> ## Documentation Index > Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt > Use this file to discover all available pages before exploring further. # Step Functions > AWS Step Functions. Runs workflows as JSON-defined state machines, with retries, error handling, parallel and map states. Preview **On this page** * [Coverage by target cloud](#coverage-by-target-cloud) * [How the targets compare](#how-the-targets-compare) * [Max adaptation](#max-adaptation) * [On Google Cloud](#on-google-cloud) * [Via Cloud Workflows](#via-cloud-workflows) * [On Google Cloud, Azure, OCI, and Private Kubernetes](#on-google-cloud-azure-oci-and-private-kubernetes) * [Via Temporal (Self-Hosted)](#via-temporal-self-hosted) * [Via Temporal Cloud (Managed)](#via-temporal-cloud-managed) * [On Azure](#on-azure) * [Via Azure Durable Functions](#via-azure-durable-functions) ## Coverage by target cloud | Target | Available | | ------------------ | --------- | | Google Cloud | ✓ | | Azure | ✓ | | OCI | ✓ | | Private Kubernetes | ✓ | ## How the targets compare Each row compares a capability of Step Functions with its adaptation on each target. A dash means this row is not stated for that target. ### Max adaptation | Capability | Step Functions | Google Cloud · Cloud Workflows | Google Cloud, Azure, OCI, and Private Kubernetes · Temporal (Self-Hosted) | Google Cloud, Azure, OCI, and Private Kubernetes · Temporal Cloud (Managed) | Azure · Azure Durable Functions | | ----------------------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Execution engine · what runs the state machine | the Step Functions service interprets the Amazon States Language definition | Cloud Workflows runs workflow modules the adapter prepares from the definition per revision, with ASL data and expression semantics from an adapter helper the workflow calls; an Express execution runs inline in the adapter | - | - | a Tensor9-maintained orchestrator function on Azure Functions interprets the same definition, one Durable Functions orchestration per Standard execution; an Express execution runs inline in the adapter | | Execution state · where progress is checkpointed | held by the service | held by Cloud Workflows per execution; the adapter keeps the execution's identity, input and outcome | - | - | checkpointed in a task hub in an Azure Storage account; an execution survives a restart of the function app or of the adapter | | Long-running executions · Wait states and timeouts | up to one year; a Wait state holds no compute | up to one year, the Workflows ceiling; a Wait is the engine's own sleep | - | - | up to one year; a Wait is a durable timer held in the task hub | | Express workflows · 5-minute, high-volume runs | at-least-once asynchronous runs and at-most-once synchronous runs, no API history | an inline run in the adapter with no durable record, within the 5-minute ceiling and with no API history; a fresh start is never deduplicated | - | - | an inline run in the adapter with no durable record, within the 5-minute ceiling and with no API history; a fresh start is never deduplicated | | Activities and task tokens · work handed to outside workers | a service-hosted queue polled by GetActivityTask | a queue the adapter serves; the token is minted by the adapter and completion resumes the workflow through its callback | - | - | a queue the adapter serves; the token is minted and checked by the adapter, and workers reach the adapter's endpoint | | Definition size · the largest state machine | 1 MB of Amazon States Language | 1 MB accepted; split across prepared modules because one Workflows source is capped at 128 KB | - | - | - | | Service integrations · what a Task state can call | AWS services through optimized and SDK integrations | the services adapted on the same appliance, through their own mappings; a Resource the appliance does not serve is refused at CreateStateMachine | - | - | the services adapted on the same appliance, through their own mappings; a Resource the appliance does not serve is refused at CreateStateMachine | | Logs and traces · where execution logs go | CloudWatch Logs and X-Ray | Cloud Logging captures execution and step logs; X-Ray tracing is not reproduced | - | - | the appliance's logging; X-Ray tracing is not reproduced | | API coverage | full | partial | partial | partial | partial | | Execution engine | Step Functions interprets ASL | - | a generic Tensor9-maintained Temporal workflow interprets Standard executions; Express runs separately in the adapter | a generic Tensor9-maintained Temporal workflow interprets Standard executions; Express runs separately in the adapter | - | | Execution state | AWS holds state and history | - | self-hosted Temporal holds native history; the adapter retains AWS identities and public records | Temporal Cloud holds native history in the namespace region; the adapter retains AWS identities and public records | - | | Activities and callbacks | AWS hosts Activity queues and accepts task tokens | - | the adapter serves Activity queues and durable token completion; Temporal activities perform internal service calls | the adapter serves Activity queues and durable token completion; Temporal activities perform internal service calls | - | | Service integrations | optimized and SDK integrations with AWS services | - | only supported service mappings and invocation patterns in the deployment | only supported service mappings and invocation patterns in the deployment | - | | Execution debugging | AWS console, CloudWatch Logs and X-Ray | - | Temporal Web UI and deployment logs; the AWS graph and X-Ray tracing are not reproduced | Temporal Web UI and deployment logs; the AWS graph and X-Ray tracing are not reproduced | - | | Capacity | service quotas govern concurrency | - | cluster, database and worker capacity govern throughput; the deployment operator maintains them | namespace and worker capacity govern throughput; customer billing covers Temporal Cloud and worker compute | - | | Versions and aliases · immutable versions, weighted routing | native | - | - | - | adapter records; an execution pins the version it was routed to | ## On Google Cloud ### Via Cloud Workflows | Capability | Area | Support | Required tier | Operations | Notes | | ----------------------------- | ---------------------- | ------------ | ------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data flow and expressions | Amazon States Language | Supported | - | - | InputPath, Parameters, ResultSelector, ResultPath, OutputPath, intrinsic functions, JSONata, variables and Assign are evaluated for the workflow by an adapter helper, since the Workflows language has no equivalent | | Distributed Map | Amazon States Language | Supported | - | - | a Map Run fans out into child Workflows executions scheduled by the parent within MaxConcurrency; item slots and ordered output survive a restart, an item retry never becomes a whole-Map retry, and UpdateMapRun reaches children already running or fails with a named error. A large Map Run is paced by shared admission and backpressure without any change to its semantics | | Error handling | Amazon States Language | Supported | - | - | Retry and Catch with backoff, jitter and error matching; one ASL attempt is one submission, never multiplied by the platform's own retry | | Parallel and inline Map | Amazon States Language | Supported | - | - | Cloud Workflows nests parallel steps two deep and runs 20 branches at once within one execution; a Parallel or Map beyond that runs its branches as child executions, so the definition's shape is preserved | | Wait states and timeouts | Amazon States Language | Supported | - | - | a Wait is served by the engine itself, which sleeps within the execution for up to a year; state and execution timeouts fire as States.Timeout | | Encryption configuration | Configuration | Supported | - | - | a customer-managed key names a key served by the KMS mapping on the same appliance (Cloud KMS on Google Cloud); the definition, the prepared modules' data and execution payloads are encrypted under it and become unreadable when it is revoked | | Logging configuration | Configuration | Partial | - | - | includeExecutionData decides whether execution payloads are written at all, and the configured destination decides whose log they reach; the entries land in Cloud Logging, since CloudWatch Logs is a service the appliance does not adapt | | Tracing configuration | Configuration | Out of scope | - | - | X-Ray is not adapted, so a configuration that enables tracing