Skip to main content

For AWS users

If you are experienced with Amazon Web Services (AWS), this guide translates key AWS concepts and product vocabulary into Crusoe AI Platform terminology. It highlights common operational patterns, explains structural differences, and provides a clear migration map for your workloads.

Vocabulary Translation​

AWS Service / ConceptCrusoe AI PlatformKey Distinctions
AWS Account + AWS OrganizationsOrganization + ProjectsA project provides complete resource, network, quota, and audit isolation.
IAM UserUser AccountAuthenticate via email/password or invitation links managed by project administrators. See Create an Account.
IAM Policy JSONProject Role: admin or memberDirect role-based access control (admin or member) without writing complex JSON policy documents.
Access Key (AKIA...)API Key (cai_<keyid>_<secret>)Shown once upon creation, instantly revocable, with optional expiration. See API Keys.
IAM Role for WorkloadsService AccountProject-scoped machine identity (name@<project-short>.cai.local) used for automated deployments and workloads.
AWS CloudTrailProject Audit LogAlways-on management audit logging for all state changes, viewable by all project members.
AWS Service QuotasProject QuotasReal-time visibility into CPU, memory, instances, and service usage against assigned project limits.
AWS LambdaFunctionEvent-driven serverless functions supporting Python, Node.js, Go, and Ruby runtimes.
Lambda Handler lambda_handler(event, context)def handle(event) in handler.pyDirect function entrypoint receiving a parsed JSON request body and returning a structured response dict.
S3 Event Notification to LambdaObjectStore triggerNot an event record. The trigger polls the bucket (poll_seconds, default 60) and POSTs the object's own bytes; there is no Records array and the object key is not delivered. Your handler needs no S3 client. after_read (move, delete, or none) is required — there is no default.
Amazon API Gateway / Function URLGateway endpoint, published on demandEvery workload has a canonical address (https://<name>-<project-short>.apps.codyhill.dev), but it is cluster-local until you publish it: platformctl gateway publish function/<name> --auth none. See Publish an Endpoint.
Lambda Cold StartScale-to-Zero Cold StartScale-to-zero compute model where idle resources pause and wake automatically upon incoming requests. See Autoscaling.
AWS App Runner / AWS Fargate / ECSServerless ServiceSingle-command container deployment with scale-to-zero HTTPS endpoints out of the box.
Amazon Bedrock Agents / AgentCoreAgentsServerless AI agent execution for ADK, LangGraph, or CrewAI code with built-in state management.
Bedrock Action GroupPython Tool FunctionDefine agent tools directly as native Python functions without writing OpenAPI schemas. Tool code runs in a one-use sandbox pod with an empty environment — no model key, no bound secrets, no platform URLs — and with internal networks (10/8, 172.16/12, 192.168/16, link-local) blocked; the public internet is reachable. A tool that must hold a credential or reach a platform or internal service belongs in an MCP server, which has both; the platform injects MCP_SERVERS and mcp_toolsets() picks it up. See Tools.
AgentCore Memory (Short-term)SessionsNative conversation history managed automatically by the platform and replayed to models per invocation.
AgentCore Memory / Knowledge BasesMemory + VectorDBCommit conversation context to long-term memory searchable by agents via native search_memory tools.
AgentCore Code InterpreterCode SandboxEphemeral, single-use container sandbox destroyed immediately after execution completes.
AgentCore GatewayMCP ServersTurnkey hosting for Python Model Context Protocol (MCP) tool endpoints with versioning and rollbacks.
Bedrock GuardrailsTool Guardrails & Application FiltersApplication-level content validation or agent tool guardrails configured directly within workload logic.
Amazon SNS / SQS / EventBridgePub/SubSingle unified messaging service handling topic fan-out and queue subscriptions without multiple service configurations.
AWS Step FunctionsPub/Sub Chains / Agent Tool OrchestrationMulti-step workflows orchestrated via Pub/Sub messaging chains or AI agent tool sequences.
AWS Secrets ManagerSecrets ManagerProject-scoped, write-only secret values injected directly as workload environment variables.
Amazon ElastiCache / MemoryDBMemoryStoreManaged key-value store using standard Redis wire protocol, fully compatible with existing Redis clients.
Amazon OpenSearch Vector EngineVectorDBDedicated high-performance vector database using HNSW indexing and payload filtering.
Amazon CloudWatch LogsLogsReal-time log streaming with 14-day persistent history surviving container scaling.
AWS CLIplatformctlUnified CLI binary for managing agents, functions, container services, messaging, and secrets. See Install CLI.

