AWS Migration Services for US & EU Workloads

All seven (Retire, Retain, Relocate, Rehost, Repurchase, Replatform, Refactor) but we explicitly resist defaulting to Rehost. Decision input is an AWS Migration Hub Strategy Recommendations run plus our own dependency map from Application Discovery Service agents. We score each workload on five axes: blast radius, change frequency, runtime cost on EC2 vs managed equivalent, license entanglement, and team familiarity. Stateless web tiers usually Replatform onto ECS Fargate or App Runner. Oracle/SQL Server with heavy PL/SQL go Refactor to Aurora PostgreSQL via Babelfish or DMS + SCT. COTS without an exit goes Rehost via MGN, then revisited 12 months later.

Terraform by default, occasionally Pulumi when the client team prefers TypeScript end-to-end. We never use ClickOps for foundation. The landing zone is AWS Control Tower with customizations: separate OUs for Security, Audit, Log Archive, SharedServices, Workloads (dev/stage/prod), and Sandbox. Identity is IAM Identity Center federated to your IdP (Okta, Entra ID, Google Workspace). Network is a Transit Gateway hub-spoke with centralized inspection VPC running AWS Network Firewall. Everything is in Terraform modules versioned in your repo — you own the code on day one, not us.

Workloads with EU personal data land in eu-central-1 (Frankfurt), eu-west-1 (Ireland), or the AWS European Sovereign Cloud where appropriate. We pin services to those regions via SCPs at the OU level — a developer cannot accidentally spin up a Bedrock model in us-east-1. For Schrems II compliance we use AWS Nitro Enclaves where attestable confidential compute is required, KMS with customer-managed CMKs (and XKS / external key store for sovereignty-critical workloads), and SCCs in the DPA. CloudTrail and Config logs are encrypted with separate keys and replicated cross-region inside the EU only.

We instrument Cost and Usage Reports into Athena + QuickSight on day one and tag every resource with cost-center, environment, and service via Terraform-enforced policy. The FinOps cadence is weekly: anomaly detection via AWS Cost Anomaly Detection, rightsizing recommendations from Compute Optimizer, Savings Plans coverage tracking, and a monthly written report. Typical savings on a lift-and-shift baseline are 28–35 percent within 90 days (Graviton migration on stateless tiers, S3 Intelligent-Tiering on cold data, Aurora I/O-Optimized on write-heavy databases, Spot for batch on EKS via Karpenter).

Yes — co-delivery is our default model. Your team owns business logic, application changes and final cutover decisions. Our team owns landing zone, network, security baseline, MGN/DMS pipelines, observability stack and the runbooks. We pair-program the Terraform, run weekly architecture review with your tech leads, and hand off via a 30-day shadow period. By the end of the engagement your engineers are reviewing our PRs, not the other way round. No vendor lock-in to YuSMP after the sprint ends — that is contractual.

Discovery sprint is 4 weeks fixed-fee at 35,000 EUR — Migration Hub assessment, dependency map, 7Rs decision matrix, landing zone design, cost model and migration waves. Execution runs as dedicated team engagements from 12,000 EUR/month per team of 3 (TPM + cloud engineer + SRE). A 200-server estate typically moves in 4–6 months end-to-end. Refactor work on databases or monoliths is quoted per wave. FinOps and 24/7 SRE retainer is available post-cutover from 6,500 EUR/month.