 6, and 7.

A firewall shows the DDoS Protection Unmetered switch in Main Settings > Modules, always on. In the API, modules.ddos_protection is read-only. DDoS Protection has no thresholds, no per-rule switches, and no alerts. For targeted mitigation, write custom rules on the firewall bound to the workload. The Security Response Team is an add-on to Enterprise and Mission-Critical support. For the attack types, refer to Attack mitigation.

Before the cutover, write down the DDoS assumptions, the support processes, and the escalation paths of the Fastly setup. Confirm the workload, the firewall, and its Network Shield configuration, and keep the rollback and escalation procedures ready during the cutover window.

Network Shield is a different module of the firewall. It matches the client address against a Network List of IP addresses, CIDR ranges, ASNs, or countries, through the ${network} criterion. Use it to block or allow sets of clients, restrict countries, or rate-limit a set of clients.

Recreate bot management

Bot Manager scores each request and acts on the score. Bot Manager Lite is the Marketplace function included on every plan, and the full Bot Manager is available on Enterprise.

Bot Manager Lite scores a request with 26 static rules, against a threshold that defaults to 30, and takes the deny action by default. It can also check the client against reputation Network Lists. Tolerance levels belong to the dynamic rules of the full Bot Manager, which Bot Manager Lite does not have.

To set up Bot Manager Lite in Azion Console:

The firewall scores the requests of the workload. For every argument, refer to Install Bot Manager Lite and Bot Manager Lite.

To block a client by its user agent, add a firewall rule:

${header_user_agent} requires the WAF module on the firewall and supports only matches and does not match. The firewall has no allow behavior. To exempt a client such as Googlebot, add a does not match criterion to the deny rule, or order the rules. A client can send any user agent, so verify a good bot another way. To check the rule:

The first response is 403, with the Forbidden error page. The second, with a browser user agent, receives the normal response.

Recreate rate limits

Azion limits request rates in two ways, and each covers a different part of what Fastly Edge Rate Limiting does. Use the native Set Rate Limit behavior of a firewall rule to cap the requests per second or per minute, per client IP address or across all clients. Use the Upstash Rate Limiting integration, a rate limit with penalty run as a firewall function, for custom keys, custom windows, or a penalty period.

Use the native rate limit

A Set Rate Limit behavior counts the requests its rule matches. The criteria of the rule scope the limit, such as the path with ${request_uri}, or the method, which requires WAF on the firewall. Rate Limit Type is Req/s or Req/min, and Limit By is Client IP address or Global. Average Rate Limit takes at least 1, and Maximum Burst Size takes at least 1 and applies to Req/s only. No behavior can follow Set Rate Limit in a rule. A rule whose criteria join several paths with or shares one count across all of them.

A request beyond the rate and the burst receives 429, with the error page titled Too Many Requests. For how the rate and the burst admit requests, refer to Set Rate Limit.

Use the rate limit with penalty

The Upstash Rate Limiting function keeps its counters in an Upstash Global Database. It therefore counts every request across the network, not in each data center. A request during a penalty receives 403 Forbidden. A valid request is counted, and the function returns 429 Too Many Requests when the count reaches the limit.

To set it up in Azion Console:

The function counts the requests the rule matches. These arguments set a sliding window of 2 requests per 20 seconds from midnight to noon UTC, with a 45-second penalty:

The key joins the prefix and every value the arguments select. In this example, it is my_rate_limit + client IP + x-a-custom-header value + hostname, such as my_rate_limit_127.0.0.1_Value_azion.com. For the full setup, refer to Install the Upstash Rate Limiting integration. KV Store also lists rate-limit counters among its uses, for a counter a function keeps itself.

Rebuild monitoring

Azion splits observability across three products. Real-Time Metrics charts aggregates over time, and replaces Domain Inspector and Origin Inspector. Real-Time Events answers queries about individual requests, and replaces Log Explorer & Insights. Data Stream sends the logs to external destinations, and replaces High Volume Logging.

Real-Time Metrics

A metric takes up to 10 minutes to aggregate. Data stays for 2 years, except 90 days for httpBreakdownMetrics and 60 days for botManagerBreakdownMetrics. The interval is 1 minute under 2.5 days, 1 hour up to 60 days, and 1 day beyond.

The Applications dashboards chart:

• Requests: total requests, requests by method and by scheme, and Average Request Time, the average time in seconds Azion takes to process and answer a request.
• Status Codes: the 2XX, 3XX, 4XX, and 5XX responses, and the Requests by Status and Upstream Status table, which tells errors from Azion and errors from the origin apart.
• Data Transferred: saved and missed data and bandwidth, and Edge Offload.
• Cache: Requests Offloaded, Saved Requests, and Missed Requests.

Real-Time Metrics reports no latency, time to first byte, or origin response time. To read the cache status of the requests, filter a dashboard by Upstream Cache Status, whose values include HIT, MISS, STALE, and EXPIRED. To find origin errors, filter by Upstream Status, which is 0 when the origin did not answer.

To open the dashboards, access Azion Console > Real-Time Metrics. It opens on Build > Applications > Data Transferred, over the Last 5 minutes. To narrow a dashboard to one workload, add the Domain or Workload filter. To export a chart, open its More options menu and select Export CSV.