is rejected at CreateStateMachine and UpdateStateMachine rather than stored and ignored | | EXPRESS workflows | Execution model | Supported | - | - | an Express execution is an inline run in the adapter with no durable record, within the 5-minute ceiling; as on AWS it has no history through the API, cannot use Activities, Distributed Map, .sync or .waitForTaskToken, and DescribeStateMachineForExecution, GetExecutionHistory, ListExecutions, RedriveExecution and StopExecution refuse it. A fresh Express start is never deduplicated, and an interrupted delivery is retried under the same accepted start | | STANDARD workflows | Execution model | Supported | - | - | exactly-once execution with a durable record, up to one year, which is also the ceiling of a Cloud Workflows execution | | Service integrations | Integrations | Partial | - | - | a Task Resource naming an AWS service is served by that service's mapping on the same appliance, including .sync and .waitForTaskToken, nested executions and Task.Credentials role overrides; a Resource naming a service the appliance does not serve is refused at CreateStateMachine | | Payload and definition limits | Limits | Supported | - | - | the 256 KiB payload ceiling and the 1 MB definition ceiling are enforced at the API; a definition larger than Workflows' 128 KB source limit is split across prepared modules, so the AWS ceiling is the one you plan against | | Operation | Area | Support | Depth | Notes | | -------------------------------- | -------------------- | -------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CreateActivity | Activities | Adapter-served | Most usage | an Activity is a record and a task queue the adapter serves; Cloud Workflows has callback endpoints but nothing an outside worker long-polls by name | | DeleteActivity | Activities | Adapter-served | Full surface | deletes the Activity even while workers hold tasks from it, as on AWS; a worker's next SendTaskSuccess for such a task answers TaskDoesNotExist | | DescribeActivity | Activities | Adapter-served | Full surface | returns the Activity's ARN, name and creation date | | GetActivityTask | Activities | Adapter-served | Most usage | holds the poll open for up to 60 seconds and hands one task to one worker with an adapter-minted token; an empty poll returns a null token | | ListActivities | Activities | Adapter-served | Full surface | lists the Activities | | SendTaskFailure | Activities | Adapter-served | Most usage | fails the task with the error and cause supplied | | SendTaskHeartbeat | Activities | Adapter-served | Full surface | renews the heartbeat window; a lapsed heartbeat fails the task with States.Timeout | | SendTaskSuccess | Activities | Adapter-served | Most usage | completes the task the token identifies, once; the waiting Workflows execution resumes through its callback | | TestState | Diagnostics | Supported | Full surface | evaluates a single state without starting an execution; a Task state that reaches a real service does so under the caller's own authorization | | ValidateStateMachineDefinition | Diagnostics | Supported | Most usage | validates a definition without creating anything and returns diagnostics with severity; a Task whose Resource names a service the appliance does not serve is reported here | | DescribeMapRun | Distributed Map | Supported | Most usage | returns the Map Run's status, item counts, tolerated-failure settings and concurrency | | ListMapRuns | Distributed Map | Supported | Full surface | lists the Map Runs of an execution | | UpdateMapRun | Distributed Map | Supported | Full surface | changes MaxConcurrency or the tolerated-failure thresholds of a running Map Run; children in flight continue | | DescribeExecution | Executions | Supported | Common | returns status, input, output, error, cause and redrive details | | GetExecutionHistory | Executions | Supported | Most usage | returns the execution's transitions as Step Functions events in causal order, derived from the adapter's record and the Workflows execution; EXPRESS executions have no history through the API, as on AWS | | ListExecutions | Executions | Supported | Common | lists executions by state machine or Map Run with status and redrive filters | | RedriveExecution | Executions | Supported | Most usage | resumes a failed, aborted or timed-out STANDARD execution from its unsuccessful states within 14 days, under the same execution ARN and revision; successful states are not rerun and only failed Map Run children restart | | StartExecution | Executions | Supported | Common | admits the execution, pins its revision and runs it: a STANDARD execution as a Cloud Workflows execution of that revision's prepared workflow under the workflow's own service account, an EXPRESS execution as an inline run in the adapter with no durable record. STANDARD starts are idempotent on name and input while the execution runs, ExecutionAlreadyExists is returned for a closed execution or a different input, and a name is reusable 90 days after closing; EXPRESS starts are never deduplicated | | StartSyncExecution | Executions | Supported | Most usage | the synchronous result API of an EXPRESS state machine: the request is held open until the inline run completes or the 5-minute ceiling passes, a failed run is reported in the response body, and a caller that disconnects does not cancel accepted work | | StopExecution | Executions | Supported | Common | cancels the Workflows execution and records the ABORTED outcome with the error and cause supplied | | CreateStateMachine | State machines | Supported | Common | validates the definition, records the state machine, and prepares for that revision an immutable set of workflow modules and a manifest in Cloud Workflows; the definition itself is kept as written | | DeleteStateMachine | State machines | Supported | Common | succeeds at once and reads DELETING until running executions complete; the prepared modules of its revisions are retired with it | | DescribeStateMachine | State machines | Supported | Common | returns the definition, role, type, revision and configuration from the adapter's record | | DescribeStateMachineForExecution | State machines | Supported | Most usage | returns the definition and revision the execution is pinned to | | ListStateMachines | State machines | Supported | Common | lists state machines with opaque pagination tokens | | UpdateStateMachine | State machines | Supported | Common | returns a new revision with its own prepared modules; executions in flight keep the revision and modules they started on | | ListTagsForResource | Tags | Supported | Full surface | lists the tags | | TagResource | Tags | Supported | Full surface | attaches tags to a state machine or Activity | | UntagResource | Tags | Supported | Full surface | removes tags | | CreateStateMachineAlias | Versions and aliases | Supported | Most usage | an alias routes to one or two versions by weight; an execution pins the version it was routed to | | DeleteStateMachineAlias | Versions and aliases | Supported | Full surface | deletes the alias; executions it routed keep running | | DeleteStateMachineVersion | Versions and aliases | Supported | Full surface | deletes a version; refused while an alias still routes to it | | DescribeStateMachineAlias | Versions and aliases | Supported | Full surface | returns the alias and its routing | | ListStateMachineAliases | Versions and aliases | Supported | Full surface | lists the aliases | | ListStateMachineVersions | Versions and aliases | Supported | Most usage | lists the published versions | | PublishStateMachineVersion | Versions and aliases | Supported | Most usage | publishes the current revision as an immutable numbered version; the version shares the revision's prepared modules | | UpdateStateMachineAlias | Versions and aliases | Supported | Full surface | changes the routing for executions started afterwards | #### How it works Your application keeps calling the Step Functions API. On Google Cloud those calls reach a Tensor9 service adapter instead of AWS. The adapter holds each state machine as a record (the Amazon States Language definition as you wrote it, the role, the type, the versions, the aliases and the tags) and answers every `states:` operation from that record and from the executions it has admitted. Cloud Workflows executes its own language, so for each revision of a state machine the adapter prepares an immutable set of bounded workflow modules and a manifest in Cloud Workflows. Four quotas make that split