AWS Cloud Migration Runbook: Zero-Downtime Production Template

# 1. AWS DMS Replication Instance
resource "aws_dms_replication_instance" "migration_runner" {
  replication_instance_id     = "prod-migration-instance"
  replication_instance_class  = "dms.c5.xlarge"
  allocated_storage           = 100
  multi_az                    = true
  publicly_accessible         = false
  apply_immediately           = true
  replication_subnet_group_id = aws_dms_replication_subnet_group.migration_subnets.id

  vpc_security_group_ids = [aws_security_group.dms_sg.id]
}

# 2. Source On-Premise Endpoint
resource "aws_dms_endpoint" "source_onprem" {
  endpoint_id   = "onprem-postgres-source"
  endpoint_type = "source"
  engine_name   = "postgres"
  server_name   = "db.onprem.internal"
  port          = 5432
  database_name = "payments_prod"
  username      = var.dms_user
  password      = var.dms_password
  ssl_mode      = "require"
}

# 3. Target Amazon Aurora Endpoint
resource "aws_dms_endpoint" "target_aurora" {
  endpoint_id   = "aurora-postgres-target"
  endpoint_type = "target"
  engine_name   = "aurora-postgresql"
  server_name   = aws_rds_cluster.aurora.endpoint
  port          = 5432
  database_name = "payments_prod"
  username      = var.aurora_user
  password      = var.aurora_password
  ssl_mode      = "require"
}

# 4. Continuous CDC Replication Task
resource "aws_dms_replication_task" "live_sync" {
  replication_task_id      = "sync-payments-continuous"
  migration_type           = "full-load-and-cdc"
  replication_instance_arn = aws_dms_replication_instance.migration_runner.replication_instance_arn
  source_endpoint_arn      = aws_dms_endpoint.source_onprem.endpoint_arn
  target_endpoint_arn      = aws_dms_endpoint.target_aurora.endpoint_arn

  table_mappings = jsonencode({
    rules = [
      {
        rule-type = "selection"
        rule-id   = "1"
        rule-name = "all-tables"
        object-locator = {
          schema-name = "public"
          table-name  = "%"
        }
        rule-action = "include"
      }
    ]
  })
}

# Traffic Route to On-Premises (Primary 90%)
resource "aws_route53_record" "api_onprem" {
  zone_id = var.hosted_zone_id
  name    = "api.yourcompany.com"
  type    = "A"
  ttl     = 60

  weighted_routing_policy {
    weight = 90
  }
  set_identifier = "onprem-primary"
  records        = [var.onprem_lb_ip]
}

# Traffic Route to AWS Cloud (Canary 10%)
resource "aws_route53_record" "api_aws" {
  zone_id = var.hosted_zone_id
  name    = "api.yourcompany.com"
  type    = "A"

  weighted_routing_policy {
    weight = 10
  }
  set_identifier = "aws-canary"
  alias {
    name                   = aws_lb.alb.dns_name
    zone_id                = aws_lb.alb.zone_id
    evaluate_target_health = true
  }
}

# 1. Flip Route 53 weight back to 100% on-premises
aws route53 change-resource-record-sets --hosted-zone-id $ZONE_ID --change-batch '{
  "Changes": [
    {"Action": "UPSERT", "ResourceRecordSet": {"Name": "api.yourcompany.com", "Type": "A", "SetIdentifier": "onprem-primary", "Weight": 100, "TTL": 60, "ResourceRecords": [{"Value": "'$ONPREM_IP'"}]}},
    {"Action": "UPSERT", "ResourceRecordSet": {"Name": "api.yourcompany.com", "Type": "A", "SetIdentifier": "aws-canary", "Weight": 0, "AliasTarget": {"HostedZoneId": "'$ALB_ZONE'", "DNSName": "'$ALB_DNS'", "EvaluateTargetHealth": true}}}
  ]
}'

# 2. Wait for reverse DMS CDC to drain inflight AWS transactions
aws dms describe-replication-tasks --filters "Name=replication-task-id,Values=reverse-sync-aurora-to-onprem" \
  --query "ReplicationTasks[0].ReplicationTaskStats.CDCLatencySource"

# 3. Stop incoming AWS ingress traffic and resume 100% on-premise operations