Moving Beyond 3scale to AWS API Gateway
HiFX helps enterprises migrate Red Hat 3scale API estates to AWS API Gateway - APIs, policies, security configurations, consumers and developer portals - in controlled waves, with minimal disruption to the business.Talk to Us
The Clock Is Running on 3scale. Land on a Platform Built to Last.
Red Hat has confirmed that 3scale API Management 2.x is the last major line of the product. Full support ends on 30 June 2027, and the hosted (SaaS) edition switches off on the same day with no extension. For enterprises that built their API programmes on 3scale, the question is no longer whether to move, but where and how fast. For organisations already running workloads on AWS, Amazon API Gateway is the natural destination - fully managed, deeply integrated with your workloads, and on a long-term roadmap.
Wave-Based Migration, No Big-Bang Cutover
Consumers and Credentials Carried Over
Fully Managed, Serverless API GatewayFive Reasons Every Month of Delay Matters
API management is vital production infrastructure. Postponing your migration increases security risks and engineering costs.
A fixed end-of-life date
Red Hat has stated there will be no major release after 2.x. Maintenance Support began on 1 July 2026, full support ends 30 June 2027, and final retirement - including paid Extended Lifecycle Support - lands on 30 June 2029.
Managed customers have no extension
Teams on 3scale SaaS or Red Hat OpenShift API Management lose the service on 30 June 2027. ELS is only offered for self-managed deployments, and only a single ELS phase is planned.
The product is already shrinking
The 2.16 release notes drop support for the 3scale Toolbox CLI and state there are no plans to support newer Redis versions, with Valkey named as the alternative.
Red Hat itself recommends alternatives
For new deployments, Red Hat advises starting with an alternative rather than 3scale - IBM API Connect or Red Hat Connectivity Link, both a new platform migration in their own right.
Security exposure after EOL
Once a version leaves support, security patches stop while new CVEs keep arriving. An internet-facing API gateway is the worst place to run unpatched software, especially in banking, insurance and healthcare where 3scale is widely deployed.
There is also a structural cost. 3scale is tightly coupled to OpenShift, with APIcast gateways, Redis, a system database and operators to patch and scale. If the rest of your platform already lives on AWS, keeping an OpenShift cluster alive mainly to host API management is hard to justify.
Choosing a Destination
Red Hat points customers to two successors, but neither avoids a migration. For AWS-centric organisations, API Gateway removes the most operational burden.
| Option | What it is | Best fit |
|---|---|---|
| Red Hat Connectivity Link | Kubernetes-native connectivity built on Kuadrant, Gateway API and Envoy | Teams committed to running OpenShift long term |
| IBM API Connect | Full-lifecycle API management, as software or SaaS | Organisations standardising on IBM middleware |
| AWS API GatewayRecommended | Fully managed, pay-per-request gateway with native portal | Workloads already on AWS, or moving there |
Why AWS API Gateway is the right landing zone
Fully managed and serverless
No gateway pods, Redis clusters or operator upgrades. You pay per request and scale without capacity planning.
Consumer management built in
Usage plans and API keys give per-consumer throttling and quotas, scoped to specific APIs and stages — the direct equivalent of 3scale application plans.
(AWS News Blog)A native developer portal
Since November 2025, API Gateway Portals provides a fully managed portal with API products, auto-generated documentation, "Try It" testing, custom branding and Cognito-based access control.
(AWS announcement)Layered security
IAM authorization, Cognito and JWT authorizers, Lambda authorizers, mutual TLS, resource policies and AWS WAF in front.
Deep integration
Native routing to Lambda, ECS/EKS services, Step Functions and private VPC backends through VPC Link.
Observability out of the box
CloudWatch metrics and logs, X-Ray tracing, CloudTrail audit trails, and portal analytics through CloudWatch RUM.
Infrastructure as code
Everything is definable in OpenAPI, Terraform, CloudFormation or CDK, so API configuration lives in Git and ships through CI/CD.
Full-Spectrum API Gateway Migration Services
3scale Estate Inventory & Export
Every product, backend, mapping rule, metric, application plan and APIcast policy, with traffic data per API so you know which carry real load and which can be retired. We capture product exports early - the Toolbox CLI is no longer supported from 3scale 2.16 - and fall back to the Admin API where needed.
Target Architecture Design
REST vs HTTP API standards, authorizer patterns (Cognito, JWT, Lambda, IAM), usage-plan tiers, custom domains, WAF rules and a multi-account, multi-stage deployment model - decided from your workloads, not a template.
Policy & Configuration Translation
No platform replicates the 3scale model one to one. We convert each concept to its AWS equivalent as OpenAPI definitions and Terraform/CDK modules, and rewrite custom Lua policies as Lambda authorizers, mapping templates or WAF rules - each with its own tests.
Consumer & Credential Migration
For each consumer group we choose one path: carry existing keys over, issue new keys, or move to OAuth 2.0 / OpenID Connect through your identity provider. Accounts, applications and credentials aren't in the 3scale export, so we extract them separately.
Developer Portal Rebuild
OpenAPI specs carry over to API Gateway Portals, with portal content, branding and Cognito-based access rebuilt so partners keep a self-service experience.
Operate, Govern & Decommission
Runbooks, CloudWatch dashboards and alarms, OpenAPI linting in CI and Git-based gateway deployment - then 3scale and its OpenShift footprint are switched off.