necessary: a single workflow source is capped at 128 KB against the 1 MB an ASL definition may be, parallel steps nest two deep, 20 branches run at once within one execution, and variables, arguments and events share 512 KB. A Parallel or Map that exceeds the depth or width runs its branches as child executions; a large definition spans several modules. Data flow and expression semantics (paths, intrinsics, JSONata, Choice rules) are evaluated by an adapter helper the workflow calls, so ASL behaves as it does on AWS rather than as an approximation in the Workflows language. StartExecution admits the execution and pins its revision. A Standard execution runs as a Workflows execution of that revision's prepared workflow; an Express execution runs inline in the adapter and leaves no durable record, as on AWS. The workflow runs under a service account the adapter creates for that revision, so its calls to other services present an identity of their own and are authorized per workflow rather than for the whole project. A Task state's Resource names an AWS service and is served by that service's mapping on the same appliance; a `.waitForTaskToken` integration parks the execution on a Workflows callback until SendTaskSuccess or SendTaskFailure arrives. Each Task effect is authorized against the state machine's execution role, or the Task.Credentials role where one is set, before it is made. GetExecutionHistory returns Step Functions events built from the adapter's record and the Workflows execution in causal order. #### Infrastructure-only translation A deployment that translates infrastructure only, with no adapter, treats the state machine as a Terraform resource. The Tensor9 compiler emits a Cloud Workflows workflow with the state machine's name in the appliance's region and stops there: the Amazon States Language definition has no mechanical translation to the Workflows language (Task, Wait, Choice, Map and Parallel states against Workflows steps, switch, try/retry/except, for and parallel), so the workflow's source is left unset and reported as an omission, and the logic must be re-authored by hand in Workflows YAML. The execution role, an EXPRESS type, the logging configuration and tags are reported as lossy for the same reason: the role is a separate IAM object with no service-account email to bind, Workflows has one durable execution model, logging is a Cloud Logging setting, and label keys must be lowercase without dots. That path exists so a deployment with a state machine still produces a valid Google Cloud stack; it does not answer the Step Functions API, and an application that calls `states:` needs the adapter above. #### Limitations * **Activities are served by the adapter.** Cloud Workflows has callback endpoints but no resource a worker outside the platform long-polls by name, so an Activity is a queue the adapter serves: GetActivityTask holds the poll open for up to 60 seconds, the token is minted by the adapter, and a completion resumes the workflow through its callback. Workers need no code change; they must reach the adapter's endpoint. - **Large Map Runs are paced by the appliance.** A Map Run becomes child Workflows executions within MaxConcurrency, and a Parallel or inline Map wider than 20 branches also runs as child executions. A large Map Run is admitted with backpressure rather than all at once; its semantics do not change, and an UpdateMapRun that cannot reach children already running fails with a named error instead of reporting a change that did not happen. - **A ceiling reached mid-execution is named.** Cloud Workflows has budgets of its own, such as its step budget per execution. When one is reached inside a window AWS would still honour, the execution fails with an error naming the ceiling rather than as an ordinary timeout, and a task token outstanding for as long as AWS allows is either honoured or fails the same way. - **Definitions span modules.** A definition larger than 128 KB, or nested deeper than Workflows allows, is split across prepared modules. The split is the adapter's and is invisible to the API, but the prepared workflows are visible in the Google Cloud console, named per revision. - **Logs and traces do not reach CloudWatch or X-Ray.** `includeExecutionData` decides whether execution payloads are written at all and the configured destination decides whose log they reach; the entries land in Cloud Logging, since CloudWatch Logs is a service the appliance does not adapt. A `tracingConfiguration` that enables X-Ray tracing is rejected at CreateStateMachine and UpdateStateMachine rather than stored and ignored. - **Service integrations are bounded by the appliance.** A Resource naming a service the appliance does not serve is reported by ValidateStateMachineDefinition and refused at CreateStateMachine with an error naming the state. - **Without the adapter, the definition does not come across.** The infrastructure-only translation emits the Workflows shell and leaves its source unset; the state machine's logic must be re-authored by hand. - **The engine choice is fixed per execution.** Which engine runs a state machine is chosen per deployment and recorded with each execution. Changing it affects executions started afterwards; executions already running, their history and their outstanding task tokens stay on the engine they started on until they complete and their retention expires. Nothing migrates a live execution. #### Other considerations * **Migration.** State machines are created by your own deployment through CreateStateMachine, versions and aliases included; the adapter prepares each revision's modules at that point. Executions do not migrate, and AWS execution history is not copied. - **Who operates what.** Google operates Cloud Workflows and stores each execution's state and history for 90 days after it completes. Tensor9 operates the adapter, the prepared modules and the helper service; an adapter upgrade leaves a revision's prepared modules in place, so a running execution keeps the code it started with. - **Cost shape.** AWS bills a Standard execution per state transition. Cloud Workflows bills per step executed and per external call, and the adapter helper's evaluations count as external calls. - **What you see in the Google Cloud console.** Workflows named per revision and their executions, under the per-revision service accounts the adapter creates. State machines, execution ARNs and versions exist in the adapter's record and are what the Step Functions API returns. ## On Google Cloud, Azure, OCI, and Private Kubernetes ### Via Temporal (Self-Hosted) | Capability | Area | Support | Required tier | Operations | Notes | | ----------------------------- | ---------------------- | ------------ | ------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | ASL state types and data flow | Amazon States Language | Supported | - | - | Pass, Succeed, Fail, Choice, Wait, Task, Parallel and Map use the generic interpreter, including paths, intrinsic functions, JSONata, variables and Assign. | | Map and Parallel | Amazon States Language | Supported | - | - | Child workflows preserve branch and item ordering, dynamic concurrency, item-level retries and failure thresholds. Capacity admission may delay runnable items. | | Retry, Catch and timeouts | Amazon States Language | Supported | - | - | The interpreter controls ASL retries, error matching, backoff and jitter; transport retries do not silently add business attempts. Temporal timers drive waits and timeout handling. | | Encryption configuration | Configuration | Supported | - | - | Customer-managed encryption uses the deployment's KMS mapping for adapter records and a worker payload codec for Temporal payloads; decoded history requires key authorization. | | Logging configuration | Configuration | Partial | - | - | The configured destination and includeExecutionData setting control deployment logs. Logs do not reach AWS CloudWatch Logs. | | Tracing configuration | Configuration | Out of scope | - | - | Enabling AWS X-Ray tracing is rejected; X-Ray is not supplied by this mapping. | | EXPRESS workflows | Execution model | Supported | - | - | The adapter executes Express separately within five minutes, without Standard API history. Activities, Distributed Map, .sync, callbacks and Standard-only execution APIs are unavailable for Express. | | STANDARD workflows | Execution model | Supported | - | - | Temporal persists Standard execution history and timers. The interpreter preserves the execution identity