Migrate from AWS VPC to Quake AI

AWS VPC exposes more networking primitives than the other major cloud providers, so it has the largest gap to bridge when migrating to Quake AI. The core shift: AWS layers subnets, an Internet Gateway, NAT Gateways, route tables, and NACLs into a multi-component stack. On Quake AI, the Network service (OpenStack Neutron) composes three objects: a network, a subnet, and a router. The router replaces both the Internet Gateway and NAT Gateway in a single resource.

Service mapping#

Prerequisites#

• A Quake AI account with application credentials
• The OpenStack CLI installed and configured
• An inventory of your AWS VPC resources: subnets, security groups, NACLs, Elastic IPs, load balancers, and Route 53 zones
• An SSH key pair imported to Quake AI (run openstack keypair create with --public-key)

Topology mapping#

The AWS public-subnet/IGW/NACL stack collapses into a single Neutron router with an external gateway. NACLs are dropped entirely. Security groups map closely.

Set up the Neutron equivalent#

Create the network, subnet, and router that replace your VPC stack:

openstack network create MY_NETWORK

openstack subnet create MY_SUBNET \
  --network MY_NETWORK \
  --subnet-range 10.0.0.0/24 \
  --gateway 10.0.0.1 \
  --dns-nameserver 8.8.8.8

openstack router create MY_ROUTER
openstack router set MY_ROUTER --external-gateway PublicStatic
openstack router add subnet MY_ROUTER MY_SUBNET

This single router replaces your Internet Gateway (inbound through floating IPs), NAT Gateway (outbound through SNAT), and route tables (default route through the router).

Security rule translation#

AWS has two firewall layers: Security Groups (stateful, allow-only, per-ENI) and NACLs (stateless, allow+deny, per-subnet). Neutron has one layer: Security Groups (stateful, allow-only, per-port).

Translating NACLs#

NACLs have no Neutron equivalent. For most deployments, the migration approach is:

1. Convert NACL allow rules to security group rules. Any traffic your NACLs explicitly allowed that your security groups do not already cover needs a new SG rule.
2. Drop NACL deny rules. Neutron's default deny-all ingress achieves the same effect. If a NACL denied traffic that a broad SG allow rule would permit (e.g., deny 10.0.0.0/8 within a 0.0.0.0/0 allow), split the SG allow into specific non-overlapping CIDRs.
3. Accept single-layer security. Neutron security groups are functionally comparable to AWS SGs. The NACL layer is an AWS-specific defense-in-depth measure that many deployments do not rely on.

3-tier app example#

AWS source:

• NACL on public subnet: allow HTTP/HTTPS from internet, deny RFC 1918
• web-sg: inbound TCP 80, 443 from 0.0.0.0/0
• app-sg: inbound TCP 8080 from web-sg
• db-sg: inbound TCP 5432 from app-sg

Neutron target:

openstack security group create MY_SG_WEB
openstack security group rule create MY_SG_WEB \
  --protocol tcp --dst-port 80 --remote-ip 0.0.0.0/0 --ingress
openstack security group rule create MY_SG_WEB \
  --protocol tcp --dst-port 443 --remote-ip 0.0.0.0/0 --ingress

openstack security group create MY_SG_APP
openstack security group rule create MY_SG_APP \
  --protocol tcp --dst-port 8080 --remote-group MY_SG_WEB --ingress

openstack security group create MY_SG_DB
openstack security group rule create MY_SG_DB \
  --protocol tcp --dst-port 5432 --remote-group MY_SG_APP --ingress

You drop the NACLs. The NACL that denied RFC 1918 to the public subnet is unnecessary because Neutron does not route non-addressed traffic to your instances. You replace the NACL that denied port 3389/RDP from the internet by omitting an allow rule for port 3389 on MY_SG_WEB.

Load balancer migration#

Replace an AWS load balancer with a reverse proxy that you operate, or with an external edge service.

Assign a floating IP to the proxy instance and keep application instances on a private network. Configure health checks and backend pools in the proxy. Install certificates on the proxy with Certbot or let Caddy manage ACME issuance and renewal.

Floating IP setup#

Allocate and associate a floating IP:

openstack floating ip create PublicStatic
openstack server add floating ip MY_INSTANCE FLOATING_IP_ADDRESS

DNS cutover#

Quake AI has no managed DNS service. Route 53 must be replaced by an external provider (Cloudflare, NS1, self-hosted BIND).

1. Lower TTLs: 24-48 hours before cutover, reduce all record TTLs to 60-300 seconds. The NS record TTL (typically 172,800 seconds) must be reduced first; wait the full TTL period before continuing.
2. Export records: Use the AWS Console or CLI to export the hosted zone.
3. Translate alias records: Route 53 alias records (A records pointing to ELB, CloudFront) have no standard DNS equivalent. Create standard A or CNAME records that point to the reverse proxy floating IP or external edge hostname.
4. Import at new provider: Most DNS providers accept BIND zone file imports or Terraform configuration.
5. Validate: dig @NEW_NAMESERVER example.com A
6. Update registrar NS records: This step completes the cutover. DNS propagation takes up to 48 hours globally.
7. Monitor for 48 hours: Keep the Route 53 zone active during monitoring; rollback by reverting registrar NS records.
8. Restore TTLs: Raise TTLs to 3600-86400 after successful cutover.

Validation checklist#

After completing the migration, verify:

• Neutron network, subnet, and router are operational (openstack router show MY_ROUTER)
• Security group rules match your AWS SG rules (compare rule counts and port/CIDR combinations)
• NACL intent is covered by security group rules (no implicit allow gaps)
• Floating IPs are associated with the correct instance ports
• Reverse proxy health checks pass for application backends
• TLS termination works on the reverse proxy or external edge
• DNS records resolve to the correct Quake AI floating IP or external edge hostname
• Applications respond correctly through the full network path
• Egress traffic routes through the router (test outbound connectivity from instances)

Provider-specific gotchas#

See also#

• Migrating from AWS to Quake AI: full cross-service migration hub
• Coming from AWS: concept translation reference
• Migrate from EC2 to Quake AI Compute: compute workload migration
• Network migration guides: all provider guides
• Edge reverse proxy template: deploy a self-managed traffic entry point