1# Code Migration Phase
2 
3Migrate AWS Lambda function code to Azure Functions.
4 
5## Prerequisites
6 
7- Assessment report completed
8- Azure Functions extension installed in VS Code
9- Best practices loaded via `mcp_azure_mcp_get_azure_bestpractices` tool
10 
11## Rules
12 
13- If runtime is Python or Node.js: **do NOT create function.json files**
14- If runtime is .NET (in-process or isolated) or Java: **do NOT hand-author function.json** — bindings metadata is generated from attributes/annotations at build time
15- Use extension bundle version `[4.*, 5.0.0)` in host.json
16- Use latest programming model (v4 for JavaScript, v2 for Python)
17- **Always use bindings and triggers instead of SDKs** — For blob read/write, use `input.storageBlob()` / `output.storageBlob()` with `extraInputs`/`extraOutputs`. For queues, use `app.storageQueue()` or `app.serviceBusQueue()`. Only use SDK when there is no equivalent binding (e.g., Azure AI, custom HTTP calls)
18- **Always use the latest supported language runtime** — Consult [supported languages](https://learn.microsoft.com/en-us/azure/azure-functions/supported-languages) and select the newest GA version. Do NOT default to an older LTS version when a newer version is available on Azure Functions.
19 
20## Steps
21 
221. **Install Azure Functions Extension** — Ensure VS Code extension is installed
232. **Load Best Practices** — Use `mcp_azure_mcp_get_azure_bestpractices` tool for code generation guidance
243. **Create Project Structure** — Set up the Azure Functions project inside the output directory (`<workspace-root-basename>-azure/`). Do NOT create files inside the original AWS directory
254. **Migrate Functions** — Convert each Lambda function to Azure Functions equivalent
265. **Update Dependencies** — Replace AWS SDKs with Azure SDKs in package.json / requirements.txt
276. **Configure Bindings** — Set up triggers and bindings inline (v4 JS / v2 Python)
287. **Configure Environment** — Map Lambda env vars to Azure Functions app settings
298. **Add Error Handling** — Ensure proper error handling in all functions
30 
31## Key Configuration Files
32 
33### host.json
34 
35```json
36{
37  "version": "2.0",
38  "extensionBundle": {
39    "id": "Microsoft.Azure.Functions.ExtensionBundle",
40    "version": "[4.*, 5.0.0)"
41  },
42  "extensions": {
43    "queues": {
44      "maxPollingInterval": "00:00:02",
45      "visibilityTimeout": "00:00:30",
46      "batchSize": 1,
47      "maxDequeueCount": 5
48    }
49  },
50  "logging": {
51    "applicationInsights": {
52      "samplingSettings": {
53        "isEnabled": true,
54        "excludedTypes": "Request"
55      }
56    }
57  }
58}
59```
60 
61## Critical Infrastructure Dependencies
62 
63### Blob Trigger with EventGrid Source — Additional Requirements
64 
65When migrating S3 event triggers to Azure blob triggers with `source: 'EventGrid'`, the following infrastructure must be configured **at the IaC level** (not code level). Failure to set these up results in silent trigger failures.
66 
67| Requirement | Why | Consequence of Missing |
68|------------|-----|----------------------|
69| **Queue endpoint** (`AzureWebJobsStorage__queueServiceUri`) | Blob extension uses queues internally for poison-message tracking with EventGrid source | Function fails to index: "Unable to find matching constructor...QueueServiceClient" |
70| **Always-ready instances** (Flex Consumption only) | Blob trigger group must be running to register the Event Grid webhook | Trigger group never starts → webhook never registered → events never delivered |
71| **Event Grid subscription via Bicep/ARM** | CLI-based webhook validation handshake times out on Flex Consumption | Use `listKeys()` in Bicep to obtain the `blobs_extension` system key at deployment time |
72| **Storage Queue Data Contributor** RBAC | Identity-based queue access for poison messages | 403 errors during blob trigger indexing |
73 
74See [lambda-to-functions.md](lambda-to-functions.md#flex-consumption--blob-trigger-with-eventgrid-source) for Bicep patterns.
75 
76### UAMI Credential Pattern
77 
78When using User Assigned Managed Identity (UAMI), `DefaultAzureCredential()` without arguments tries System Assigned first and fails. Always pass the client ID:
79 
80```javascript
81const credential = new DefaultAzureCredential({
82  managedIdentityClientId: process.env.AZURE_CLIENT_ID
83});
84```
85 
86Add `AZURE_CLIENT_ID` as an app setting in Bicep pointing to the UAMI client ID.
87 
88### azd init Workaround for Non-Empty Directories
89 
90`azd init --template <template>` refuses to run in a non-empty directory. Use a temp-directory approach:
91 
921. `azd init --template <template>` in an empty temp directory
932. Copy IaC files (`infra/`, `azure.yaml`, etc.) into the project root
943. Clean up the temp directory
95 
96### package.json (JavaScript)
97 
98```json
99{
100  "dependencies": {
101    "@azure/functions": "^4.0.0",
102    "@azure/identity": "<latest>"
103  },
104  "devDependencies": {
105    "@azure/functions-core-tools": "^4",
106    "jest": "<latest>"
107  }
108}
109```
110 
111## Runtime-Specific Trigger & Binding Patterns
112 
113Load the appropriate runtime reference for the target language:
114 
115| Runtime | Reference |
116|---------|----------|
117| JavaScript (Node.js v4) | [runtimes/javascript.md](runtimes/javascript.md) |
118| TypeScript (v4) | [runtimes/typescript.md](runtimes/typescript.md) |
119| Python (v2) | [runtimes/python.md](runtimes/python.md) |
120| C# (Isolated Worker) | [runtimes/csharp.md](runtimes/csharp.md) |
121| Java | [runtimes/java.md](runtimes/java.md) |
122| PowerShell | [runtimes/powershell.md](runtimes/powershell.md) |
123 
124## Scenario-Specific Guidance
125 
126See [lambda-to-functions.md](lambda-to-functions.md) for detailed trigger mapping, code patterns, and examples.
127 
128## Handoff to azure-prepare
129 
130After code migration is complete:
131 
1321. Update `migration-status.md` — mark Code Migration as ✅ Complete
1332. Invoke **azure-prepare** — pass the assessment report context so it can:
134   - Use the service mapping as requirements input (skips manual gather-requirements)
135   - Generate IaC (Bicep/Terraform) for the mapped Azure services
136   - Create `azure.yaml` and `.azure/preparation-manifest.md`
137   - Apply security hardening
1383. azure-prepare will then chain to **azure-validate** → **azure-deploy**
139