Replacing Akamai With AWS to Save $100k a Year, and Leading a 4-Continent SRE Team

The challenge

Amway is the world’s largest direct-selling company. Its high-availability e-commerce platform serves customers and independent business owners in the USA, Canada, Brazil and beyond, and the SAP Hybris-based platform ran under strict availability, performance and security requirements. My team owned the non-production environments of the US region in full, and all environments, including production, for Amway Brazil. A separate team in India owned USA production, so coordination between the two teams was a continuous operational requirement.

The SRE team I led spanned four continents: L2 and L3 engineers in the USA, Brazil, the EU and India, working across every time zone. Shift handovers, incident escalation paths and knowledge transfer all had to work across more than 12 hours of time zone difference and several languages. Leading this team meant building operational processes for people who would never all be in a meeting at the same time.

Akamai was the existing CDN and edge security provider: a standard enterprise choice, but expensive and increasingly hard to evolve together with the rest of the AWS-based infrastructure. More than 100,000 URL redirect rules lived in the Akamai configuration. Moving that much redirect logic to a new platform without breaking the SEO and routing behaviour that Amway’s business depended on was the engineering problem that had kept this migration theoretical.

My task: lead the Platform DevOps and SRE teams, keep the environments and CI/CD of the SAP Hybris platform running across regions, and find a practical way to move from Akamai to AWS native services.

How do redirects work at the CDN edge on AWS?

A content delivery network (CDN), such as Akamai or Amazon CloudFront, serves a website from locations close to its users. Redirect rules send an old address to a new one, for example after a product or campaign page moves, and they protect search rankings and old links. CloudFront has no built-in list of redirect rules: the logic runs as code at the edge. In 2020 that code was Lambda@Edge, and AWS described this pattern as a way to take redirect work off the origin and answer users faster. Lambda@Edge runs in CloudFront’s regional edge caches, close to users. AWS later added CloudFront Functions (2021) and CloudFront KeyValueStore (2023), and its current guidance uses them for most redirect lists, with Lambda@Edge and external storage for very large or often-changing ones. AWS WAF filters harmful web requests, and AWS Shield protects against DDoS attacks.

What I did

1. Replaced Akamai with CloudFront, AWS WAF and AWS Shield, with Lambda@Edge for 100,000+ redirects

   Akamai had built up over 100,000 URL redirect rules for Amway USA, from years of product catalogue changes, regional routing, campaign landing pages and SEO management. They couldn’t simply be exported and imported into CloudFront: at that time it had no native way to manage redirect rules at that volume with the pattern-matching flexibility Akamai provides. I designed a Lambda@Edge function that runs the redirect logic in CloudFront, before requests ever reach the origin infrastructure. This made the 100k+ rules manageable in AWS, removed the origin server load that central redirect processing would create, and reduced latency for redirected traffic, because users are redirected close to where they are. The PoC started with US traffic, which moved from Akamai to CloudFront, AWS WAF and AWS Shield, and it was then rolled out across all Amway locations worldwide.

   Technical details

   • Edge stack: Amazon CloudFront for content delivery, AWS WAF for web request filtering and AWS Shield for DDoS protection, in place of Akamai’s CDN and edge security.
   • Redirect logic: the rules are stored and evaluated at the CDN layer, not in the application, so the SAP Hybris origin never sees redirected requests.
   • Validation: the redirect behaviour on CloudFront was checked against Akamai before US traffic moved.

2. Led the Platform DevOps team: environments and CI/CD for SAP Hybris

   I led a four-person Platform DevOps team responsible for all non-production environments for Amway USA and Canada, and all environments including production for Amway Brazil. The CI/CD processes of the SAP Hybris-based platform were under our direct management: design, implementation and ongoing improvement. I worked closely with the India-based production team for Amway USA, coordinating deployments, environment promotions and architectural changes across both teams.

3. Built a follow-the-sun SRE team across four continents

   I led and mentored the cross-regional SRE team, with L2 (SRE) and L3 (DevOps) support across four continents. Incident response, escalation paths and knowledge sharing across more than 12 hours of time zone difference need explicit operational design. I built the processes that made the team work reliably in every operating window, and mentored engineers at both levels to grow their technical skills and operational maturity.

   Technical details

   • Processes designed for a distributed team: incident escalation, shift handover, runbook access and on-call thresholds.

4. Acted as first responder for security incidents

   I was the first responder for security incidents across the platform. In a high-volume global retail environment, security events range from credential attacks and bot traffic to WAF rule tuning and DDoS mitigation. Responding well needs both security expertise and deep knowledge of the infrastructure: knowing where the risk really lives and which actions will contain an incident without disrupting live commerce.

5. Tested a move from the SAP Hybris monolith to microservices

   In parallel with the Akamai migration, I designed and implemented a PoC for moving from the SAP Hybris monolith towards a microservices architecture. On a platform of this scale and business importance, architectural changes have to be proven through working experiments before the organisation commits to them at scale. The PoC gave the technical and operational evidence for an informed architectural decision, so the organisation understood the real implementation complexity before choosing a transformation path.

Results

Over 1 year and 7 months, the work delivered:

• $100,000 a year lower infrastructure cost for this part of the stack, for the US region alone, after replacing Akamai with CloudFront, AWS WAF and AWS Shield.
• 30% faster access to Amway USA services after the switch.
• The Akamai replacement rolled out across all Amway locations worldwide.
• More than 100,000 redirect rules moved to the CDN edge with Lambda@Edge, with the SEO and routing behaviour the business depended on.
• A cross-continental SRE team with incident response and shift handover that worked in every time zone, and engineers who grew at both L2 and L3 levels.
• Evidence for the microservices direction of the SAP Hybris platform, from a working PoC.

What I learned

A migration that never starts is often blocked by one specific engineering problem.

The Akamai migration had been desirable for a long time. It hadn’t happened because of 100,000+ redirect rules with no clear path to AWS. Solving that one problem with Lambda@Edge unlocked the whole migration and produced $100k a year in savings as a direct result. Distributed teams work the same way: their performance is a design problem. A cross-continental SRE team fails when incident escalation, shift handover, runbook access and on-call thresholds were designed for people in one office. Getting those right is an engineering and management discipline. And in a PoC, the goal is to surface the specific constraints that will stop an idea at scale, before they become production incidents.

Evidence and further reading

• Related projectFrom COBOL mainframe to cloud-native microservices: the unified DevOps platform for SIXT Leasing SEA monolith that did move to microservices, with DevOps practices built around it.
• Article · this siteCloud exit economics: real-world ROI and financial modelsHow to judge the business case for leaving a provider.
• Service · this siteCloud migration consultingHow I plan and lead migrations to AWS.

Delivered as Lead DevOps and Cloud Architect at EPAM Systems, where I was an EPAM Certified Technical Mentor and an EPAM Certified Resource Manager.

Skills and technologies

• Akamai to CloudFront migration
• Amazon CloudFront
• Lambda@Edge
• AWS WAF
• AWS Shield
• Edge computing
• URL redirects at scale
• CDN cost optimisation
• SAP Hybris (SAP Commerce Cloud)
• CI/CD
• Platform DevOps
• Site reliability engineering (SRE)
• Follow-the-sun support
• Incident response
• Security incident response
• DDoS mitigation
• Monolith to microservices
• Distributed team leadership
• Mentoring

← All projects