Azure to AWS: the service mapping, the cutover, and who pays for it.
Most of an Azure to AWS move is mechanical mapping: AKS to EKS, Blob to S3, App Service to ECS, Azure SQL to RDS for SQL Server. The real work is a smaller set: Cosmos DB and Synapse, Entra ID federation, and the networking model. Microsoft offers free egress for customers leaving Azure, so plan the data path and claim it.
- Containers, storage and app hosting map cleanly: AKS to EKS, Blob to S3, App Service to ECS on Fargate, Azure SQL to RDS for SQL Server, Functions to Lambda, Service Bus to SQS and SNS. Cosmos DB to DynamoDB, Synapse to Redshift, Entra ID to IAM Identity Center, and the networking model are where the time goes.
- Azure bills data transfer out ($0.087 per GB after the first free 100 GB a month from North America and Europe), and AWS does not charge for data coming in. Microsoft offers free egress for customers leaving Azure through a documented claim process, so check it before you move large datasets.
- A vetted AWS partner can run the landing zone, the waves and the data cutover. If the migration qualifies, your matched partner can file MAP funding: typically $50K to $150K for startups. Depends on the workload; AWS approves.
IWhy teams move from Azure to AWS, and how to think about it
The usual triggers: an acquirer or parent company standardised on AWS, the team wants AWS strengths in a specific area (Bedrock, EKS, the data stack), or a renewal made a clean AWS landing zone look better. The engineering work is the same either way.
Classify every workload with the 7 Rs. Stateless tiers and containers are rehost or replatform. Managed databases are replatform. Cloud-native services (Functions, Cosmos DB, Service Bus, Synapse) are where you choose between a faithful mapping and a selective refactor. Most teams get off Azure first, then refactor the few services that benefit.
Two early decisions shape the project. The landing zone: a multi-account AWS Organizations layout, a network baseline, guardrails and central logging. Skipping it is the most common regret. And the data path: public internet, a dedicated circuit, or a physical upload through AWS Data Transfer Terminal, plus whether you claim Microsoft's free egress for leaving.
IIAzure to AWS, service by service
"Mechanical" means tooling does most of the work. "Re-engineering" means the data or programming model differs enough that a lift-and-shift fails. The re-engineering items are your critical path.
AKS to EKS (mechanical)
Deployments, Services, ConfigMaps and Helm charts move almost unchanged. The work is at the edges: ingress (Application Gateway to the AWS Load Balancer Controller), storage (Azure Disk and Files CSI to EBS and EFS CSI), identity (AKS workload identity to IRSA or EKS Pod Identity), secrets (Key Vault CSI to Secrets Manager), and the registry (ACR to ECR).
Azure SQL to RDS for SQL Server, or Aurora (replatform)
The lowest-risk path is RDS for SQL Server: same engine, T-SQL and schema intact. Check your source type: AWS DMS lists ongoing replication (CDC) for Azure SQL Managed Instance, not for Azure SQL Database, so a Database source usually means a full load inside a write freeze. Converting to Aurora PostgreSQL with the Schema Conversion Tool drops SQL Server licensing, but stored procedures and T-SQL functions need rework. Many teams land on RDS for SQL Server first and refactor later.
Blob Storage to S3 (mechanical)
Containers become buckets; access tiers become S3 storage classes. AWS DataSync can read Azure Blob directly; azcopy plus the S3 CLI also works. SAS tokens become S3 pre-signed URLs and bucket policies.
Azure Functions to Lambda (replatform)
Function bodies port with modest changes. Azure's declarative input and output bindings have no Lambda equivalent, so they become explicit SDK calls. HTTP triggers go to API Gateway or Function URLs, Blob triggers to S3 events, queue triggers to SQS, timers to EventBridge Scheduler. Durable Functions map to Step Functions, which is a rewrite of the orchestration.
App Service to ECS on Fargate (replatform)
Containerise first if you have not. For a simple web app, Amazon ECS Express Mode creates the Fargate service, load balancer and scaling from one image. (App Runner closed to new customers on April 30, 2026.) For multiple services or finer networking, define ECS services and an ALB yourself. Deployment slots become blue/green deployments; built-in auth becomes Cognito or ALB OIDC.
Cosmos DB to DynamoDB or DocumentDB (re-engineering)
If you used the Mongo API, Amazon DocumentDB is usually the cleaner target. For the core NoSQL API, DynamoDB is the target, but its partition-key, sort-key and index model is different from Cosmos's index-everything default. You remodel the data around access patterns first, then load it.
Service Bus to SQS, SNS or EventBridge (replatform)
Queues map to SQS (FIFO where you relied on sessions or ordering). Topics map to SNS fan-out, or EventBridge for content-based routing. Re-check message size limits, lock and visibility timeouts, and any exactly-once assumptions.
Synapse to Redshift (re-engineering)
Dedicated SQL pools map to Redshift, Synapse Spark to EMR or Glue, serverless SQL to Athena. Translate DDL and T-SQL with the Schema Conversion Tool, then move data via S3 and COPY. Distribution and sort keys need deliberate design; a one-to-one schema port performs badly.