across worker restart and continue-as-new; external side effects retain their integration's idempotency rules. | | Service integrations | Integrations | Partial | - | - | Task resources, .sync, .waitForTaskToken and Task.Credentials are supported only where the deployment has the corresponding service mapping and authorization. Unsupported combinations are rejected at admission. | | AWS visual console | Operator interface | Out of scope | - | - | Temporal Web UI shows workflow history, timers and pending work. It does not reproduce the AWS console's ASL graph and highlighted execution path. | | Operation | Area | Support | Depth | Notes | | -------------------------------- | ------------------------ | -------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CreateActivity | Activities | Adapter-served | Most usage | Creates an AWS Activity record and a durable task queue served by the adapter; it is separate from Temporal's internal activities. | | DeleteActivity | Activities | Adapter-served | Full surface | Deletes the Activity and refuses subsequent completion for removed tasks. | | DescribeActivity | Activities | Adapter-served | Full surface | Returns the Activity ARN, name and creation time. | | GetActivityTask | Activities | Adapter-served | Most usage | Long-polls the adapter queue and gives one worker a task and attempt-specific token; workers connect to the adapter endpoint. | | ListActivities | Activities | Adapter-served | Full surface | Lists Activity records with pagination. | | SendTaskFailure | Activities and callbacks | Adapter-served | Most usage | Records the active attempt's error and cause and resumes ASL error handling. | | SendTaskHeartbeat | Activities and callbacks | Adapter-served | Full surface | Renews the active task's heartbeat window without extending its absolute timeout. | | SendTaskSuccess | Activities and callbacks | Adapter-served | Most usage | Durably records completion of the active task attempt and wakes the Temporal workflow; stale tokens are refused and a transport acknowledgment is insufficient. | | TestState | Diagnostics | Supported | Full surface | Evaluates a single state through the same ASL evaluator; an external Task call requires the caller's authorization and a supported integration. | | ValidateStateMachineDefinition | Diagnostics | Supported | Most usage | Validates ASL without creating a resource and reports diagnostics, including unsupported Task resources and invocation patterns. | | DescribeMapRun | Distributed Map | Supported | Most usage | Returns Map Run status, item counts, concurrency and tolerated-failure settings. | | ListMapRuns | Distributed Map | Supported | Full surface | Lists an execution's Map Runs. | | UpdateMapRun | Distributed Map | Supported | Full surface | Updates concurrency and failure thresholds in the running interpreter; an update that cannot reach it fails explicitly. Existing child work is retained. | | DescribeExecution | Executions | Supported | Common | Returns Standard execution status, input, output, failure and redrive details through the adapter's execution record. | | GetExecutionHistory | Executions | Supported | Most usage | Returns Step Functions events in causal order, including event links and timestamps; Temporal history is translated into the public event model. Express has no API history. | | ListExecutions | Executions | Supported | Common | Lists Standard executions by state machine or Map Run, with status filters and pagination. | | RedriveExecution | Executions | Supported | Most usage | Resumes eligible unsuccessful Standard work under the same execution identity and revision within the redrive window; successful states are retained and rerun states reset their retry counters. | | StartExecution | Executions | Supported | Common | Admits a Standard execution durably and runs the selected ASL revision as a Temporal workflow. Standard name/input deduplication is kept; Express uses a separate short-lived execution path and fresh starts are not deduplicated. | | StartSyncExecution | Executions | Supported | Most usage | Returns the result of an Express execution within its five-minute limit, including execution failures in the response body; caller disconnection does not cancel accepted work. | | StopExecution | Executions | Supported | Common | Stops the Standard workflow and records ABORTED with the supplied error and cause; cancellation of an already accepted external effect depends on its integration. | | CreateStateMachine | State machines | Supported | Common | Validates ASL and stores the definition, role, mode, encryption, logging and tags; unsupported integrations are rejected. | | DeleteStateMachine | State machines | Supported | Common | Reports DELETING, terminates executions at their next state transition and retires the definition, versions and aliases once executions have closed. Express deletion is eventually consistent. | | DescribeStateMachine | State machines | Supported | Common | Returns the adapter's definition, role, mode, revision and configuration. | | DescribeStateMachineForExecution | State machines | Supported | Most usage | Returns the immutable definition and revision selected for a Standard execution. | | ListStateMachines | State machines | Supported | Common | Lists state machines using opaque pagination tokens. | | UpdateStateMachine | State machines | Supported | Common | Creates a new revision for subsequent executions; active executions retain their selected definition and runtime version. | | ListTagsForResource | Tags | Supported | Full surface | Returns the resource's tags. | | TagResource | Tags | Supported | Full surface | Attaches tags to state-machine or Activity records. | | UntagResource | Tags | Supported | Full surface | Removes tags from the adapter's resource record. | | CreateStateMachineAlias | Versions and aliases | Supported | Most usage | Stores weighted routing to one or two versions; each new execution retains the selected version. | | DeleteStateMachineAlias | Versions and aliases | Supported | Full surface | Deletes the alias without interrupting executions previously started through it. | | DeleteStateMachineVersion | Versions and aliases | Supported | Full surface | Deletes an unreferenced version; a version used by an alias cannot be deleted. | | DescribeStateMachineAlias | Versions and aliases | Supported | Full surface | Returns the alias and routing configuration. | | ListStateMachineAliases | Versions and aliases | Supported | Full surface | Lists aliases with pagination. | | ListStateMachineVersions | Versions and aliases | Supported | Most usage | Lists published versions with pagination. | | PublishStateMachineVersion | Versions and aliases | Supported | Most usage | Publishes an immutable numbered revision. | | UpdateStateMachineAlias | Versions and aliases | Supported | Full surface | Updates routing for subsequent starts; existing executions keep their selected version. | #### How Step Functions runs on self-hosted Temporal Your application calls the Step Functions API in the target environment. A Tensor9 service adapter stores state-machine definitions, revisions, versions and aliases. For a Standard execution, a Tensor9-maintained worker reads the selected Amazon States Language definition and interprets it as a Temporal workflow. The same worker runs many definitions; your team does not maintain generated application code. The Temporal service and its persistence database run in the selected deployment environment. Workers use its task queues, durable timers and execution history to resume after a worker restart. The adapter retains the AWS execution ARN and translates execution status and history back into Step Functions responses. An Express execution uses the adapter's separate, short-lived execution path. #### Tasks, callbacks and an approval example A Task Resource identifies an AWS integration, not a Temporal workflow type. The adapter resolves the requested operation through the service mappings available in the deployment and checks the execution role before dispatch. Temporal activities perform external calls; the interpreter controls ASL Retry and Catch so a native retry does not silently create another business attempt. AWS Activities remain a separate queue served through GetActivityTask. Consider an order awaiting approval through .waitForTaskToken. The adapter associates the token with the active task attempt while the Temporal workflow waits. An authorized SendTaskSuccess or SendTaskFailure call records