The customer is an AI-native technology company building autonomous, agentic AI products. Its production, pre-production, and internal workloads had grown organically on Microsoft Azure across multiple regions and business units — spanning Kubernetes clusters, virtual machines, App Services, managed PostgreSQL and MySQL databases, Databricks workspaces, and a wide range of supporting storage, registry, and networking services. To gain broader regional coverage, native AI/ML services, mature multi-account governance, and stronger commercial alignment with its go-to-market motion, the customer elected to consolidate its entire estate onto AWS. Aivar partnered with the customer to design and execute a six-week migration programme that preserved operational continuity, minimized customer-visible downtime, and exited Azure with a clean cut.
The customer is an AI-native technology company building autonomous, agentic AI products. Its production, pre-production, and internal workloads had grown organically on Microsoft Azure across multiple regions and business units — spanning Kubernetes clusters, virtual machines, App Services, managed PostgreSQL and MySQL databases, Databricks workspaces, and a wide range of supporting storage, registry, and networking services. To gain broader regional coverage, native AI/ML services, mature multi-account governance, and stronger commercial alignment with its go-to-market motion, the customer elected to consolidate its entire estate onto AWS. Aivar partnered with the customer to design and execute a six-week migration programme that preserved operational continuity, minimized customer-visible downtime, and exited Azure with a clean cut.
No items found.
Customer Challenge
The customer needed to move a large, heterogeneous, multi-region Azure estate to AWS quickly and safely — without disrupting live customer engagements. Key challenges included:
Large, Heterogeneous Estate: Dozens of workloads across Kubernetes clusters, ~14 VMs, App Services and Function Apps, 12 managed PostgreSQL/MySQL databases, Redis, Databricks, 18 storage accounts, 20 container registries, and extensive networking — all to be migrated in six weeks.
Multi-Region Consolidation: Sprawl across several Azure regions in India and the United States had to be consolidated into two well-governed AWS regions.
Data Residency and Latency: India-resident workloads needed to stay in-region for latency and residency, while US workloads needed a clean, cost-effective home.
Operational Continuity: Multiple live customer-facing products had to keep running, with minimal downtime and a guaranteed path back if any cutover failed.
Governance and Security from Day Zero: The target needed enterprise-grade multi-account isolation, federated identity, guardrails, encryption, and centralized security — not bolted on later.
Identity Continuity: The customer wanted to retain Microsoft Entra ID as its identity provider and federate to AWS rather than re-platform identity.
Solution
Aivar designed and executed a six-week Azure-to-AWS migration built on a multi-account AWS Control Tower Landing Zone, following the AWS 6R framework with each workload mapped to its optimal disposition:
AWS Control Tower Landing Zone: A multi-account structure (Security, Infrastructure, Workloads, Sandbox, and Suspended OUs) governed by AWS Organizations, with preventive and detective guardrails via Service Control Policies and AWS Config.
Two-Region, Hub-and-Spoke Network: Workloads distributed across ap-south-1 (Mumbai) for India-resident data and us-east-2 (Ohio) for US workloads, each with a Transit Gateway hub, three-tier VPCs across three AZs, and private VPC endpoints.
Federated Identity: IAM Identity Center integrated with Microsoft Entra ID via SAML 2.0 and SCIM — no long-lived IAM users for human operators, least-privilege permission sets, and audited break-glass access.
6R Migration Execution: Kubernetes and App Service workloads replatformed to Amazon EKS; VMs rehosted to Amazon EC2 via AWS MGN; PostgreSQL/MySQL replatformed to Amazon RDS via AWS DMS (full-load + CDC); Function Apps refactored to AWS Lambda; Databricks repurchased on AWS; storage moved to Amazon S3/EFS via DataSync; registries mirrored to Amazon ECR.
Zero-Downtime Data Migration: Continuous replication with AWS MGN (block-level), AWS DMS (change data capture), and AWS DataSync kept targets in sync until cutover, with lag held under agreed thresholds.
Phased Cutover with Tested Rollback: Three migration waves (non-production, pre-production, production) with per-workload runbooks, rehearsed rollback, DNS swings at 60-second TTL, and defined rollback triggers on error rate, latency, and data integrity.
Security in Depth: KMS customer-managed keys, TLS everywhere, Secrets Manager rotation, AWS WAF on public ALBs, and centralized GuardDuty, Security Hub, Inspector, Config, and organization-wide CloudTrail from day zero.
Observability and FinOps: CloudWatch dashboards and alarms, EventBridge-routed alerting, and a mandatory cost-allocation tagging schema for spend visibility.
Architecture
The target AWS environment was built as a governed, two-region Landing Zone with each Azure service mapped to its AWS equivalent:
AWS Control Tower Landing Zone with Security, Infrastructure, Workloads, Sandbox, and Suspended OUs
Transit Gateway hub-and-spoke networking in ap-south-1 (Mumbai) and us-east-2 (Ohio), with inter-region peering
Amazon EKS for Kubernetes clusters and containerized App Services, with managed node groups and IRSA
Amazon EC2 (via AWS MGN) for Linux and Windows VM workloads
Amazon RDS for PostgreSQL and MySQL, migrated via AWS DMS full-load + CDC
AWS Lambda + API Gateway for refactored Function Apps
Amazon S3 and Amazon EFS for blob and NFS data, migrated via AWS DataSync
Amazon ECR for container images mirrored from Azure Container Registry
Amazon ElastiCache for Redis; Databricks on AWS for analytics workspaces
Azure-to-AWS 6R migration into a two-region AWS Control Tower Landing Zone (Mumbai + Ohio).
Key Outcomes
Full Estate Migrated in four Weeks: The entire in-scope Azure estate moved to AWS in a phased, three-wave programme, exiting Azure with a clean cut.
Governed Multi-Account Foundation: An AWS Control Tower Landing Zone with guardrails, OU isolation, and federated Entra ID identity established enterprise governance from day zero.
Minimal Downtime, Reversible Cutovers: Continuous replication plus per-workload runbooks and rehearsed rollback kept customer-visible downtime low and every cutover reversible.
Optimized Regional Footprint: Several Azure regions consolidated into two AWS regions — Mumbai for India-resident data and Ohio for US workloads — improving latency, residency, and cost.
Right-Sized via the 6R Framework: Each workload was rehosted, replatformed, refactored, repurchased, retired, or retained on its merits, modernizing where it added value.
Security and Cost Visibility Built In: Encryption, centralized threat detection, and a cost-allocation tagging schema gave the customer a secure, observable, cost-aware platform.
Operational Readiness: Knowledge-transfer sessions and a one-week hypercare period handed a fully documented, self-operable AWS environment to the customer's team.
Explore Other Case Studies
[ Read More ]
BY:
NIkhil Narayan
From Hours to Minutes: How BornFree Ceramics Transformed Their Quoting Operations
[ Read More ]
BY:
Kousik Rajendran
Migrating Critical Payment Infrastructure for a Leading Fintech Platform with AWS and Infrastructure as Code
[ Read More ]
BY:
Kousik Rajendran
Reva AI – Transforming Enterprise Policy Management with Generative AI on AWS
.svg)
.svg)
.svg)
.svg)
