Multi-Account AWS Workload Migration

The Problem #

A full set of production tenant workloads — Aurora MySQL databases, ECS services, and supporting resources — needed to move from a legacy AWS account across four accounts, with minimal downtime and a process auditable enough for a non-engineer to execute from a runbook.

What I Built #

• Step Functions state machine orchestrating Lambda-driven tasks: seeding, validation, DNS cutover, with retry logic at each step
• seed.py: mysqldump with compression and DEFINER stripping, piped through pv for progress, credential fetching from Secrets Manager, row-count validation; runs on EC2 assuming cross-account IAM roles
• Cutover: Route53 + Cloud Map DNS alias flip — atomic, instant rollback, no app restarts needed
• Validation: row counts and checksums compared across all tables before any cutover
• Terraform: multi-account IAM roles, Secrets Manager cross-account replication, Step Functions infrastructure
• Runbook: detailed enough for an ops team member with no AWS background to execute

Details on the projects page.

Outcome #

• All workloads migrated with minimal downtime
• Retiring redundant infrastructure cut significant recurring cloud spend