that attempt's result and wakes the workflow. A transport acknowledgment alone does not complete the task. A .sync task instead observes the submitted job until its terminal result. Parallel branches and Map items use child workflows. The interpreter retains item order, concurrency limits and the distinction between an item retry and a retry of the containing Map. Continue-as-new and worker upgrades preserve the public execution identity and the definition revision. #### Debugging and worker upgrades Temporal Web UI is the operator interface for Standard workflow execution. Its history, pending activities and timers help distinguish a stuck external call from an execution waiting for a callback. It does not reproduce the AWS console's ASL graph or highlighted state path. GetExecutionHistory supplies the Step Functions view of a Standard execution; access to decoded payloads requires separate authorization. Tensor9 maintains the interpreter and compatible worker versions. Running executions keep their program and evaluator versions during an upgrade. Your deployment operator maintains Temporal service availability, database backups and restoration procedures. Retaining a Helm release without protecting the persistence database is insufficient for recovery. #### Limitations Where Step Functions and self-hosted Temporal differ * **Service integrations depend on the deployment.** A Task can call only an operation and invocation pattern supplied by its service mapping. A Glue or SageMaker ARN does not become executable merely because Temporal can schedule an activity. * **External effects retain their own retry rules.** Workflow replay does not make a remote, non-idempotent operation safe to submit twice. The integration's recovery and cancellation behavior applies to work already accepted by that service. * **Capacity comes from the installed cluster.** Worker capacity, persistence throughput and Temporal history limits constrain concurrency. ASL MaxConcurrency is an upper bound, not a throughput reservation. * **AWS console and telemetry endpoints change.** Use Temporal Web UI and deployment logs. X-Ray tracing is rejected when enabled, and configured logs do not go to AWS CloudWatch Logs. * **Express has a different execution model.** It has no Standard execution-history API and cannot use Activities, Distributed Map, .sync or .waitForTaskToken. #### Other considerations * **Cutover.** Deploy definitions, versions and aliases through the Step Functions API. Existing AWS executions and callbacks finish against AWS; their running state and history are not imported. * **Operations.** The deployment operator owns the Temporal cluster, persistence, backups, network access and service upgrades. Tensor9 maintains the adapter and interpreter workers. Infrastructure and operating costs include the workers and database as well as the Temporal services. * **Data and credentials.** Protect both the adapter's records and Temporal's history. Configure authentication and encryption for the cluster and restrict Web UI access; namespace naming alone is not authorization. * **Changing engines.** A backend change applies to new executions. Retain the old workers, credentials and callback routes until their executions and retention obligations finish. Temporal documents the [self-hosted service](https://github.com/temporalio/documentation/blob/main/docs/production-deployment/self-hosted-guide/index.mdx) and [Web UI](https://docs.temporal.io/web-ui). ### Via Temporal Cloud (Managed) | Capability | Area | Support | Required tier | Operations | Notes | | ----------------------------- | ---------------------- | ------------ | ------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | ASL state types and data flow | Amazon States Language | Supported | - | - | Pass, Succeed, Fail, Choice, Wait, Task, Parallel and Map use the generic interpreter, including paths, intrinsic functions, JSONata, variables and Assign. | | Map and Parallel | Amazon States Language | Supported | - | - | Child workflows preserve branch and item ordering, dynamic concurrency, item-level retries and failure thresholds. Capacity admission may delay runnable items. | | Retry, Catch and timeouts | Amazon States Language | Supported | - | - | The interpreter controls ASL retries, error matching, backoff and jitter; transport retries do not silently add business attempts. Temporal timers drive waits and timeout handling. | | Encryption configuration | Configuration | Supported | - | - | Customer-managed encryption uses the deployment's KMS mapping for adapter records and a worker payload codec for Temporal payloads; decoded history requires key authorization. | | Logging configuration | Configuration | Partial | - | - | The configured destination and includeExecutionData setting control deployment logs. Logs do not reach AWS CloudWatch Logs. | | Tracing configuration | Configuration | Out of scope | - | - | Enabling AWS X-Ray tracing is rejected; X-Ray is not supplied by this mapping. | | EXPRESS workflows | Execution model | Supported | - | - | The adapter executes Express separately within five minutes, without Standard API history. Activities, Distributed Map, .sync, callbacks and Standard-only execution APIs are unavailable for Express. | | STANDARD workflows | Execution model | Supported | - | - | Temporal persists Standard execution history and timers. The interpreter preserves the execution identity across worker restart and continue-as-new; external side effects retain their integration's idempotency rules. | | Service integrations | Integrations | Partial | - | - | Task resources, .sync, .waitForTaskToken and Task.Credentials are supported only where the deployment has the corresponding service mapping and authorization. Unsupported combinations are rejected at admission. | | AWS visual console | Operator interface | Out of scope | - | - | Temporal Web UI shows workflow history, timers and pending work. It does not reproduce the AWS console's ASL graph and highlighted execution path. | | Operation | Area | Support | Depth | Notes | | -------------------------------- | ------------------------ | -------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CreateActivity | Activities | Adapter-served | Most usage | Creates an AWS Activity record and a durable task queue served by the adapter; it is separate from Temporal's internal activities. | | DeleteActivity | Activities | Adapter-served | Full surface | Deletes the Activity and refuses subsequent completion for removed tasks. | | DescribeActivity | Activities | Adapter-served | Full surface | Returns the Activity ARN, name and creation time. | | GetActivityTask | Activities | Adapter-served | Most usage | Long-polls the adapter queue and gives one worker a task and attempt-specific token; workers connect to the adapter endpoint. | | ListActivities | Activities | Adapter-served | Full surface | Lists Activity records with pagination. | | SendTaskFailure | Activities and callbacks | Adapter-served | Most usage | Records the active attempt's error and cause and resumes ASL error handling. | | SendTaskHeartbeat | Activities and callbacks | Adapter-served | Full surface | Renews the active task's heartbeat window without extending its absolute timeout. | | SendTaskSuccess | Activities and callbacks | Adapter-served | Most usage | Durably records completion of the active task attempt and wakes the Temporal workflow; stale tokens are refused and a transport acknowledgment is insufficient. | | TestState | Diagnostics | Supported | Full surface | Evaluates a single state through the same ASL evaluator; an external Task call requires the caller's authorization and a supported integration. | | ValidateStateMachineDefinition | Diagnostics | Supported | Most usage | Validates ASL without creating a resource and reports diagnostics, including unsupported Task resources and invocation patterns. | | DescribeMapRun | Distributed Map | Supported | Most usage | Returns Map Run status, item counts, concurrency and tolerated-failure settings. | | ListMapRuns | Distributed Map | Supported | Full surface | Lists an execution's Map Runs. | | UpdateMapRun | Distributed Map | Supported | Full surface | Updates concurrency and failure thresholds in the running interpreter; an update that cannot reach it fails explicitly. Existing child work is retained. | | DescribeExecution | Executions | Supported | Common | Returns Standard execution status, input, output, failure and redrive details through the adapter's execution