Migrate from AWS to Azion

A platform migration usually begins long before the first configuration file is changed. It starts when a team notices that its current environment no longer gives the same level of clarity, speed, or control it once did.

For teams using AWS, this moment often comes after years of accumulated complexity: CloudFront distributions with layered cache behaviors, Lambda functions with runtime dependencies, S3 buckets with evolving access policies, DynamoDB tables with provisioned capacity, Route 53 zones with health checks, WAF rules with managed rule groups, and CloudWatch alarms with custom metrics. Each service works, but together they create operational overhead that slows development.

For teams currently using Amazon CloudFront, AWS Lambda, Amazon S3, Amazon DynamoDB, Amazon Route 53, AWS WAF, AWS Shield, Amazon CloudWatch, or other AWS services, Azion provides equivalent capabilities through Applications, Functions, Object Storage, KV Store, Edge DNS, Web Application Firewall, DDoS Protection, Real-Time Metrics, and Real-Time Events.

The strongest reason to migrate is not simply to replace one vendor with another. It is to consolidate compute, storage, database, delivery, security, and observability into a unified platform designed for globally distributed applications.

How AWS to Azion Migration Works

Traditional platform migrations often require rewriting application logic, reconfiguring infrastructure from scratch, and managing multiple disconnected services. This approach creates operational risk, extends timelines, and fragments team knowledge across different configuration patterns.

The Azion migration approach preserves your application logic while transitioning to a unified platform:

1. Incremental migration path. Start with a single project, validate each layer independently, and expand with confidence. No need to migrate everything at once.

2. Preserved application logic. Functions, cache policies, origin configurations, and data services map directly to Azion equivalents with minimal code changes—primarily syntax updates for environment access and service imports.

3. Unified platform model. Instead of managing compute, storage, databases, security, and observability as disconnected layers, Azion brings these capabilities together with consistent APIs and configuration patterns.

Feature Mapping

The following tables provide a comprehensive mapping of AWS products to their Azion equivalents. A dash (-) indicates that Azion does not currently offer a direct equivalent.

Migration Strategy

The migration is organized around Azion’s four product categories, allowing teams to plan and execute each layer independently:

• Build: deploy applications, configure builds and environment variables, migrate Lambda functions, CloudFront behaviors, routing, headers, load balancing, cache, image optimization, and AI workloads.
• Secure: migrate custom domains, Route 53 DNS, SSL/TLS certificates, WAF rules, DDoS protection, bot management, and rate limiting.
• Store: migrate S3 objects, DynamoDB tables, and Aurora databases to Object Storage, KV Store, and SQL Database.
• Observe: migrate CloudWatch metrics, logs, and alarms to Azion’s real-time observability stack.

Build

The Build category covers application deployment, compute, routing, and configuration. Start here to bring your application onto Azion and establish the foundation for the rest of the migration.

1. Project Setup on Azion

The first step brings your application into Azion in a way that feels familiar to teams that deploy modern web projects on AWS. If you have used AWS CloudFormation, SAM, or CDK, you already understand the pattern: define infrastructure as code, configure build settings, deploy the output, and validate the generated URL.

Azion follows a similar workflow but with a broader platform context. Your project becomes part of an environment where application delivery, Functions, rules, security, and observability can be managed together.

Key Differences

Connect Your Repository

1. Open Azion Console.
2. Click + Create > Import from GitHub.
3. Authorize the Azion GitHub App.
4. Select the repository you want to migrate.

Configure Your Build

Azion auto-detects your framework and configures build settings. Override the detected preset in azion.config.js:

import { defineConfig } from 'azion'

export default defineConfig({
name: 'my-project',
preset: 'nextjs', // Override auto-detection if needed
})

Deploy and Verify

Deploy from the Azion Console or CLI. Your temporary Azion URL follows this pattern:

https://xxxxxxxxxx.map.azionedge.net/

Validate the deployment:

curl https://xxxxxxxxxx.map.azionedge.net/

Reference documentation

• Applications
• Applications first steps
• Azion CLI overview
• Import an existing project from GitHub

2. Converting Build Configuration

A migration can appear successful when the build passes but fail later when runtime behavior differs. Review build and deployment configuration carefully instead of treating it as a mechanical command replacement.

