Migrate data using private connections in Azure Storage Mover

Azure Storage Mover supports secure, large-scale data migration across cloud environments, including scenarios that require strict network isolation. Storage Mover can be configured to use private networking constructs to keep data traffic within trusted boundaries. By using Azure Private Link and Private Endpoints, data transfers stay within trusted boundaries between your AWS VPC and Azure virtual network.

This article explains how private connections enable secure migrations between AWS S3 and Azure Storage, and when this approach is appropriate.

Overview

A private connection allows enterprise customers to securely migrate data between Amazon Web Services (AWS) S3 and Azure Storage over private networks, keeping transfers off the public internet. By using Azure Private Link Service (PLS) and Private Endpoints (PE), this solution extends the Virtual Private Cloud (VPC) network into Azure, supports strict security compliance, and helps protect sensitive information.

Prerequisites

Before you begin, ensure that you have the following resources and configurations in place.

Prerequisites for setting up Storage Mover

An understanding of the Azure Storage Mover resource hierarchy.
A Storage Mover resource deployed in your Azure subscription.
Completed the preparation steps from Get started with cloud-to-cloud migration in Azure Storage Mover.
An active Azure subscription with permissions to create and manage Azure Storage Mover and Azure Arc resources.

Prerequisites for creating a private connection

A Private Link Service Direct Connect configured and ready to use.
Familiarity with Azure Private Link networking documentation.

Known limits

The Virtual Private Cloud feature in Azure Storage Mover has the following limits:

A Private Link Service Direct Connect (an IP-based Private Link Service) can't be created directly within Storage Mover. You must establish the Private Link Service before initiating the creation of a private connection.
Review your AWS S3 environment to determine whether it resides behind a Virtual Private Cloud, as this process doesn't validate the public or private status of your S3 bucket.
When configuring your PLS, ensure it accurately maps to the Virtual Private Cloud associated with your S3 resource, since this experience doesn't offer validation at that level.
There's a default limit of 10 private connections per subscription per region.

Step 1: Create a private connection

To configure a private connection, use the Storage Endpoints section of your Storage Mover resource.

Navigate to your Storage Mover instance in the Azure portal.
Under Storage endpoints, select Private Connection > Create Private Connection.
Enter a name for this private connection. This name matches the name of the Private Endpoint that you later approve to connect to the Private Link Service.
Select the appropriate Private Link Service Direct Connect that directs you to the correct AWS S3 bucket you want to migrate to Azure.
Select Create and commit your changes. Creating the private connection takes 20–30 seconds. You might need to refresh manually to view it in the grid.
Repeat steps 1–5 to set up additional private connections.

Tip

Create multiple private connections to avoid bandwidth limits and ensure efficient, successful data migration.

Step 2: Approve a private connection

After you create a private connection, you must approve it before it can be used in a migration job.

Select the checkbox for your newly created private connection. This step authorizes the connection between the Private Link Service you specified during setup and the corresponding private endpoint that was automatically generated for you.
Select Approve.

Important

Only a private connection in an Approved state can be used for a migration job. Connections in pending, rejected, or disconnected states don't appear as options when you create a job.

Step 3: Create a project

Navigate to the Projects page in your Storage Mover resource.
Provide a name for your project.
Select Create.

Step 4: Create a migration job

After your project is ready, create a migration job to define the source, target, and private connections for your data transfer.

Navigate to the Projects page and select your project.
Select Create Job.
On the Basics tab, select your desired migration type.
On the Source tab, select an existing or newly created source type. Ensure that your selected source is protected by a Virtual Private Cloud.
Select a Private type. Some sources don't require you to select Private, but they do require you to add one or more private connections for the selected source.
Select your existing private connections. Select multiple private connections to avoid bandwidth limits and ensure efficient data migration.
Select Next.
On the Target tab, select the target resource where you want your data migrated in Azure.
On the Settings tab, select the appropriate settings for your migration.
Review your configuration on the Review tab, then select Create.