Mapping 3scale to AWS
Most 3scale concepts have a direct AWS counterpart; a few need design work rather than a one-to-one copy.
| 3scale concept | AWS equivalent | Migration note |
|---|---|---|
| Product / Backend | REST or HTTP API, with integrations | Choose REST API where usage plans, caching or WAF are needed; HTTP API for lean, low-latency routes |
| APIcast gateway | API Gateway (managed) | No gateway infrastructure to run |
| Mapping rules | Resources, methods and routes | Path patterns are translated, not copied |
| Application plans and limits | Usage plans (throttling + quotas) | Plan tiers map directly; complex per-metric limits need design |
| User-key credentials | API keys bound to usage plans | Existing key values can be imported so consumers keep working |
| app_id / app_key pairs | Lambda authorizer, or a move to OAuth | API Gateway keys are single values, so pairs need a custom authorizer or a credential change |
| OpenID Connect / OAuth (via RH-SSO) | Cognito or JWT authorizer | Existing IdPs can stay; validate token claims and scopes |
| APIcast policies (Lua) | Lambda authorizers, mapping templates, WAF rules | Custom policies must be rewritten |
| Accounts and applications | Usage-plan keys + portal users (Cognito) | Not in the 3scale product export; extracted via Admin API |
| Developer Portal and ActiveDocs | API Gateway Portals | OpenAPI specs carry over; portal content is rebuilt |
| Staging / Production environments | Stages and stage variables | Promote via CI/CD |
| Metrics and analytics | CloudWatch, Athena over access logs | Build dashboards for business KPIs |
| Billing and monetisation | Usage data + AWS Marketplace or custom billing | Needs explicit design |
Our Process
Discovery
Inventory every product, backend, mapping rule, metric, application plan and APIcast policy, with traffic per API. Export configuration while you still can: product exports write each product to YAML, and consumer accounts, applications and credentials are extracted separately.
Architecture & Translation
Design the target architecture, then translate each 3scale concept into OpenAPI definitions and Terraform/CDK modules, rewriting custom Lua policies with their own tests. Agree a consumer and credential strategy, and publish dates and changes to consumers well in advance.
Wave Migration
Run both gateways in parallel. Start with internal and low-risk APIs and leave business-critical ones for last. Shift traffic gradually with weighted DNS on custom domains, keeping instant rollback. Every wave has written success criteria; we compare latency, error rates and usage, and run contract tests against the OpenAPI specification.
Operate & Decommission
Every API exits with a current OpenAPI spec and a named owner, design rules enforced by linters in CI, and gateway configuration deployed from Git. We hand over runbooks, dashboards and alarms, launch the API Gateway Portal, then switch off 3scale and its OpenShift footprint.
Pitfalls We Help Clients Avoid
The hard parts of this migration are rarely the routes; they are the behaviours 3scale handled quietly.
Copying configuration instead of translating it
Custom Lua policies, header transformations and edge-case mapping rules must be found and re-implemented for the new gateway.
Forgetting the consumers
The product export leaves out accounts, applications and credentials. Without a plan for them, partners face re-registration, broken integrations and a flood of support calls.
Assuming keys import cleanly
AWS API keys must be at least 20 characters, and app_id/app_key pairs have no direct equivalent. Shorter or paired credentials need an authorizer or a managed rotation.
A big-bang cutover
Switching every API at once removes your rollback path. Waves, parallel running and per-wave success criteria keep risk contained.
Losing analytics
3scale's per-method hit counts and plan reporting do not appear automatically; dashboards and log pipelines must be designed up front.
Ignoring service limits
API Gateway has quotas on payload size, integration timeouts and resources per API. Large or long-running APIs need to be checked early.
Migrating technical debt
Moving undocumented, ownerless APIs simply relocates the problem. Use the migration to fix specs, ownership and standards.
Leaving it too late
Analysis, testing, consumer communication and parallel running take months. Starting after mid-2027 means running unsupported software or paying for ELS while you migrate.
A Team, Not a Seat
Enterprises are hiring for exactly the skills our cloud engineering team already brings as a delivery unit: leadership of 3scale-to-AWS API Gateway migrations covering APIs, policies, security configurations, developer portals and integrations, plus hands-on work with usage plans, API keys, custom domains, stage variables, throttling, caching and migration runbooks. Hiring one specialist covers part of that list. HiFX delivers the whole of it:
Cloud engineering and migration experience
Including platform moves into AWS such as Azure-to-AWS migrations - with infrastructure as code and CI/CD as standard.
API and product engineering depth
RESTful design, microservices and authentication patterns (OAuth 2.0, OIDC, JWT, mTLS) built for production.
Security by design
IAM, Cognito, WAF, Secrets Manager and least-privilege, multi-account setups.
Data and AI capability
So API analytics, usage reporting and AI-ready APIs are part of the target design, not an afterthought.
A team, not a seat
Architects, engineers, QA and DevOps working to a single migration plan, with documentation and knowledge transfer to your team.
Questions We Get Asked
Full support ends on 30 June 2027, when the hosted SaaS edition also switches off. Self-managed deployments can buy Extended Lifecycle Support until final retirement on 30 June 2029.
Not necessarily. Existing user keys can be imported into usage plans so consumers keep working; app_id/app_key pairs and keys under 20 characters need a custom authorizer or a planned rotation.
They're rewritten as Lambda authorizers, mapping templates or WAF rules, each with its own tests — Lua policies don't carry over automatically.
It depends on the size of the estate, but analysis, testing, consumer communication and parallel running take months — which is why we recommend starting well before June 2027.
Start With a Migration Readiness Assessment
Prepare for a seamless transition before June 2027. Partner with HiFX to assess your 3scale environment, plan your API management migration, and ensure a smooth, secure transition with minimal disruption.
Talk to Our Experts- 3scale Estate Inventory & Export
- Target Architecture Design
- Policy & Configuration Translation
- Consumer & Credential Migration
- Developer Portal Rebuild