CLI Quick Reference

Build Configuration Comparison

Reference documentation

• Azion CLI overview
• azion.config.js reference
• azion deploy command

3. Migrating Environment Variables

Environment variables contain API keys, database credentials, authentication secrets, service endpoints, feature flags, and environment-specific configuration. Migrating them incorrectly causes runtime failures even when deployment succeeds.

Key Differences

Evaluate Your Variables

Before changing code, identify every variable in:

• AWS Lambda: Environment variables in function configuration
• AWS Secrets Manager: Secret values and rotation policies
• Systems Manager Parameter Store: Parameters and paths
• Elastic Beanstalk: Environment properties
• CI/CD environment settings (CodePipeline, CodeBuild)
• Runtime configuration in source code

Create Variables in Azion

curl -X POST 'https://api.azionapi.net/variables' --header 'Accept: application/json; version=3' --header 'Authorization: Token [TOKEN VALUE]' --header 'Content-Type: application/json' --data '{
"key": "key-test",
"value": "value-test"
}'

Update Your Code

// Before: AWS Lambda / Node.js
const apiKey = process.env.API_KEY;
const dbHost = process.env.DB_HOST;

// Before: AWS with Secrets Manager (async)
const { SecretsManager } = require('@aws-sdk/client-secrets-manager');
const client = new SecretsManager();
const secret = await client.getSecretValue({ SecretId: 'my-secret' });
const secretValue = JSON.parse(secret.SecretString);

// After: Azion
const apiKey = Azion.env.get('API_KEY');
const dbHost = Azion.env.get('DB_HOST');

Reference documentation

• Environment Variables
• Working with variables
• Azion runtime environment variables reference

4. Migrating CloudFront to Applications

CloudFront distributions deliver content from edge locations with caching and origin configuration. Azion Applications provide similar capabilities with integrated Rules Engine for request/response manipulation.

Key Differences

Configuration Steps

curl -X POST 'https://api.azionapi.net/v4/workspace/applications' --header 'Authorization: Token YOUR_TOKEN' --header 'Content-Type: application/json' --data '{
  "name": "my-app",
  "origins": [
    {
      "name": "origin-main",
      "addresses": [
        {
          "address": "origin.example.com",
          "weight": 1
        }
      ]
    }
  ],
  "cache_settings": {
    "default_ttl": 3600
  }
}'

Distribution Configuration Migration

// CloudFront distribution config (CloudFormation YAML converted to Azion JS)
import { defineConfig } from 'azion'

export default defineConfig({
name: 'my-distribution',
applications: [{
  name: 'main-app',
  origins: [{
    name: 's3-origin',
    type: 'object_storage',
    addresses: [{
      address: 'my-bucket.azionedge.net',
      weight: 1
    }]
  }],
  cache: {
    ttl: 86400,
    staleWhileRevalidate: 300
  },
  rules: {
    request: [{
      name: 'API Routes',
      criteria: [{
        variable: 'uri',
        operator: 'starts_with',
        argument: '/api/'
      }],
      behavior: {
        bypassCache: true,
        runFunction: 'api-handler'
      }
    }]
  }
}]
})

Origin Request vs Viewer Request

In CloudFront, Lambda@Edge functions trigger at different points. Azion maps these to Rules Engine phases:

Reference documentation

• Applications
• Applications Main Settings
• Rules Engine for Applications
• Connectors

5. Migrating API Gateway to Applications + Functions

API Gateway provides REST and HTTP API management with authorizers, throttling, and stage management. Azion Applications combined with Functions deliver similar capabilities with distributed execution.