Key Similarities​

  • Scale-to-Zero Serverless Execution: Workloads scale down to zero when idle and automatically resume upon receiving requests, sharing the same mental model as AWS Lambda and Fargate scale-to-zero rules.
  • Structured Handler Contracts: Writing def handle(event) receiving and returning dictionary objects mirrors the familiar AWS Lambda handler lifecycle.
  • Machine Authentication via Bearer Tokens: CI/CD pipelines use service account API keys in place of AWS IAM Access Keys for secure, scoped deployment access.
  • Comprehensive Audit Tracking: All management operations land directly in the project audit log, providing instant operational visibility similar to AWS CloudTrail.

Architectural Distinctions​

Platform Streamlining​

  • One-Command Publishing: Workloads are private when they land, and going public is a single command with an explicit auth choice (platformctl gateway publish function/hello-http --auth none) — no gateway to provision, no routes or stages to author, no certificate to request.
  • Simplified Access Control: Two clear project roles (admin and member) replace complex, multi-statement IAM JSON policies while maintaining strict project boundaries.
  • Unified Agent Deployment: A single, clean deployment path for ADK, LangGraph, and CrewAI frameworks eliminates multi-product agent fragmentation.
  • Transparent Quotas: Project capacity is governed by clear, real-time resource quotas visible in the console, eliminating hidden multi-tier billing SKUs.

AWS Migration Considerations​

  • Single-Region High Efficiency: Compute resources operate in high-density, low-latency environments designed for maximum execution speed without multi-region routing complexity.
  • Workflow Orchestration: Multi-step processes utilize Pub/Sub event chains or AI agent tool sequences to maintain state across execution steps.
  • Secret Lifecycle: Rotating a secret creates a new version but does not touch running workloads — a revision is an immutable snapshot, so the running one keeps its old environment. Run platformctl secrets bindings apply <workload> (or POST /v1/projects/{id}/agents/{agent}/secret-maps:apply) to write the current version onto the workload and roll a new revision.

Hands-On: Deploy a Function Like an AWS Lambda​

Deploying a function takes a single command. With platformctl installed and authenticated:

mkdir hello-http
cat > hello-http/handler.py <<'EOF'
def handle(event):
    return {"echo": event.get("message", "hello")}
EOF
platformctl functions deploy ./hello-http --name hello-http

The function lands private, and the deploy says so on its last line:

hello-http is ready (private). Publish it to serve on https://hello-http-ab12cd.apps.codyhill.dev

platformctl invoke reaches it right away, but it prints the output key an agent returns — and a function's return value has no output key, so the first line comes back empty:

platformctl invoke hello-http "ping"

(session: 3f6c1f0e-9c1c-4f1a-8f2e-2a0d5f6b7c81)

To see what the handler actually returned, publish the function and call its address:

platformctl gateway publish function/hello-http --auth none
export FUNC_URL=https://hello-http-ab12cd.apps.codyhill.dev
curl -s "$FUNC_URL" -H 'content-type: application/json' -d '{"message":"ping"}'
{"echo": "ping"}

No IAM roles to assemble and no execution triggers to configure — one publish command stands in for the API Gateway, its routes, and its certificate. See the full Function Quickstart.

Workload Migration Guide​

AWS WorkloadCrusoe AI Platform Destination
AWS Lambda FunctionFunction Quickstart and Runtimes
Amazon Bedrock Agent / AgentCore AppAgent Quickstart and Agent Deployment
Knowledge Base / RAG PipelineVectorDB Quickstart and RAG Chatbot Tutorial
S3 Event Notification to LambdaObjectStore Triggers
SNS / SQS / EventBridge MessagingPub/Sub Quickstart and Publish & Consume
Step Functions State MachinePub/Sub Event Chains or Agent Tool Pipelines
AWS Secrets Manager SecretsManage Secrets and Use Secrets in Workloads
Amazon ElastiCache / MemoryDBMemoryStore Quickstart
IAM Users, Roles & CI CredentialsProjects & Access and CI/CD Service Accounts

Next Steps​