AWS Migration Checklist

Recommended: Root account (management), Security account, Log archive account, Production account(s), Dev/Test accounts.

Root credentials should almost never be used. Enable MFA and do not create access keys for root.

Control Tower automatically applies security guardrails (SCPs) across all accounts.

Config records all resource changes and evaluates compliance rules. Required for most security frameworks.

CloudTrail is your audit log. Store immutably in a dedicated security/logging account.

Prevent bill shock by alerting before overspend occurs, not after the monthly bill arrives.

Trusted Advisor recommends cost savings, security improvements, and performance optimisations.

Plan your IP space carefully. Overlapping CIDRs prevent VPN/Direct Connect and VPC peering.

3-tier subnet model: public (ALB/NAT), private app (EC2/ECS), private data (RDS). Span minimum 2 AZs.

Private subnets need NAT Gateway for outbound internet access (software updates, API calls).

Flow logs capture accepted and rejected traffic at the ENI level. Essential for security investigation.

Required for migration traffic and hybrid operation during the transition period.

Security groups are your primary cloud firewall. Restrict inbound to known IPs and required ports only.

NACLs are stateless — remember to add both inbound and outbound rules for ephemeral ports.

MGN continuously replicates servers to AWS, enabling a quick cutover with minimal downtime.

Use AWS Compute Optimizer or CloudWatch metrics to choose the right instance family and size.

Create AMIs before cutover — they serve as your rollback snapshot if issues surface post go-live.

Replace fixed instance counts with ASG min/max/desired for resilience and cost efficiency.

ALB for HTTP/HTTPS applications, NLB for TCP/UDP or high-performance requirements.

Test connectivity from DMS replication instance to both source DB and target RDS before starting migration.

Test your DMS task configuration on a copy of production data before running on live data.

SCT converts schema DDL, stored procedures, functions, and views between engines (e.g. Oracle to Aurora PostgreSQL).

Multi-AZ provides synchronous standby replica in a different AZ with automatic failover. Required for production.

Set retention to at least 7 days. Enable point-in-time recovery (PITR) for fine-grained restore points.

Default parameter groups are conservative. Review and tune connection limits, query cache, and logging parameters.

Use EC2 instance profiles and ECS task roles. Never hardcode credentials in code or config files.

Rotate secrets automatically. Audit secret access via CloudTrail.

Prevent accidental public bucket exposure — a leading cause of data breaches.

GuardDuty uses ML to detect account compromise, cryptomining, reconnaissance, and data exfiltration.

Security Hub aggregates findings from GuardDuty, Inspector, Config, Macie, and third-party tools.

Enable default EBS encryption in each region and account to ensure all new volumes are encrypted.

Encryption must be enabled at creation time. You cannot encrypt an existing unencrypted RDS instance directly.

Add a bucket policy with aws:SecureTransport: false deny to force HTTPS only.