Key Differences

Configuration Steps

# Create a Function
curl -X POST 'https://api.azionapi.net/v4/workspace/functions' --header 'Authorization: Token YOUR_TOKEN' --header 'Content-Type: application/json' --data '{
  "name": "api-handler",
  "code": "export default { async fetch(request) { return new Response(JSON.stringify({ message: "Hello" }), { headers: { "Content-Type": "application/json" } }); } }"
}'

# Create Application with routing rules
curl -X POST 'https://api.azionapi.net/v4/workspace/applications' --header 'Authorization: Token YOUR_TOKEN' --header 'Content-Type: application/json' --data '{
  "name": "api-gateway",
  "rules": {
    "request": [{
      "name": "API Route",
      "criteria": [{ "variable": "uri", "operator": "starts_with", "argument": "/api/" }],
      "behavior": { "runFunction": "api-handler" }
    }]
  }
}'

API Gateway Authorizer Migration

// Before: AWS Lambda Authorizer
exports.handler = async (event) => {
const token = event.authorizationToken;
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET);
  return {
    principalId: decoded.sub,
    policyDocument: {
      Version: '2012-10-17',
      Statement: [{
        Action: 'execute-api:Invoke',
        Effect: 'Allow',
        Resource: event.methodArn
      }]
    }
  };
} catch (err) {
  throw new Error('Unauthorized');
}
};

// After: Azion Function for Authorization
export default {
async fetch(request) {
  const authHeader = request.headers.get('Authorization');
  if (!authHeader) {
    return new Response('Unauthorized', { status: 401 });
  }

  const token = authHeader.replace('Bearer ', '');
  try {
    const secret = Azion.env.get('JWT_SECRET');
    const decoded = await verifyJWT(token, secret);

    // Store user info in request metadata for downstream functions
    request.metadata['user_id'] = decoded.sub;
    return request; // Continue to next handler
  } catch (err) {
    return new Response('Unauthorized', { status: 401 });
  }
}
};

Route Migration Example

// API Gateway routes → Azion Rules Engine

// Before: API Gateway resource paths
// GET /users/{id}
// POST /users
// PUT /users/{id}
// DELETE /users/{id}

// After: Azion Rules Engine configuration
import { defineConfig } from 'azion'

export default defineConfig({
applications: [{
  name: 'api-app',
  rules: {
    request: [
      {
        name: 'GET /users/:id',
        criteria: [
          { variable: 'uri', operator: 'matches_regex', argument: '^/users/([0-9]+)$' },
          { variable: 'request_method', operator: 'equals', argument: 'GET' }
        ],
        behavior: { runFunction: 'get-user' }
      },
      {
        name: 'POST /users',
        criteria: [
          { variable: 'uri', operator: 'equals', argument: '/users' },
          { variable: 'request_method', operator: 'equals', argument: 'POST' }
        ],
        behavior: { runFunction: 'create-user' }
      }
    ]
  }
}]
})

Reference documentation

• Functions
• Functions Instances
• Rules Engine for Applications

6. Migrating Lambda to Functions

Functions are the computational engine of modern distributed applications. They often contain the most business-critical logic: authentication, personalization, API orchestration, and integrations with third-party systems.

Key Differences

Update Function Signature

// Before: AWS Lambda
exports.handler = async (event) => {
const body = JSON.parse(event.body);
const pathParams = event.pathParameters;
const queryParams = event.queryStringParameters;

// Process request
return {
  statusCode: 200,
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ message: 'Hello', data: body })
};
};

// After: Azion Functions
export default {
async fetch(request) {
  const body = await request.json();
  const url = new URL(request.url);
  const queryParams = Object.fromEntries(url.searchParams);

  // Process request
  return new Response(JSON.stringify({ message: 'Hello', data: body }), {
    status: 200,
    headers: { 'Content-Type': 'application/json' }
  });
}
};

Event Context Migration

// Before: AWS Lambda event context
exports.handler = async (event, context) => {
const requestId = context.awsRequestId;
const functionName = context.functionName;
const remainingTime = context.getRemainingTimeInMillis();

// Request metadata from API Gateway
const sourceIp = event.requestContext.identity.sourceIp;
const userAgent = event.requestContext.identity.userAgent;
const country = event.headers['CloudFront-Viewer-Country'];

return { statusCode: 200, body: 'OK' };
};

// After: Azion Functions
export default {
async fetch(request, env, ctx) {
  // Request metadata
  const requestId = request.headers.get('x-request-id');
  const userAgent = request.headers.get('user-agent');
  const country = request.metadata['geoip_country_code'];
  const city = request.metadata['geoip_city'];

  // Geo metadata available directly
  const region = request.metadata['geoip_region'];

  return new Response('OK', { status: 200 });
}
};