To query the same data, send a GraphQL query to https://api.azion.com/v4/metrics/graphql:

Replace the dates with a range inside the retention period. A range past it returns an empty array. limit takes up to 10,000 rows and defaults to 10. The httpMetrics dataset of older queries still works, but it is deprecated. For every field, refer to Real-Time Metrics GraphQL fields and Real-Time Metrics quickstart. For dashboards in Grafana, refer to Grafana plugin custom dashboards. To read the dashboards, refer to Analyze metrics.

Real-Time Events

A record is queryable up to 30 seconds after the event, and stays for 7 days. For longer retention, use Data Stream. Real-Time Events needs no setup. Its data sources are HTTP Requests, Functions, Functions Console, Image Processor, Tiered Cache, Edge DNS, Data Stream, and Activity History. WAF results are fields of HTTP Requests.

To query the events in Azion Console:

The results table lists the events. Select a row to open the whole record.

To query the same data, send a GraphQL query to https://api.azion.com/v4/events/graphql. The workloadEvents dataset holds the HTTP requests:

Replace the dates with a range inside the last 7 days. upstreamResponseTime and upstreamHeaderTime are raw fields of workloadEvents, and upstreamResponseTime reads - for a response served from cache. For every field, refer to Real-Time Events GraphQL fields and Investigate requests with the GraphQL API. To read a record, refer to Understand Real-Time Events logs.

Data Stream

Records go out in batches of 2,000 or every 60 seconds, delivered within 3 minutes. Retention is set by the destination. A stream sends one data source to one destination:

• Storage: Amazon S3, Azure Blob Storage, and Azion Object Storage, through the S3 type.
• Monitoring: Datadog, Splunk, Elasticsearch, and Azure Monitor.
• Streaming: AWS Kinesis Data Firehose and Apache Kafka.
• Analytics: Google BigQuery.
• Security: IBM QRadar.
• Custom: Standard HTTP/HTTPS POST.

A stream needs exactly one of sampling or a workload filter. Saving an active sampled stream deactivates every other stream on the account. Filtered streams coexist.

When logs do not reach the destination, check the stream status, the destination credentials, and the variables the template selects. For an Object Storage destination, the credential needs listAllBucketNames, listBuckets, listFiles, and writeFiles, or every send fails with 503. For the fields, refer to Stream settings and Data sources and variables. For sampling, refer to Configure sampling.

Prepare the certificate

Certificate Manager holds the certificates that workloads serve. Fastly Platform TLS, TLS Service Options, and Certainly map to it. Prepare the certificate before the domain points to Azion, so users reach the service over HTTPS from the first request.

Azion issues a Let’s Encrypt certificate at no additional cost once you choose a Let’s Encrypt preset. Pick the challenge by where DNS answers:

• HTTP-01 needs the hostname, and every alternative name, to already point to Azion.
• DNS-01 works before the move. At an external DNS provider, add a CNAME from _acme-challenge.<domain> to <domain>.letsencrypt.azion.com. In Edge DNS, the record is automatic.

For a move from Fastly, use DNS-01.

If the certificate does not become active, read its status and status_detail. For HTTP-01, check that the hostname points to Azion. For DNS-01, check the _acme-challenge CNAME. Confirm that the hostname is in the Domains of the workload. Retries continue on schedule, so a fixed record issues the certificate later. For the issuance rules, refer to Issuance and renewal, and for every certificate field, to Certificates.

mTLS needs a Trusted CA certificate, and an Azion-generated certificate cannot be the Trusted CA. Sales activates mTLS on the account. Then set mtls.enabled, mtls.config.certificate, and verification, enforce or permissive, on the workload through the API or azion update workload --file. mTLS works over HTTPS only. For the steps, refer to Configure mTLS on a workload and mTLS.

Point the domain to the workload

The DNS change is the switch: once the domain resolves to the workload, users reach the service through Azion. It affects users, SEO, brand trust, and availability, so treat it as a controlled cutover. Before you switch, confirm that:

• The certificate is active.
• The hostname is in the Domains of the workload.
• The DNS records are ready.
• The critical routes and the redirects answer as expected on the workload domain. To test them under the real hostname before the switch, refer to Test an application through the hosts file.
• Monitoring is ready to watch the traffic after the switch.

Point each name with the record its zone allows:

For the nameserver strategy, create the zone in Edge DNS first, with every record of the current zone. Edge DNS takes 11 record types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NS, PTR, SRV, and TXT. An ANAME aliases the apex to an Azion hostname, and its TTL must be 20. Then set the nameservers of the domain at the registrar to ns1.aziondns.net, ns2.aziondns.com, and ns3.aziondns.org. For the zone and its records, refer to Edge DNS quickstart.

To check a CNAME and the response under the real hostname:

The dig answer is the workload domain, such as xxxxxxxxxx.map.azionedge.net, and curl returns the response of the workload. DNS changes take time to propagate. For the Console settings of the custom domain, refer to Point a domain to a workload. To move the nameservers, refer to Migrate the nameservers to Azion. For the workload settings, refer to Workloads.

Next steps