For AWS users
You know AWS. This page translates its vocabulary into Crusoe Agent Platform terms, tells you what will feel familiar, is honest about what AWS has that we don't, and points you at the exact docs pages to migrate each workload.
Terminology map
| In AWS | Here | Notes |
|---|---|---|
| AWS account + AWS Organizations | Organization + projects | A project is your isolated workspace: its own namespace, quota, members, and audit log. |
| IAM user | User account | Email and password. Accounts are created by an admin or an invitation link — ask your administrator; there is no sign-up page. See create an account. |
| IAM policy JSON | Project role: admin or member | There is no policy language. A member uses a project's resources; an admin can also do the irreversible things. Simpler than IAM, and less expressive — both on purpose. |
Access key (AKIA...) | API key (cai_<keyid>_<secret>) | Shown exactly once at creation, revocable instantly, optional expiry. A personal key acts as you and loses access the moment you do. See API keys. |
| IAM role for a workload | Service account | A machine identity that belongs to one project, GCP-style: name@<project-short>.cai.local. Its keys can never mint more credentials. |
| CloudTrail | Per-project audit log | On by default, readable by every project member, no trail to configure. Honest gap: no export or retention settings yet. |
| Service Quotas | Project quotas | A live view of instances, services, CPU, and memory against your project's caps. |
| Lambda function | Function | One file exposing handle(event). Runtimes: Python, Node.js, Go, Ruby. |
Lambda handler lambda_handler(event, context) | def handle(event) in handler.py | The event is the parsed JSON request body. Return a dict; include statusCode to set the HTTP status. |
| API Gateway / Function URL | Nothing — the URL is included | Every function and agent gets https://<name>-<project-short>.apps.codyhill.dev. No separate resource to create or pay for. |
| Lambda cold start | Scale-to-zero cold start | Same physics, documented as an explicit setting rather than folklore. See autoscaling and scale to zero. |
| App Runner / Fargate service | Serverless service | One deploy command; no cluster, task definition, or service triplet. Note: App Runner itself is closed to new AWS customers. |
| Bedrock Agents / AgentCore Runtime | Agent Engine | Upload ADK, LangGraph, or CrewAI code; get a scale-to-zero chat endpoint. There is one agent product here, not a "Classic" and a successor running in parallel. |
| Bedrock action group (OpenAPI schema + Lambda) | A Python function in your agent's tools list | No schema to author, no Lambda to wire. See tools. |
| AgentCore Memory (short-term) | Sessions | Conversation history, stored by the platform and replayed to the model each turn. |
| AgentCore Memory (long-term) / Knowledge Base | Memory + VectorDB | "Memorize" a session to commit it to a searchable memory bank; agents query it with the built-in search_memory tool. |
| AgentCore Code Interpreter | Code Sandbox | One HTTP call, one single-use pod, destroyed after the run. No session lifecycle to manage. |
| AgentCore Gateway | MCP Servers | Publish Python tools as a hosted Model Context Protocol endpoint with immutable versions and rollback. |
| Bedrock Guardrails | No equivalent yet | We do not have a content-safety layer. We would rather tell you that than stretch a mapping. |
| SNS topic / SQS queue / EventBridge bus | Pub/Sub topics and subscriptions | One messaging service covers fan-out and queue-style consumption. AWS ships an official decision guide to pick between its three; here there is nothing to pick. |
| Step Functions state machine (Amazon States Language) | Durable workflow | Written in ordinary code. Branches and loops are language constructs, not JSON states — no ASL casing bugs. |
| Secrets Manager secret | Secret | Write-only key-value pairs injected as environment variables. No rotation Lambda, and honestly: no automatic rotation at all. |
| ElastiCache / MemoryDB | MemoryStore | Redis/Valkey protocol, existing clients work unchanged. One product, not a cache-vs-durable-database pair. |
| OpenSearch Service vector engine (k-NN) | VectorDB | A dedicated vector database with collections and points, not a vector field inside a search engine. |
| CloudWatch Logs | Agent logs | Live tail plus persisted history that survives scale-to-zero. Default retention is 14 days. |
| AWS CLI | platformctl | One binary. See install the CLI. |
What will feel familiar
- Scale-to-zero and cold starts. Idle workloads stop; the next request wakes them. Same mental model as Lambda, applied to agents and containers too.
- The handler contract.
handle(event)receiving a dict and returning a dict is a direct cousin oflambda_handler. - Bearer credentials for machines. A CI pipeline holds a service-account key the way it would hold an access key — created once, revoked instantly. See the CI/CD tutorial.
- An audit trail. Every state change lands in the project audit log, the way CloudTrail records management events — except ours needs no setup.
What is different
Simpler here
- No API Gateway step. Deploying a function is the whole job; the HTTPS URL comes with it.
- No IAM policy authoring. Nothing on this platform requires writing a policy document before your first call. Two roles cover the access model.
- One agent product. No Bedrock-Agents-vs-AgentCore research project before you start. One deploy path: deploy an agent.
- Predictable cost story. AgentCore meters roughly a dozen components separately. This platform has no usage-based metering today — capacity is bounded by visible project quotas. That is an alpha simplification, and we state it as such.
AWS has more
- Global footprint. Dozens of regions and availability zones, formal SLAs, and compliance programs. We have none of those today.
- Model catalog. Bedrock's first-party model catalog is large. Agents here use the platform's OpenAI-compatible inference endpoint, configured by your administrator.
- Event sources. EventBridge integrates SaaS partners and has a content-based rule language. Our functions accept HTTP and CloudEvents; the trigger catalog is much smaller.
- Long-running compute. Lambda MicroVMs offer hours-long stateful sessions. Our agent invokes default to a 60-second timeout.
- Secret rotation. Secrets Manager rotates credentials automatically. Here you rotate by writing a new value, which rolls a new revision.
- Observability. CloudWatch keeps historical metrics; our metrics are live counts only, and logs default to 14-day retention.
- Identity. MFA, SSO federation, fine-grained policies. Here: email plus password and 12-hour sessions.
Try the Lambda muscle memory
If you can write a Lambda handler, you can deploy a function right now. With the CLI installed and signed in:
mkdir hello-http
cat > hello-http/handler.py <<'EOF'
def handle(event):
return {"echo": event.get("message", "")}
EOF
platformctl functions deploy ./hello-http --name hello-http
platformctl invoke hello-http "ping"
You should see:
{"echo":"ping"}
No execution role, no API Gateway, no test-event JSON to build. Full walkthrough: functions quickstart.
Migration pointers
| Moving this from AWS | Start here |
|---|---|
| A Lambda function | Functions quickstart, then runtimes |
| A Bedrock agent (or AgentCore app) | Agent quickstart, then deploy and tools |
| A Knowledge Base / RAG pipeline | VectorDB quickstart and the RAG chatbot tutorial |
| SNS/SQS/EventBridge plumbing | Pub/Sub quickstart, then publish and consume |
| A Step Functions state machine | Run a workflow and the durable agent pipeline tutorial |
| Secrets Manager secrets | Manage secrets, then use in workloads |
| ElastiCache / MemoryDB data | MemoryStore quickstart |
| IAM users, roles, and CI keys | Projects and access and the CI/CD service account tutorial |