Environment Variables Migration

// Before: AWS Lambda
const dbUrl = process.env.DATABASE_URL;
const apiKey = process.env.API_KEY;

// After: Azion Functions
const dbUrl = Azion.env.get('DATABASE_URL');
const apiKey = Azion.env.get('API_KEY');

Cold Start Comparison

AWS Lambda cold starts vary significantly based on runtime, memory allocation, and VPC configuration. Azion Functions minimize cold starts through distributed node placement:

Reference documentation

• Functions
• Functions Instances
• Runtime APIs
• JavaScript Runtime APIs reference

7. Migrating Load Balancing (ALB/NLB to Load Balancer)

Load balancing distributes traffic across multiple origins for high availability and performance. Azion Load Balancer provides health checks, steering policies, and origin failover at the distributed infrastructure.

Key Differences

Configuration Steps

# Create a Connector with multiple addresses for load balancing
curl -X POST 'https://api.azionapi.net/v4/workspace/connectors' --header 'Authorization: Token YOUR_TOKEN' --header 'Content-Type: application/json' --data '{
  "name": "Origin-Pool-US",
  "type": "http",
  "attributes": {
    "addresses": [
      {
        "address": "us-east-origin1.example.com",
        "active": true,
        "modules": {
          "load_balancer": {
            "weight": 3,
            "method": "round_robin"
          }
        }
      },
      {
        "address": "us-east-origin2.example.com",
        "active": true,
        "modules": {
          "load_balancer": {
            "weight": 1,
            "method": "round_robin"
          }
        }
      }
    ]
  }
}'

Load Balancer Module Configuration

// Load balancer settings within Connector address modules
{
"weight": 3,                    // Relative weight for weighted distribution
"method": "round_robin",        // Options: "round_robin", "least_conn", "ip_hash"
"max_retries": 3,               // Maximum retry attempts on failure
"connection_timeout": 10,       // Connection timeout in seconds
"read_write_timeout": 30        // Read/write timeout in seconds
}

ALB Target Group Migration

Reference documentation

• Load Balancer
• Connectors
• Application Main Settings

8. Migrating Cache Configuration

Caching configuration determines how content is stored and served from node locations. Azion Cache provides fine-grained control with Tiered Cache support for improved hit ratios.

Key Differences

CloudFront Cache Policies to Azion Cache Settings

Configuration Steps

# Update cache settings for an application
curl -X PATCH 'https://api.azion.com/v4/workspace/applications/{application_id}/cache_settings/{cache_setting_id}' --header 'Authorization: Token YOUR_TOKEN' --header 'Content-Type: application/json' --data '{
  "name": "my-cache-setting",
  "browser_cache": {
    "ttl": 3600
  },
  "modules": {
    "cache": {
      "ttl": 86400
    },
    "tiered_cache": {
      "enabled": true
    }
  }
}'

Cache Key Customization

In CloudFront, cache keys are defined by cache policies. In Azion, use Advanced Cache Key in Cache Settings:

Example: Vary cache by query strings

// In Cache Settings
{
"name": "api-cache",
"cache_key": {
  "query_string": {
    "include_all": false,
    "include": ["version", "lang"]
  }
}
}

CloudFront Invalidation to Azion Purge

# Before: AWS CloudFront invalidation
aws cloudfront create-invalidation --distribution-id E123456789ABCD --paths "/images/*" "/css/*"

# After: Azion cache purge
curl -X POST 'https://api.azion.com/v4/workspace/purge/wildcard' --header 'Authorization: Token YOUR_TOKEN' --header 'Content-Type: application/json' --data '{
  "items": [
    "https://example.com/images/*",
    "https://example.com/css/*"
  ],
  "layer": "cache"
}'

Reference documentation

• Cache
• Cache Settings
• Tiered Cache
• Real-Time Purge

9. Migrating Image Optimization

Image optimization reduces image file sizes while maintaining visual quality. Azion Image Processor transforms, optimizes, and delivers images from the distributed locations with automatic format selection.