Entra ID to IAM Identity Center (re-engineering)
Keep Entra ID as the identity provider and federate it to AWS IAM Identity Center with SAML 2.0 and SCIM. Map Entra groups to permission sets. Managed identities become IAM roles (IRSA, instance roles, task roles); Entra External ID or B2C becomes Amazon Cognito. Set this up before workloads move.
IIINetworking and identity differences that break go-lives
The service map is the easy model. Go-live incidents come from networking and identity, where Azure and AWS made different choices.
Security model. Azure uses Network Security Groups on subnets or NICs. AWS splits the job: security groups (stateful, the workhorse), network ACLs (stateless, subnet-level), and route tables you manage per subnet. Use security-group references instead of CIDR ranges where you can.
Outbound access. A private AWS subnet has no internet path until you add a NAT gateway and route, which costs hourly plus per GB. Add VPC endpoints for S3, DynamoDB and ECR so internal traffic skips NAT. ExpressRoute becomes Direct Connect, VPN Gateway becomes Site-to-Site VPN, VNet peering becomes VPC peering or Transit Gateway, Private DNS becomes Route 53 private hosted zones.
Workload identity. Azure managed identities are attached to a resource. AWS uses scoped IAM roles assumed through STS, with a stronger least-privilege expectation. Recreating broad Azure permissions as one wide IAM role is the shortcut that fails a real audit.
(1) NACL return traffic: stateless NACLs block ephemeral return ports, so connections open but responses never arrive. (2) No NAT or route: private workloads fail on package pulls and API calls. (3) Security groups deny inbound by default: a service that worked under looser rules goes dark until the rule is added.
IVARM and Bicep to Terraform or CDK: re-author, do not translate
ARM and Bicep describe Azure resource types with no one-to-one AWS shape. A literal conversion produces awkward code.
Use your Bicep as the specification of what exists and how it is wired, then re-express it in Terraform (common when the team knows HCL) or AWS CDK (if the team prefers TypeScript or Python). A typical pattern: the landing zone as modular Terraform with S3 state and locking from day one, then each workload's resources as it migrates. Azure DevOps Pipelines become CodePipeline and CodeBuild, or GitHub Actions with AWS OIDC.
VA phased cutover that keeps the business running
Move in waves, run both clouds in parallel for the data-heavy services, and keep a tested rollback for every wave. Order matters: landing zone first, stateless tiers next, data last.
Assess
Inventory every Azure resource (an Azure Resource Graph export is a good start), map dependencies, classify with the 7 Rs, and cost the target. Note that AWS Migration Hub and Application Discovery Service closed to new customers on November 7, 2025; AWS now points to AWS Transform for discovery and planning.
Mobilize
Build the landing zone: Organizations, accounts, VPCs, Transit Gateway, a Direct Connect or VPN link back to Azure for the parallel run, guardrails, central logging and IAM Identity Center federated to Entra ID. Migrate one representative low-risk workload end to end to prove the tools and the runbook.
Migrate the stateless tiers
Rehost VMs with AWS Application Migration Service (MGN), which replicates continuously so cutover is short. Move containers to EKS or ECS. Shift traffic gradually with Route 53 weighted records and roll back by reverting the weight.
Migrate the data
Stand up the target, seed a full load, and use DMS CDC where the source supports it so the target stays in sync. Cut over in a short window: stop writes on Azure, drain the last changes, switch the connection string, verify. Keep the Azure database read-only as a rollback target for a defined window.
Validate, optimise, decommission
Run the full test suite, watch CloudWatch and cost for a billing cycle, right-size, then shut Azure down. A half-shut-down Azure estate is pure cost.
VIEgress: what leaving Azure costs, and how to avoid it
Azure bills data transfer out; AWS does not bill data coming in. On a data-heavy estate, that shapes both the budget and the schedule.
List price. Azure's bandwidth page (checked October 10, 2026) lists the first 100 GB a month free, then $0.087 per GB for the next 10 TB from North America and Europe, stepping down at higher volumes.
Free egress when leaving. The same page says Azure offers free egress for customers leaving Azure who move data out over the internet to another cloud or on-premises, and links the steps to claim the credit. If you are exiting Azure, follow that process before the big transfer.
Other levers. AWS Data Transfer Terminal for very large datasets or slow links (AWS Snowball Edge is no longer open to new customers); a Direct Connect circuit for predictable throughput during the parallel run; and simply not migrating cold data you are about to archive.
VIIThe gotchas nobody warns you about
These do not show up in the mapping table but each costs teams a day.
- Stateless NACLs: Allow ephemeral return ports explicitly. Azure NSGs are stateful, so this catches everyone once.
- No default outbound: Private subnets need a NAT gateway and route. Add VPC endpoints so AWS-internal traffic skips NAT charges.
- Data moves are remodels: Cosmos DB to DynamoDB needs keys and indexes designed first. Azure SQL to Aurora carries stored-procedure rework the Schema Conversion Tool cannot fully automate.
- Check DMS support for your source: CDC is listed for Azure SQL Managed Instance, not Azure SQL Database. Plan the cutover window accordingly.
- Identity late blocks go-live: Entra ID to IAM Identity Center federation and permission sets must be ready before the first workload account goes live.