record. | | GetExecutionHistory | Executions | Supported | Most usage | Returns Step Functions events in causal order, including event links and timestamps; Temporal history is translated into the public event model. Express has no API history. | | ListExecutions | Executions | Supported | Common | Lists Standard executions by state machine or Map Run, with status filters and pagination. | | RedriveExecution | Executions | Supported | Most usage | Resumes eligible unsuccessful Standard work under the same execution identity and revision within the redrive window; successful states are retained and rerun states reset their retry counters. | | StartExecution | Executions | Supported | Common | Admits a Standard execution durably and runs the selected ASL revision as a Temporal workflow. Standard name/input deduplication is kept; Express uses a separate short-lived execution path and fresh starts are not deduplicated. | | StartSyncExecution | Executions | Supported | Most usage | Returns the result of an Express execution within its five-minute limit, including execution failures in the response body; caller disconnection does not cancel accepted work. | | StopExecution | Executions | Supported | Common | Stops the Standard workflow and records ABORTED with the supplied error and cause; cancellation of an already accepted external effect depends on its integration. | | CreateStateMachine | State machines | Supported | Common | Validates ASL and stores the definition, role, mode, encryption, logging and tags; unsupported integrations are rejected. | | DeleteStateMachine | State machines | Supported | Common | Reports DELETING, terminates executions at their next state transition and retires the definition, versions and aliases once executions have closed. Express deletion is eventually consistent. | | DescribeStateMachine | State machines | Supported | Common | Returns the adapter's definition, role, mode, revision and configuration. | | DescribeStateMachineForExecution | State machines | Supported | Most usage | Returns the immutable definition and revision selected for a Standard execution. | | ListStateMachines | State machines | Supported | Common | Lists state machines using opaque pagination tokens. | | UpdateStateMachine | State machines | Supported | Common | Creates a new revision for subsequent executions; active executions retain their selected definition and runtime version. | | ListTagsForResource | Tags | Supported | Full surface | Returns the resource's tags. | | TagResource | Tags | Supported | Full surface | Attaches tags to state-machine or Activity records. | | UntagResource | Tags | Supported | Full surface | Removes tags from the adapter's resource record. | | CreateStateMachineAlias | Versions and aliases | Supported | Most usage | Stores weighted routing to one or two versions; each new execution retains the selected version. | | DeleteStateMachineAlias | Versions and aliases | Supported | Full surface | Deletes the alias without interrupting executions previously started through it. | | DeleteStateMachineVersion | Versions and aliases | Supported | Full surface | Deletes an unreferenced version; a version used by an alias cannot be deleted. | | DescribeStateMachineAlias | Versions and aliases | Supported | Full surface | Returns the alias and routing configuration. | | ListStateMachineAliases | Versions and aliases | Supported | Full surface | Lists aliases with pagination. | | ListStateMachineVersions | Versions and aliases | Supported | Most usage | Lists published versions with pagination. | | PublishStateMachineVersion | Versions and aliases | Supported | Most usage | Publishes an immutable numbered revision. | | UpdateStateMachineAlias | Versions and aliases | Supported | Full surface | Updates routing for subsequent starts; existing executions keep their selected version. | #### How Step Functions uses Temporal Cloud Your application keeps using the Step Functions API in the target environment. A Tensor9 service adapter stores definitions, revisions, versions and aliases, then starts Standard executions in a Temporal Cloud namespace owned by the customer. Tensor9-maintained interpreter workers run beside the adapter in the deployment environment and evaluate the original Amazon States Language definition. Temporal operates the workflow service and stores execution history in the namespace's selected region. The workers execute the orchestration code and service calls. Temporal Cloud does not host these workers. An Express execution follows the adapter's separate, short-lived execution path. #### Connecting the namespace Connect an existing customer-owned namespace using its full namespace ID, endpoint and an authorized credential. The initial connection uses mutual TLS. Namespace creation, billing and account administration remain with the customer; deploying or removing the adapter does not create or delete that namespace. The workers need network access to Temporal Cloud and to the service adapters used by Tasks. An application on Azure, GCP, Kubernetes or OCI can use the namespace independently of where its managed history is stored. Select the namespace region and connectivity to meet the deployment's residency requirements. This option requires access to the managed service and does not serve a disconnected deployment. #### An execution waiting for approval StartExecution returns an AWS execution ARN while the Standard workflow runs. The interpreter uses Temporal timers for Wait states, activities for external calls, and child workflows for Parallel branches and Map items. ASL Retry and Catch determine the business attempts; the integration adapter resolves ambiguous service responses under its own idempotency rules. For an approval task using .waitForTaskToken, an authorized callback reaches the Step Functions adapter in the deployment environment. The adapter records completion for the exact active attempt and delivers it to the workflow in Temporal Cloud. The caller receives success only after the task disposition is durable. An engine notification alone is insufficient. If a worker restarts during the wait, a compatible worker resumes from Temporal's history. The execution keeps its AWS identity, selected definition and worker version. Moving the deployment to a different engine affects subsequent starts and does not move this active approval. #### Limitations Where Step Functions and Temporal Cloud differ * **Managed history leaves the deployment environment.** Temporal Cloud stores workflow history and any encoded payloads in the selected namespace region. Payload encryption does not move that storage into the local cluster; avoid secrets in searchable metadata. * **The namespace does not provide AWS integrations.** A Task Resource must resolve to a supported service operation and invocation pattern in the deployment. .sync and callback behavior depend on that integration. * **Service capacity and worker capacity both matter.** Namespace limits, history size, worker slots and downstream service limits affect throughput. Selecting Temporal Cloud does not reserve concurrency for every Map item. * **Debugging uses Temporal's interface.** Temporal Web UI exposes workflow history and pending work rather than the AWS console's visual ASL graph. Payload decoding requires authorized access. Logs use the deployment's logging destination; X-Ray tracing is rejected when enabled. * **Express restrictions remain.** Express executions have no Standard execution-history API and cannot use Activities, Distributed Map, .sync or .waitForTaskToken. #### Other considerations * **Responsibility and cost.** Temporal operates the managed service. The customer owns the account, namespace, credentials and billing. Tensor9 maintains the service adapter and interpreter workers, whose compute still runs in the deployment environment. * **Retention and encryption.** Set namespace retention together with the adapter's history and redrive retention requirements. Configure the worker payload codec and key access when using customer-managed encryption. Web UI access and permission to decode payloads are separate controls. * **Cutover.** Deploy definitions, versions and aliases through the adapter. Existing AWS executions finish there; active executions, outstanding tokens and historical runs are not imported into Temporal Cloud. * **Connection lifecycle.