How to Migrate Your Static IP's from Heroku to AWS Marketplace

If you are leaving Heroku for AWS but want to keep using QuotaGuard, the process is straightforward and you keep the same static IPs, the same connection URL, and the same credentials throughout. Most of the work happens on our side. You sign up through AWS Marketplace, tell us you are ready, and we move the ownership of your existing subscription onto your new AWS account.

This page is the AWS-specific version of our direct migration guide. The backend swap works the same way, but AWS Marketplace has an important account limitation for customers with multiple subscriptions. Read the multiple-subscription section below before purchasing any AWS contracts.

How long will this take you? About 15 to 20 minutes of active work on your end, and you can spread it over a day or two if you want to monitor traffic in between steps. The backend swap on our side runs whenever you tell us you are ready, and from that go-ahead it takes about 2 minutes.

What’s Different About AWS Marketplace

AWS Marketplace plans bill on a monthly cycle with no annual commitment. A few things follow from that:

• You are billed monthly, starting when AWS confirms your subscription.
• Plan upgrades take effect immediately.
• Plan downgrades require you to cancel your current plan, wait until the end of your billing period, then subscribe at the lower tier. AWS does not allow direct downgrades.
• Cancellation takes effect at the end of your current billing period. AWS does not issue partial-month refunds.

For details on plan changes and cancellation through AWS, see How to Change or Cancel Your AWS Plan.

Important: Multiple Subscriptions Require Multiple AWS Accounts

An AWS buyer account can have only one active contract for each QuotaGuard Marketplace listing. Each contract provisions one QuotaGuard subscription on one plan.

That means:

• One QuotaGuard Shield subscription can be billed through an AWS account.
• One QuotaGuard Static subscription can be billed through an AWS account.
• One Shield subscription and one Static subscription can share the same AWS account because they are separate Marketplace listings.
• A second Shield subscription requires a different AWS account.
• A second Static subscription requires a different AWS account.

If you are migrating several subscriptions of the same product, the usual approach is to use separate member accounts under your AWS Organization. Each member account subscribes to the appropriate Marketplace listing, selects the matching plan, and registers its own QuotaGuard login.

If you do not want to operate multiple AWS accounts, you can move some or all of the subscriptions to direct QuotaGuard billing instead. Direct billing supports multiple QuotaGuard subscriptions under one account while preserving the existing IPs, credentials, and connection URLs through the same backend migration process.

Before starting a multi-subscription migration, map each existing Heroku add-on to its destination AWS account, Marketplace listing, and plan. If you are unsure how many AWS accounts you need, email Support before subscribing.

Prepare to Migrate from Heroku to AWS

Step 1. Sign up on AWS Marketplace.

QuotaGuard is available as two AWS Marketplace listings. Pick the one that matches your current Heroku add-on:

• QuotaGuard Static for the traditional static IP proxy.
• QuotaGuard Shield for the SSL passthrough product (often required for financial, healthcare, or other regulated traffic).

If you are migrating one subscription, open the matching listing in the AWS account that will own it. If you are migrating several subscriptions, first use the account mapping described above. Do not try to create a second subscription for the same QuotaGuard product in one AWS account.

On the listing page, click View purchase options, pick the plan that matches your usage (typically the same tier you are on with Heroku, but you can pick any tier), and complete the AWS-side subscription.

Once AWS confirms the contract, the page will show a Set up your account button. Click that. You will be redirected to our site for a short registration form where you set the email address, password, and AWS region for your new QuotaGuard account. After you submit the form, your new AWS-linked subscription appears in our system and we can take it from there. For a multi-subscription migration, complete this setup separately in every AWS account and register a separate QuotaGuard login for each contract.

For a step-by-step walkthrough of the AWS-side signup with screenshots, see How to Sign Up for QuotaGuard on AWS.

Step 2. Back up your existing Heroku connection URL.

(You can skip this step if you are only using our Inbound Proxy. Not sure? Confirm with us in your Support ticket.)

Copy and save the contents of the QUOTAGUARDSTATIC_URL or QUOTAGUARDSHIELD_URL environment variable on your Heroku app. You will use it in Step 8 if needed.

Via the Heroku CLI:

QG_URL=`heroku config:get -a APPNAME QUOTAGUARDSTATIC_URL`
# or
QG_URL=`heroku config:get -a APPNAME QUOTAGUARDSHIELD_URL`

echo $QG_URL

This is a precaution, not strictly required. The same URL is also visible in your QuotaGuard dashboard at dash.quotaguard.com after the swap, so you can retrieve it from there if needed. Heroku will delete this environment variable when you eventually remove the add-on, so having it pre-saved keeps Step 8 quick.

Step 3. Email Support to initiate the swap.

Send an email to our Support team with:

• Your Heroku app name.
• The email address you used when setting up the QuotaGuard account through AWS in Step 1.
• Your current QuotaGuard subscription username (visible in your Heroku-side QuotaGuard dashboard) or the connection URL you backed up in Step 2.
• A note that you are ready to migrate your static IPs from Heroku to AWS.

If you are moving more than one subscription, provide this information for each subscription and identify which AWS-linked QuotaGuard login should receive which Heroku subscription. We can migrate them one at a time.

We queue these up during normal business hours and run the backend swap once we have your go-ahead.