- Regions and zones differ: Azure paired Regions and AWS Availability Zones are different availability constructs. Redesign high availability for AWS multi-AZ.
VIIIWho runs the migration, and who can fund it
You can run this in-house. Most teams prefer a partner who has done the Entra federation and the Cosmos remodel before.
CloudRoute does not run migrations. It matches you with one vetted AWS partner who does, chosen for your stack (containers, .NET and SQL Server, data warehouse), Region and timeline.
Partner-filed funding: the AWS Migration Acceleration Program (MAP) helps offset initial migration costs across its Assess, Mobilize and Migrate and Modernize phases, and AWS lists Microsoft workloads among those it supports. Your matched partner files MAP funding when the migration qualifies and AWS approves. For startups this is typically $50K to $150K. Depends on the workload; AWS approves.
AWS Activate: you apply yourself. Activate Founders gives self-funded startups $1,000 to start, up to $5,000. Activate Portfolio gives up to $200,000 with the Org ID from your VC, accelerator or angel group, if it is an Activate Provider. A consulting partner cannot file Activate for you.
| Funding | Who files it | Amount | When it fits |
|---|---|---|---|
| Migration Acceleration Program (MAP) | Your matched AWS partner | $50K to $150K for startups. Depends on the workload; AWS approves. | You are not on AWS yet and want to migrate. |
| Proof of concept (POC) funding | Your matched AWS partner | $50K to $150K for startups. Depends on the workload; AWS approves. | You want to test something, whether or not you are on AWS today. |
| Incremental workload (IW) funding | Your matched AWS partner | $50K to $150K for startups. Depends on the workload; AWS approves. | You are already on AWS and are launching new work: a new AI feature, a new customer or a new contract. |
| AWS Activate Founders | Founder applies | $1,000 to start, up to $5,000 | Self-funded startups with no investor or accelerator behind them. |
| AWS Activate Portfolio | Founder applies | up to $200,000 | Startups backed by a VC firm, accelerator or angel investor that is an AWS Activate Provider. |
| AWS Credits for AI Startups | Invite only (AWS account manager) | $200,000 or more, by invitation | AI startups ready to scale after Activate Portfolio, invited by AWS. |
Azure service to AWS equivalent
The condensed mapping. "Effort" is mechanical, replatform or re-engineer.
| Azure service | AWS equivalent | Primary tool | Effort |
|---|---|---|---|
| AKS | Amazon EKS | Helm, Load Balancer Controller, EBS/EFS CSI, IRSA | Mechanical |
| Azure SQL | RDS for SQL Server, or Aurora PostgreSQL | DMS (CDC for Managed Instance); SCT for Aurora | Replatform to re-engineer |
| Blob Storage | Amazon S3 | DataSync, or azcopy plus S3 CLI | Mechanical |
| Azure Functions | AWS Lambda | Port code; rewrite bindings; Step Functions for Durable | Replatform |
| App Service | ECS on Fargate (ECS Express Mode for simple apps) | Containerise and push to ECR | Replatform |
| Cosmos DB | DynamoDB (NoSQL API) or DocumentDB (Mongo API) | Remodel, then load | Re-engineer |
| Service Bus | SQS, plus SNS or EventBridge for topics | Re-wire producers and consumers | Replatform |
| Synapse Analytics | Redshift (plus EMR or Glue, Athena) | SCT, then S3 and COPY | Re-engineer |
| Entra ID | IAM Identity Center and IAM roles; Cognito for customers | SAML 2.0 and SCIM | Re-engineer |
How a match works (example)
- You tell us about the work
You fill in a short form: what you run today, what you want to move, test or build, your stage and your region.
- We pick one partner
We read your answers and pick one vetted AWS consulting partner that fits the work, the stack and the region. We reply within 24 hours; your matched partner reaches out within 5 business days.
- The partner checks MAP funding
Your matched partner scopes the migration with you. Then it checks whether the move qualifies for MAP (Migration Acceleration Program) funding. MAP is for teams that are not on AWS yet.
- The partner files, AWS decides
If the work qualifies, the partner files the funding request with AWS. AWS reviews it and decides. The amount depends on the workload.
- You pay nothing
CloudRoute is free for startups. Partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding.
AWS Activate credits are separate, and you apply for them yourself. Use Activate Founders if no investor backs you. Use Activate Portfolio with the Org ID or invite from your VC, accelerator, incubator or angel group if it is an Activate Provider. A consulting partner cannot apply for Activate on your behalf.
Common questions
What does Azure egress cost when migrating to AWS?
What is the AWS equivalent of my Azure services?
Can AWS DMS replicate continuously from Azure SQL?
Is Cosmos DB to DynamoDB a straight migration?
How do we handle SQL Server licensing when leaving Azure SQL?
Should we convert ARM or Bicep templates to Terraform automatically?
Can AWS fund an Azure to AWS migration?
Want a vetted partner to run your Azure to AWS migration?
CloudRoute matches you with one vetted AWS partner chosen for your stack and Region. The partner files MAP funding when the migration qualifies and AWS approves. CloudRoute is free for startups; partners pay CloudRoute.