Key Differences

URL Format Comparison

# AWS CloudFront (requires Lambda@Edge or custom origin)
# Typically custom URL structure:
https://d12345.cloudfront.net/images/photo.jpg?w=400&q=80

# Azion Image Processor
https://example.com/images/photo.jpg?ims=400x400

Transformation Parameters

Azion Image Processor uses the ims query parameter for transformations:

Configuration Steps

# Enable Image Processor within application modules
curl -X PATCH 'https://api.azionapi.net/v4/workspace/applications/{application_id}' --header 'Authorization: Token YOUR_TOKEN' --header 'Content-Type: application/json' --data '{
  "modules": {
    "image_processor": {
      "enabled": true
    }
  }
}'

Reference documentation

• Image Processor
• How to process images
• Object Storage

10. Migrating AI Workloads (Bedrock to AI Inference)

AI inference enables low-latency AI-powered features in applications. Azion AI Inference provides GPU-backed inference for text and visual models at the distributed infrastructure.

Key Differences

Configuration Steps

// AI inference in Azion Functions
export default {
async fetch(request) {
  const body = await request.json();

  // Call AI inference endpoint
  const response = await fetch('https://ai-inference.azion.com/v1/predict', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${Azion.env.get('AI_API_KEY')}`
    },
    body: JSON.stringify({
      model: 'text-generation',
      prompt: body.prompt,
      max_tokens: 100
    })
  });

  return response;
}
};

Bedrock to Azion Migration Example

// Before: AWS Bedrock
import { BedrockRuntime } from '@aws-sdk/client-bedrock-runtime';

const client = new BedrockRuntime({ region: 'us-east-1' });

const response = await client.invokeModel({
modelId: 'anthropic.claude-3-sonnet-20240229-v1:0',
contentType: 'application/json',
accept: 'application/json',
body: JSON.stringify({
  anthropic_version: 'bedrock-2023-05-31',
  max_tokens: 1024,
  messages: [{ role: 'user', content: 'Hello, world!' }]
})
});

// After: Azion AI Inference
export default {
async fetch(request) {
  const response = await fetch('https://ai-inference.azion.com/v1/chat/completions', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${Azion.env.get('AI_API_KEY')}`
    },
    body: JSON.stringify({
      model: 'claude-3-sonnet',
      messages: [{ role: 'user', content: 'Hello, world!' }],
      max_tokens: 1024
    })
  });

  return response;
}
};

Reference documentation

• AI Inference
• AI Inference models
• AI Inference Starter Kit

11. Migrating Orchestration (Step Functions, EventBridge)

AWS Step Functions and EventBridge provide workflow orchestration and event routing. Azion achieves similar patterns through Functions chaining and Data Streaming for event-driven architectures.

Key Differences

Step Functions to Functions Chaining

// Before: AWS Step Functions (ASL)
{
"Comment": "Order processing workflow",
"StartAt": "ValidateOrder",
"States": {
  "ValidateOrder": {
    "Type": "Task",
    "Resource": "arn:aws:lambda:us-east-1:123456789:function:validate-order",
    "Next": "ProcessPayment"
  },
  "ProcessPayment": {
    "Type": "Task",
    "Resource": "arn:aws:lambda:us-east-1:123456789:function:process-payment",
    "Catch": [{
      "ErrorEquals": ["PaymentFailed"],
      "Next": "NotifyFailure"
    }],
    "Next": "FulfillOrder"
  },
  "FulfillOrder": {
    "Type": "Task",
    "Resource": "arn:aws:lambda:us-east-1:123456789:function:fulfill-order",
    "End": true
  },
  "NotifyFailure": {
    "Type": "Task",
    "Resource": "arn:aws:lambda:us-east-1:123456789:function:notify-failure",
    "End": true
  }
}
}

// After: Azion Functions (orchestrator pattern)
// orchestrator.js
export default {
async fetch(request) {
  const order = await request.json();

  try {
    // Step 1: Validate
    const validated = await validateOrder(order);

    // Step 2: Process payment
    const payment = await processPayment(validated);

    // Step 3: Fulfill order
    const fulfillment = await fulfillOrder(payment);

    return new Response(JSON.stringify(fulfillment), {
      headers: { 'Content-Type': 'application/json' }
    });
  } catch (error) {
    // Error handling
    await notifyFailure({ order, error: error.message });
    return new Response(JSON.stringify({ error: error.message }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' }
    });
  }
}
};