What Happens During the Swap Window

The swap is entirely backend on our side. It runs whenever you tell us you are ready, and from that go-ahead it takes about 2 minutes, has no downtime, and requires no action from your team during the window. Your existing Heroku QUOTAGUARDSTATIC_URL (or QUOTAGUARDSHIELD_URL) environment variable keeps routing the same traffic to the same IPs throughout, so the swap itself cannot cause a production issue.

Under the hood, the swap moves the ownership of your original subscription (with your real IPs and connection URL) onto your new AWS Marketplace account. The temporary credentials from your AWS sign-up move the other way and end up on the Heroku side of our backend, where they sit unused until you remove the add-on.

The only steps with any visible impact on your side (removing the Heroku add-on, restoring the env var) happen later, on your schedule, potentially days or weeks after we complete the swap.

Verify and Cut Over

Step 4. Wait for confirmation.

Support will email you when the swap is complete on our side.

Step 5. Verify the swap.

After the swap completes, log into your QuotaGuard dashboard at dash.quotaguard.com using the email and password you set in Step 1. You will see your subscription listed there, with the same connection URL your Heroku app has been using all along. That confirms the swap is done and your original credentials are now under your AWS Marketplace account.

If you open QuotaGuard from the Heroku Resources tab after the swap, you will see a different URL. That is expected. The Heroku side of our backend now holds the temporary credentials from your AWS sign-up. They are not in use by your app, and they will be cleaned up automatically when you remove the Heroku add-on. You can safely ignore them.

Take Your Time Before Removing the Add-On

There is no rush to remove the Heroku add-on after the swap. We recommend confirming that normal traffic continues flowing through your same IPs, and watching that hold for an hour or two before you remove the add-on.

Step 6. Monitor traffic for an hour or two.

Check your application logs and confirm that traffic continues to flow through the same static IPs. Behavior should be identical to before the swap. If anything looks off, contact Support before going further. Rolling back at this point is fast (see the rollback section below).

Step 7. Remove the Heroku add-on.

When you are confident the swap succeeded, remove the QuotaGuard add-on from Heroku.

Via the Heroku CLI:

heroku addons:destroy -a APPNAME quotaguardstatic
# or
heroku addons:destroy -a APPNAME quotaguardshield

When you remove the add-on, Heroku will delete the QUOTAGUARDSTATIC_URL (or QUOTAGUARDSHIELD_URL) environment variable from your app. You will restore it in the next step.

Step 8. Restore the connection URL environment variable.

(If you are only using our Inbound Proxy, you can skip this step.)

Set the connection URL environment variable using the value you saved in Step 2 or copied from your QuotaGuard dashboard. If your application is still running on Heroku, restore it there. If you are moving the application to Render, Fly.io, Kubernetes, or another platform, set the same value in that platform’s environment configuration instead.

Via the Heroku CLI:

heroku config:set -a APPNAME QUOTAGUARDSTATIC_URL=$QG_URL
# or
heroku config:set -a APPNAME QUOTAGUARDSHIELD_URL=$QG_URL

If you would like us online when you make this change, let Support know ahead of time and we will arrange a window.

If You Need to Roll Back

Rollback is straightforward and depends on where you are in the process.

• Before you have removed the Heroku add-on: Email Support and we swap back. No action on your side. The AWS Marketplace subscription you created stays on your AWS account, you can cancel it through AWS Marketplace whenever you are ready (see Change or Cancel Your AWS Plan).
• After you have removed the Heroku add-on: Re-provision the QuotaGuard add-on on Heroku. Heroku will issue a new connection URL. Email Support and we swap back. Then restore your QUOTAGUARDSTATIC_URL (or QUOTAGUARDSHIELD_URL) env var to the original URL you used before so your app continues using the same IPs.

In either case, the same IPs you started with stay assigned to your subscription throughout, so there is no risk of losing the addresses your downstream partners have allowlisted.

Common Questions

Will traffic be interrupted during the swap? No. Your existing connection URL keeps working the entire time. The swap is a backend ownership change, your traffic path does not shift.

Do my static IP addresses change? No. Your IPs are tied to your subscription, not to the billing platform. They stay with you when ownership moves to AWS.

Can I move several QuotaGuard subscriptions into one AWS account? Only if they are different products. One AWS account can hold one QuotaGuard Shield contract and one QuotaGuard Static contract because they are separate Marketplace listings. It cannot hold two Shield contracts or two Static contracts. Each additional subscription of the same product requires another AWS account, such as a member account in your AWS Organization, or it can use direct QuotaGuard billing instead.

What if I picked the wrong plan when subscribing on AWS Marketplace? Upgrades happen immediately through AWS Marketplace. Downgrades require cancelling your current plan and subscribing at the lower tier after your current billing period ends. See How to Change or Cancel Your AWS Plan for the AWS-side mechanics.

What if I want to cancel my AWS subscription later? AWS Marketplace cancellation takes effect at the end of your current billing period and AWS does not issue partial-month refunds. The cancellation flow is documented at How to Change or Cancel Your AWS Plan. If you also want to keep your static IPs across the cancellation (for example, to move back to direct billing), contact Support before cancelling so we can plan the IP-preserving swap in advance.

Are there any code changes I need to make in my Heroku app? No, with one small bookkeeping step. The connection URL and credentials your app uses do not change. Once Heroku deletes the addon-managed env var (when you remove the add-on in Step 7), you set it back manually in Step 8 using the value you backed up or copied from your dashboard. No application code changes.

More questions we did not cover? Write us any time at Support.