** Rotate namespace credentials while retaining access for existing executions. An adapter removal releases its connection and owned workers, leaving the customer's namespace and unrelated workflows intact. See Temporal's [namespace and region configuration](https://docs.temporal.io/cloud/namespaces), [worker architecture](https://docs.temporal.io/encyclopedia/architecture/temporal-sdks) and [Web UI documentation](https://docs.temporal.io/web-ui). ## On Azure ### Via Azure Durable Functions | Capability | Area | Support | Required tier | Operations | Notes | | ----------------------------- | ---------------------- | ------------ | ------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data flow and expressions | Amazon States Language | Supported | - | - | InputPath, Parameters, ResultSelector, ResultPath, OutputPath, intrinsic functions, JSONata, variables and Assign are evaluated by the orchestrator | | Distributed Map | Amazon States Language | Supported | - | - | a Map Run fans out into child orchestrations within MaxConcurrency; item slots and ordered output survive a worker restart, an item retry never becomes a whole-Map retry, and UpdateMapRun reaches children already running or fails with a named error. A large Map Run is paced by shared admission and backpressure without any change to its semantics | | Error handling | Amazon States Language | Supported | - | - | Retry and Catch with backoff, jitter and error matching; a retried attempt is one explicit attempt and is never multiplied by the platform's own retry | | Parallel and inline Map | Amazon States Language | Supported | - | - | branches and items run as child orchestrations and their outputs are aggregated in order | | Wait states and timeouts | Amazon States Language | Supported | - | - | a Wait is a durable timer held as a scheduled message in the task hub, whether it lasts seconds or months; state and execution timeouts fire as States.Timeout | | Encryption configuration | Configuration | Supported | - | - | a customer-managed key names a key served by the KMS mapping on the same appliance (Key Vault on Azure); definitions and execution payloads are encrypted under it and become unreadable when it is revoked | | Logging configuration | Configuration | Partial | - | - | includeExecutionData decides whether execution payloads are written at all, and the configured destination decides whose log they reach; the destination is served by the appliance's logging, since CloudWatch Logs is a service the appliance does not adapt | | Tracing configuration | Configuration | Out of scope | - | - | X-Ray is not adapted, so a configuration that enables tracing is rejected at CreateStateMachine and UpdateStateMachine rather than stored and ignored | | EXPRESS workflows | Execution model | Supported | - | - | an Express execution is an inline run in the adapter with no durable record, within the 5-minute ceiling; as on AWS it has no history through the API, cannot use Activities, Distributed Map, .sync or .waitForTaskToken, and DescribeStateMachineForExecution, GetExecutionHistory, ListExecutions, RedriveExecution and StopExecution refuse it. A fresh Express start is never deduplicated, and an interrupted delivery is retried under the same accepted start | | STANDARD workflows | Execution model | Supported | - | - | exactly-once execution with a durable record, up to one year | | Service integrations | Integrations | Partial | - | - | a Task Resource naming an AWS service is served by that service's mapping on the same appliance, including the .sync and .waitForTaskToken patterns, nested executions and Task.Credentials role overrides; a Resource naming a service the appliance does not serve is refused at CreateStateMachine | | Payload and definition limits | Limits | Supported | - | - | the 256 KiB ceiling on inputs, outputs and state payloads and the 1 MB definition ceiling are enforced at the API, so a definition that fits on AWS fits here | | Operation | Area | Support | Depth | Notes | | -------------------------------- | -------------------- | -------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CreateActivity | Activities | Adapter-served | Most usage | an Activity is a record and a task queue the adapter itself serves, since Azure has no resource that an outside worker long-polls by name | | DeleteActivity | Activities | Adapter-served | Full surface | deletes the Activity even while workers hold tasks from it, as on AWS; a worker's next SendTaskSuccess for such a task answers TaskDoesNotExist | | DescribeActivity | Activities | Adapter-served | Full surface | returns the Activity's ARN, name and creation date | | GetActivityTask | Activities | Adapter-served | Most usage | holds the poll open for up to 60 seconds and hands one task to one worker with a task token the adapter mints; an empty poll returns a null token, so workers keep the 65-second socket timeout AWS recommends | | ListActivities | Activities | Adapter-served | Full surface | lists the Activities | | SendTaskFailure | Activities | Adapter-served | Most usage | fails the task with the error and cause supplied | | SendTaskHeartbeat | Activities | Adapter-served | Full surface | renews the task's heartbeat window; a task whose heartbeat lapses fails with States.Timeout | | SendTaskSuccess | Activities | Adapter-served | Most usage | completes the task the token identifies, once; a stale or unknown token is refused | | TestState | Diagnostics | Supported | Full surface | runs a single state through the same evaluator without starting an execution; a Task state that reaches a real service does so under the caller's own authorization | | ValidateStateMachineDefinition | Diagnostics | Supported | Most usage | validates a definition without creating anything and returns the diagnostics with their severity; a Task whose Resource names a service the appliance does not serve is reported here | | DescribeMapRun | Distributed Map | Supported | Most usage | returns the Map Run's status, item counts, tolerated-failure settings and concurrency | | ListMapRuns | Distributed Map | Supported | Full surface | lists the Map Runs of an execution | | UpdateMapRun | Distributed Map | Supported | Full surface | changes MaxConcurrency or the tolerated-failure thresholds of a running Map Run; child runs already in flight continue | | DescribeExecution | Executions | Supported | Common | returns status, input, output, error, cause and redrive details for the execution | | GetExecutionHistory | Executions | Supported | Most usage | returns the execution's transitions as Step Functions events with ids, previous-event ids and timestamps in causal order, derived from the orchestration's record; EXPRESS executions have no history through the API, as on AWS | | ListExecutions | Executions | Supported | Common | lists executions by state machine or Map Run, filtered by status and redrive filter, with opaque pagination tokens | | RedriveExecution | Executions | Supported | Most usage | resumes a failed, aborted or timed-out STANDARD execution from its unsuccessful states within 14 days of closing, under the same execution ARN and revision; successful states are not rerun, retry counters on the rerun states reset, and on a Distributed Map only the failed child runs restart | | StartExecution | Executions | Supported | Common | admits the execution, pins its revision and returns while it runs: a STANDARD execution as a Durable Functions orchestration, an EXPRESS execution as an inline run with no durable record. A STANDARD start with the name and input of a running execution returns the original response; a closed execution or a different input returns ExecutionAlreadyExists, and a name is reusable 90 days after it closes. EXPRESS starts are never deduplicated | | StartSyncExecution | Executions | Supported | Most usage | the synchronous result API of an EXPRESS state machine: the request is held open until the inline run completes or the 5-minute ceiling passes, a failed run is reported in the response body, and a caller that disconnects does not cancel accepted work | | StopExecution | Executions | Supported | Common | terminates the orchestration and records the ABORTED outcome with the error and cause supplied | | CreateStateMachine | State machines | Supported | Common | validates the Amazon States Language definition and records the state machine with its role, type, encryption, logging and tags; the definition is kept as written and interpreted at run time, so nothing is rewritten by hand | | DeleteStateMachine | State machines | Supported | Common | succeeds at once and the state machine reads DELETING; it is retired when