// Individual function modules
async function validateOrder(order) {
// Validation logic
if (!order.items || order.items.length === 0) {
  throw new Error('Invalid order: no items');
}
return { ...order, validated: true };
}

async function processPayment(order) {
// Payment processing
const response = await fetch('https://payment-api.example.com/charge', {
  method: 'POST',
  body: JSON.stringify({ amount: order.total, currency: 'USD' })
});

if (!response.ok) {
  throw new Error('PaymentFailed');
}

return { ...order, paid: true };
}

async function fulfillOrder(order) {
// Fulfillment logic
return { ...order, fulfilled: true, fulfilledAt: new Date().toISOString() };
}

async function notifyFailure(context) {
// Send failure notification
await fetch('https://notifications.example.com/failure', {
  method: 'POST',
  body: JSON.stringify(context)
});
}

EventBridge to Data Streaming

// Before: AWS EventBridge rule
{
"source": ["com.mycompany.orders"],
"detail-type": ["OrderCreated"],
"detail": {
  "amount": [{ "numeric": [">", 100] }]
}
}

// Target: Lambda function for processing

// After: Azion Data Streaming + Functions
// Configure Data Streaming to send events to your Function endpoint
// Then process in Function:

export default {
async fetch(request) {
  const events = await request.json();

  for (const event of events) {
    if (event.source === 'com.mycompany.orders' &&
        event.type === 'OrderCreated' &&
        event.data.amount > 100) {
      // Process high-value order
      await processHighValueOrder(event.data);
    }
  }

  return new Response('OK');
}
};

Reference documentation

• Functions
• Data Streaming

Secure

The Secure category covers domains, DNS, certificates, firewall rules, and protection against malicious traffic. Plan these migrations as controlled cutovers, since they affect how users reach your application and how it is protected in production.

1. Migrating Custom Domains

Custom domain migration is one of the most sensitive parts of any platform transition. It affects users, SEO, brand trust, and production availability. Plan domain migration as a controlled cutover, not a last-minute DNS change.

Migration Strategies

Create the Certificate

Create your SSL/TLS certificate before pointing your domain to Azion. This ensures users can access the application securely over HTTPS when the domain starts resolving to the new infrastructure.

Azion provides free Let’s Encrypt certificates with automatic renewal.

Configure the Domain

Create a workload in Azion Console and associate your custom domain. See Workloads Documentation.

Point the Domain to Azion

www CNAME xxxxxxxxxx.map.azionedge.net

ns1.aziondns.net
ns2.aziondns.com
ns3.aziondns.org

Verify Propagation

dig www.yourdomain.com CNAME +short

Reference documentation

• Workloads
• Create an Azion custom domain
• Edge DNS
• Certificate Manager

2. Migrating DNS to Edge DNS

DNS configuration is foundational to application delivery. Migrating from Route 53 to Edge DNS requires careful planning to avoid downtime during the nameserver switch.

Key Differences

Migration Steps

# Create a DNS zone
curl -X POST 'https://api.azionapi.net/v4/workspace/dns/zones' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "name": "my-zone",
  "domain": "example.com",
  "active": true
}'

# Add DNS records
curl -X POST 'https://api.azionapi.net/v4/workspace/dns/zones/{zone_id}/records' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "record_type": "A",
  "entry": "www",
  "ttl": 3600,
  "rdata": ["192.168.1.1"]
}'

Record Type Mapping

Routing Policy Migration

DNSSEC Configuration

To enable DNSSEC:

1. Navigate to your zone in Edge DNS.
2. Go to DNSSEC tab.
3. Enable DNSSEC.
4. Copy the DS record to your domain registrar.

# Verify DNSSEC
dig example.com DNSSEC +dnssec

Verify Propagation

# Check nameserver propagation
dig example.com NS +short

# Check specific record
dig www.example.com A +short

# Check from specific DNS server
dig @ns1.aziondns.net example.com A

# Compare Route 53 and Azion records
dig @ns-1234.awsdns-12.com example.com A
dig @ns1.aziondns.net example.com A

Reference documentation

• Edge DNS
• DNSSEC compatibility
• Run the dig command
• Run the traceroute command

3. Migrating SSL/TLS to Certificate Manager

SSL/TLS certificates ensure secure communication between clients and your application. Azion provides automatic certificate provisioning and supports custom certificates from AWS Certificate Manager (ACM).

