Four-Phase Migration Playbook

Action

Deploy non-intrusive discovery agents across the entire network. Agents trace traffic packet-by-packet to build a live, visual map of all software dependencies, firewall rules, and database connections.

• Network flow collectors (NetFlow/sFlow/eBPF) across all switch fabrics
• Application-level dependency mapping: what calls what, on which ports
• Database schema discovery and cross-DB foreign-key mapping
• Firewall ruleset audit: identify shadow rules and deprecated ACLs
• Data classification scan: tag PII, PHI, financial, and classified data at rest
• Output: interactive dependency graph + migration risk heat-map

Action

For massive data layers, use dedicated hardware appliances to copy data locally and physically ship it to target. For live databases, set up continuous replication over dedicated dark fiber or encrypted VPN — keeping the destination in sync with the live system.

• Hardware appliance transfer (AWS Snowball / OmniGCloud DataShuttle) for >10 TB initial seeds
• Continuous CDC (Change Data Capture) replication for live relational databases
• Kafka MirrorMaker 2 for streaming topic replication with offset preservation
• All replication channels: TLS 1.3 + AES-256-GCM end-to-end
• Data integrity verification: SHA-256 checksums at source, in transit, and at destination
• Data residency enforcement: replication target validated against classification boundary before start

Action

Create an exact clone of the new environment. Use network mirroring tools to feed real, live incoming user traffic into this test setup in shadow mode — engineers verify the new system behaves correctly under real-world stress without affecting actual operations.

• Infrastructure-as-code clone of target environment (identical Wrangler / Terraform configs)
• Traffic mirroring: 5% → 25% → 100% shadow load ramp over 72 hours
• Behavioral diff engine: compare response payloads between old and shadow new system
• Performance SLO validation: p99 latency, error rate, and throughput baselines confirmed
• Security posture check: run SCAP/STIG scans against the shadow environment
• Rollback drill: practice the cutover reversal before committing to the live window

Action

Execute a scripted sequence during a low-traffic window. Freeze writes on the old database, copy final transactional updates, shift DNS to the new destination, and monitor live validation logs. Keep the old system read-only for 72 hours as a safety net.

• Scheduled during lowest-traffic window (e.g., 02:00–06:00 Sunday local time)
• Write freeze on source database: final CDC flush captured to destination
• DNS TTL pre-lowered to 60 s at T-48 h; atomic cutover at T-0
• Real-time health dashboards: HTTP success rates, DB replication lag, queue depths
• Automated rollback trigger: if error rate exceeds threshold, DNS reverts in <60 s
• Old environment stays read-only for 72 hours; decommissioned only after sign-off
• Post-cutover compliance re-scan: confirm all controls active in new environment