its running executions have completed, and its versions and aliases are retired with it | | DescribeStateMachine | State machines | Supported | Common | returns the definition, role, type, revision and configuration from the adapter's record | | DescribeStateMachineForExecution | State machines | Supported | Most usage | returns the exact definition and revision an execution runs, which is pinned when the execution starts | | ListStateMachines | State machines | Supported | Common | lists state machines with opaque pagination tokens | | UpdateStateMachine | State machines | Supported | Common | replaces the definition, role or configuration and returns a new revision; executions already running keep the revision they started on | | ListTagsForResource | Tags | Supported | Full surface | lists the tags on a state machine or Activity | | TagResource | Tags | Supported | Full surface | attaches tags to a state machine or Activity | | UntagResource | Tags | Supported | Full surface | removes tags | | CreateStateMachineAlias | Versions and aliases | Supported | Most usage | an alias routes to one or two versions by weight; an execution started through the alias pins the version it was routed to | | DeleteStateMachineAlias | Versions and aliases | Supported | Full surface | deletes the alias; executions it routed keep running | | DeleteStateMachineVersion | Versions and aliases | Supported | Full surface | deletes a version; refused while an alias still routes to it, as on AWS | | DescribeStateMachineAlias | Versions and aliases | Supported | Full surface | returns the alias and its routing configuration | | ListStateMachineAliases | Versions and aliases | Supported | Full surface | lists the aliases of a state machine | | ListStateMachineVersions | Versions and aliases | Supported | Most usage | lists the published versions | | PublishStateMachineVersion | Versions and aliases | Supported | Most usage | publishes the current revision as an immutable numbered version | | UpdateStateMachineAlias | Versions and aliases | Supported | Full surface | changes the routing for executions started afterwards; running executions are unaffected | #### How it works Your application keeps calling the Step Functions API. In the target environment those calls reach a Tensor9 service adapter instead of AWS. The adapter holds each state machine as a record: the Amazon States Language definition as you wrote it, the execution role, the type, the versions, the aliases and the tags. It answers every `states:` operation from that record and from the executions it has admitted. A Standard execution is a Durable Functions orchestration instance; an Express execution runs inline in the adapter and leaves no durable record, as on AWS. StartExecution admits the execution, pins the revision it will run, and for a Standard execution hands it to an orchestrator function that Tensor9 maintains and deploys into an Azure Functions app in the target environment. That orchestrator is generic: it interprets the definition state by state, so a state machine is never rewritten into orchestrator code and an UpdateStateMachine deploys nothing. Durable timers serve Wait states, activity functions serve Task states, sub-orchestrations serve Parallel branches and Map items, and external events serve callbacks and task tokens; StopExecution terminates the instance. Durable Functions checkpoints the orchestration's progress in its task hub, so an execution survives a restart of the function app or of the adapter and resumes where it left off. GetExecutionHistory returns Step Functions events built from that record in causal order; the platform's own replay events are not part of it. A Task state's Resource names an AWS service, and it is served by that service's mapping on the same appliance: a Lambda ARN invokes the function the Lambda mapping runs, an SQS or SNS integration reaches the queue or topic served there, and a `.waitForTaskToken` integration parks the orchestration on an external event until SendTaskSuccess or SendTaskFailure arrives. Each Task effect is authorized against the state machine's execution role, or the Task.Credentials role where one is set, before it is made, and the call itself travels on the appliance's own identity; no AWS credential is involved. #### Azure resources behind a deployment Two Azure resources sit behind a Step Functions deployment: a function app on a Premium plan, which gives the orchestrator always-ready instances and virtual-network access, and a storage account whose task hub holds orchestration history and queued work. Both are owned in the target environment. Tensor9 deploys its orchestrator code into the function app and upgrades it, and removing a backend selection never deletes the function app or the storage account. In the Azure portal you see orchestration instances named by the adapter, activity invocations, and the storage account's queues and tables. State machines, executions and ARNs are not Azure resources; they exist in the adapter's record and are what the Step Functions API returns, so DescribeExecution, ListExecutions and GetExecutionHistory are the way to observe an execution, exactly as on AWS. #### Limitations * **Activities are served by the adapter.** Azure has no resource that a worker outside the platform long-polls by name, so an Activity is a queue the adapter itself serves: GetActivityTask holds the poll open for up to 60 seconds, the task token is minted by the adapter, and SendTaskSuccess, SendTaskFailure and SendTaskHeartbeat are checked against it. Workers need no code change; they must reach the adapter's endpoint. - **Large Map Runs are paced by the appliance.** A Map Run becomes N child orchestrations within MaxConcurrency, and a large one is admitted with backpressure rather than all at once; its semantics do not change. An UpdateMapRun that cannot reach children already running fails with a named error instead of reporting a change that did not happen. - **Logs and traces do not reach CloudWatch or X-Ray.** `includeExecutionData` decides whether execution payloads are written at all and the configured destination decides whose log they reach; the destination is served by the appliance's logging, since CloudWatch Logs is a service the appliance does not adapt. A `tracingConfiguration` that enables X-Ray tracing is rejected at CreateStateMachine and UpdateStateMachine, because X-Ray is not adapted and a setting that is stored but ignored would misreport what runs. - **Service integrations are bounded by the appliance.** A Task state reaches the services adapted on the same appliance. A Resource naming a service the appliance does not serve is reported by ValidateStateMachineDefinition and refused at CreateStateMachine with an error naming the state; a definition is never admitted only to fail on its first execution. - **The engine choice is fixed per execution.** Which engine runs a state machine is chosen per deployment and recorded with each execution. Changing it affects executions started afterwards; executions already running, their history and their outstanding task tokens stay on the engine they started on until they complete and their retention expires. Nothing migrates a live execution. #### Other considerations * **Migration.** State machines are created by your own deployment: applying your Step Functions resources against the adapter creates them through CreateStateMachine, versions and aliases included. Executions do not migrate. One started on AWS completes on AWS, one started after cutover runs on Azure, and AWS execution history is not copied. - **Who operates what.** The function app and the storage account are owned in the target environment and operated by Microsoft. Tensor9 maintains the orchestrator code deployed into the function app, upgrades it, and operates the adapter; an upgrade keeps in-flight orchestrations on the orchestrator version they started with, so a running execution is not replayed against changed code. - **Cost shape.** AWS bills a Standard execution per state transition and an Express one per run, duration and memory. On Azure the cost is the Premium plan's instances, which run whether or not executions are in flight, plus storage transactions on the task hub. - **Durability.** Orchestration state lives in the storage account; the adapter's own record of state machines, versions, aliases and Activities lives in the appliance's durable store. Both are in the target environment. [Service Catalog](/byoc/service-adapters/catalog).