Key Differences

Automatic Certificate Provisioning

Azion automatically provisions Let’s Encrypt certificates for custom domains:

# Create a workload with TLS configuration
# First, create a certificate via Certificate Manager, then reference it by ID
curl -X POST 'https://api.azionapi.net/v4/workspace/workloads' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "name": "my-workload",
  "domains": ["www.example.com"],
  "tls": {
    "certificate": 12345,
    "minimum_version": "tls12",
    "ciphers": 1
  },
  "active": true,
  "infrastructure": 1
}'

Custom Certificate Upload

For organizations with existing certificates from ACM or external CAs:

# Upload custom certificate
curl -X POST 'https://api.azionapi.net/v4/workspace/tls/certificates' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "name": "my-custom-cert",
  "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
}'

mTLS Configuration

For mutual TLS authentication:

1. Navigate to Certificate Manager.
2. Upload your CA certificate as a Trusted CA.
3. Configure your workload to require client certificates.
4. See the mTLS configuration guide for detailed steps.

Reference documentation

• Certificate Manager
• Firewall Certificate Manager
• Create a digital certificate
• mTLS

4. Migrating WAF to Web Application Firewall

Web Application Firewall protects applications from malicious traffic, SQL injection, cross-site scripting (XSS), and other application-layer attacks. Migrating AWS WAF rules requires careful mapping of rule logic and understanding differences in rule construction.

Key Differences

Migration Steps

# Create a WAF instance
curl -X POST 'https://api.azion.com/v4/workspace/wafs' \
--header 'Accept: application/json' \
--header 'Authorization: Token [TOKEN]' \
--header 'Content-Type: application/json' \
--data '{
  "active": true,
  "name": "My WAF",
  "product_version": "1.0",
  "engine_settings": {
    "engine_version": "2021-Q3",
    "type": "score",
    "attributes": {
      "rulesets": [1],
      "thresholds": [
        { "threat": "sql_injection", "sensitivity": "medium" }
      ]
    }
  }
}'

Rule Migration Example

Convert AWS WAF rule to Azion Rules Engine:

AWS WAF JSON rule:

{
"Name": "BlockAdminAccess",
"Priority": 1,
"Statement": {
  "AndStatement": {
    "Statements": [
      {
        "ByteMatchStatement": {
          "SearchString": "/admin",
          "FieldToMatch": { "UriPath": {} },
          "PositionalConstraint": "CONTAINS"
        }
      },
      {
        "NotStatement": {
          "Statement": {
            "IPSetReferenceStatement": { "IPSet": "allowed-ips" }
          }
        }
      }
    ]
  }
},
"Action": { "Block": {} }
}

Azion criteria:

Variable: ${uri}
Operator: matches
Argument: /admin

AND

Variable: ${remote_addr}
Operator: does not match
Argument: 10.0.0.0/8

AWS Managed Rules to Azion Rulesets Mapping

Reference documentation

• Web Application Firewall
• Rules Engine for Firewall
• Functions for Firewall

5. Migrating DDoS Protection

DDoS protection guards against volumetric attacks, protocol attacks, and application layer attacks. Azion provides automatic DDoS mitigation with no configuration required for most attack types.

Key Differences

Automatic Protection

Azion DDoS Protection activates automatically for all applications. No manual configuration is required for standard protection against:

• Volumetric attacks (UDP floods, ICMP floods)
• Protocol attacks (SYN floods, packet fragmentation)
• Application layer attacks (HTTP floods, slowloris)

Advanced Configuration

For applications requiring specific DDoS policies:

# DDoS protection is configured as a module within Firewall
# Update the Firewall with DDoS module settings
curl -X PATCH 'https://api.azion.com/v4/workspace/firewalls/{firewall_id}' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "modules": {
    "ddos_protection": {
      "enabled": true,
      "sensitivity": "high"
    }
  }
}'

Network Shield

For network-layer protection, use Azion Network Shield:

• Provides L3/L4 DDoS protection
• Works with Edge DNS for traffic filtering
• Integrates with Firewall for unified security

Reference documentation

• DDoS Protection
• DDoS Mitigation
• Network Shield

6. Migrating Bot Management

Bot management protects applications from automated threats while allowing legitimate bots. Azion Bot Manager provides detection, challenge, and mitigation capabilities.

