The problem

Migrations fail when they are treated as one big bang. The approach that works, and the one behind 20+ real migrations, is to separate the data move from the app move, keep them in sync, validate continuously and cut over only when the numbers say it is safe.

What you’ll build

• A landing VPC with public (ALB) and private (app + DB) subnets
• Aurora PostgreSQL Serverless v2 with managed master secret, encryption, forced TLS and backups
• AWS DMS replication instance, source and target endpoints, and a full-load + CDC task with validation on
• An ECS Fargate service behind an ALB, wired to the database through Secrets Manager
• A cutover runbook and a before/after metrics table

Architecture

On-prem VM + DB ──VPN/DX──▶ DMS (full load + CDC, validation on) ──▶ Aurora PostgreSQL Serverless v2
      │                                                                     ▲
      └─ App2Container ─▶ image ─▶ ECR ─▶ ECS Fargate (private) ◀─ ALB ◀─ users after cutover

AWS services used

How it works

1. ContainerizeApp2Container analyzes the running Java/.NET app and produces an image in ECR, with no code rewrite.
2. ReplicateDMS copies existing data, then streams every change (CDC) while the old system stays live.
3. ValidateDMS validation compares rows on both sides, and the cutover waits for zero lag and “Validated”.
4. Cut overFreeze writes, switch DNS to the ALB, stop the task. Rollback is just switching DNS back.

Key design decisions

• DMS is optional at first deploy, so you can build the target before the VPN exists.
• The database password is never in a parameter: Aurora manages it in Secrets Manager.
• Deployment circuit breaker + rollback means a bad image never takes the service down.

Deploy it

# Without DMS (just the target platform)
aws cloudformation deploy --stack-name legacy-migration --template-file template.yaml \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides ContainerImage=<account>.dkr.ecr.<region>.amazonaws.com/legacy-app:latest ContainerPort=8080

# Add DMS once VPN/Direct Connect to the source DB is up
aws cloudformation deploy --stack-name legacy-migration --template-file template.yaml \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides SourceServer=10.1.2.3 SourcePort=3306 SourceEngine=mysql \
    SourceUsername=dms_user SourcePassword='********' ContainerImage=... ContainerPort=8080

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Point DMS at a MySQL source, start the task and watch describe-table-statistics show full-load rows, then live inserts/updates streaming in with validation state “Validated”.

Skills this demonstrates