Key Differences

Bot Manager Lite (Marketplace)

For basic bot protection, install Bot Manager Lite from Azion Marketplace:

Custom Bot Rules

Create custom rules to handle specific bots:

Criteria: ${user_agent} contains "BadBot"
Behavior: Deny (403)

Criteria: ${user_agent} contains "Googlebot"
Behavior: Allow

Verification

# Test bot detection
curl -A "BadBot/1.0" https://yourdomain.com/
# Expected: 403 Forbidden or challenge page

curl -A "Mozilla/5.0" https://yourdomain.com/
# Expected: Normal response

Reference documentation

• Bot Manager
• Bot Manager Lite
• Bot Manager Lite integration kit
• Radware Bot Manager

7. Migrating Rate Limiting

Rate limiting protects applications from abuse by limiting request rates per client. Azion provides rate limiting through Firewall rules and Functions.

Key Differences

Firewall-Based Rate Limiting

Configure rate limiting in Firewall Rules Engine:

# Create rate limiting rule
curl -X POST 'https://api.azionapi.net/v4/workspace/firewalls/{firewall_id}/request_rules' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "name": "Rate Limit API",
  "criteria": [[{"variable": "${uri}", "operator": "starts_with", "argument": "/api/"}]],
  "behaviors": [
    {"type": "rate_limit", "attributes": {"rps": 100, "window": 60, "action": "block"}}
  ]
}'

Reference documentation

• Rules Engine for Firewall
• Functions for Firewall
• Functions Instances for Firewall

8. Migrating Security Services

AWS provides multiple security services for threat detection and vulnerability management. Azion offers comparable protection through Firewall and Network Lists.

Key Differences

Network Lists for Threat Intelligence

Azion provides Network Lists that include threat intelligence data:

# Create a custom network list
curl -X POST 'https://api.azionapi.net/v4/workspace/network_lists' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "name": "Blocked IPs",
  "list_type": "ip_cidr",
  "items": ["192.168.1.0/24", "10.0.0.1"]
}'

# Use network list in firewall rule
curl -X POST 'https://api.azionapi.net/v4/workspace/firewalls/{firewall_id}/request_rules' \
--header 'Authorization: Token YOUR_TOKEN' \
--header 'Content-Type: application/json' \
--data '{
  "name": "Block Malicious IPs",
  "criteria": [[{"variable": "${remote_addr}", "operator": "is_in_network_list", "argument": "network_list_id"}]],
  "behaviors": [{"type": "deny", "attributes": {"status_code": 403}}]
}'

Migration Considerations

When migrating from AWS security services:

1. GuardDuty findings: Export findings and create corresponding Firewall rules for IP-based threats.
2. Inspector vulnerabilities: Address application vulnerabilities before migration; Azion WAF provides runtime protection.
3. CloudTrail logs: Configure Real-Time Events for comparable visibility.
4. Security Hub: Use Azion Real-Time Events and external SIEM integration.

Reference documentation

• Network Lists
• Real-Time Events
• Data Streaming

Store

The Store category covers data services. Migrate objects, key-value data, and relational databases with attention to consistency, access patterns, and application compatibility.

1. Migrating S3 to Object Storage

Object storage powers files that matter to users and business operations: images, documents, static assets, media files, uploads, and generated content. Azion Object Storage provides S3-compatible storage with zero data transfer out cost.

Key Differences

Update Configuration

Update your S3 client configuration to use Azion Object Storage:

import { S3Client } from '@aws-sdk/client-s3';

// Before: AWS S3
const s3Client = new S3Client({
region: 'us-east-1',
credentials: {
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY
}
});

// After: Azion Object Storage
const s3Client = new S3Client({
region: 'us-east-005',
endpoint: 'https://s3.us-east-005.azionstorage.net',
credentials: {
  accessKeyId: Azion.env.get('AZION_ACCESS_KEY'),
  secretAccessKey: Azion.env.get('AZION_SECRET_KEY')
}
});