/azure-to-aws

name: azure-to-aws
description: "Migrate Microsoft Azure workloads to AWS. Triggers on: Azure to AWS, move off Azure, AKS to EKS, App Service or Azure VMs to AWS compute, Azure SQL/Database to RDS, Cosmos DB to DynamoDB, Azure OpenAI to Bedrock, Azure cost estimates, or what-if workshops. Discovery uses the authenticated read-only `az` CLI, Terraform, a Resource Discovery for Azure (RDfA) report, and app code, with optional consent-gated OpenAI, OpenRouter, and Anthropic usage APIs. Terraform is optional. Runs Discover, Clarify, Design, Estimate, optional repricing, Generate, and Feedback; Clarify gates later phases and Generate is opt-in. Bicep/ARM discovery is not implemented; billing-export discovery is not implemented. Do not use for GCP or Heroku migrations, reverse migrations, general AWS architecture, or Azure-to-Azure refactoring."

Azure-to-AWS Migration Skill

> **Build status.** Discover, Clarify, Design, Estimate, Generate, and the > what-if workshop are implemented. A `## Status` block records which build > step filled a file in. It is not a signal to skip the file or to treat its > body as a stub. Still missing: Bicep, ARM templates; the feedback > sidebar (wiring only); and `patterns.md`, `licensing.md`, and `gpu-hpc.md`. > RDfA archive parsing is implemented (`discover-rdfa.md`). > The live `az` capture path is implemented (`discover-live.md`). OpenAI, > OpenRouter, and Anthropic usage-API discovery (interactive, consent-gated, > main-window — same shape as `discover-live.md`'s pre-dispatch live-`az` > capture) is implemented.

Optional usage telemetry

Before starting or resuming, load `references/vendored/telemetry/PROTOCOL.md` and run its read-only status check. Use the returned reporting mode rather than the model's identity. Complete the existing notice exchange only when that protocol requires it; unavailable or declined telemetry never blocks this skill.

Philosophy

• **Re-platform by default**: pick the AWS service that matches the Azure workload type (App Service → Elastic Beanstalk, AKS → EKS, VMs → EC2, Flexible Server → RDS/Aurora, Azure Cache for Redis → ElastiCache). Re-architecting is a user decision, not a default.
• **Do not recommend AWS App Runner** (no longer accepting new customers as of April 2026). App Service maps to **Elastic Beanstalk** by default, with Fargate as the override for direct container control and EKS for teams that already run Kubernetes. ECS Express Mode may be mentioned only as a forward-look on the Fargate override path.
• **Live-first discovery, read-only and consent-gated**: the user's authenticated `az` CLI is a first-class source — most startups have no `azurerm_*` Terraform, and the tenant is authoritative for what actually runs. **The live-`az` capture path is implemented** (`discover-live.md`): consent + read-only `az resource list`/`list` capture run as main-window pre-work, and a file-only fragment parses the capture into the same inventory contract as the Terraform path (a live-only workspace no longer halts — it discovers). Resource Discovery for Azure (RDfA) is offered as the **accuracy upgrade** when right-sizing dollars matter, and recommended outright above roughly a handful of subscriptions. Live capture is strictly read-only, never captures app-setting or connection-string VALUES, and never mints a token.
• **Holistic first, per-resource second**: the report leads with cluster-level architecture rationale. A 40-row per-resource mapping table is an appendix, not the headline.
• **Pre-determined where there is no ambiguity**: an architecture-invariant primitive (Blob → S3, VNet → VPC) is a deterministic table lookup and never routed through a rubric that could reason its way somewhere else. A pattern may narrow the rubric's candidate set; **a pattern may never change a `deterministic` mapping's target.**
• **Dev sizing unless specified**: default to development-tier capacity (single AZ, `db.t4g.micro`-class). Upgrade only on user direction or on measured utilization.
• **x86_64 is the default architecture here, not Graviton**: Azure fleets carry Windows and .NET far more often than GCP or Heroku fleets do, and `references/shared/graviton.md`'s escape path (Windows, .NET Framework, GPU/CUDA, RDS SQL Server) fires routinely. Graviton is offered as an optimization, not assumed.
• **Startup-weighted, not enterprise-weighted**: Azure Database for PostgreSQL/MySQL Flexible Server and Cosmos DB Core API get full depth. Azure SQL Database / Managed Instance / SQL-on-VM, Azure Hybrid Use Benefit licensing, elastic-pool consolidation, and Synapse sit behind specialist gates that fire only on detection.
• **No human one-time migration costs**: do not present human labor, professional services, or people-time as dollar estimates or a "one-time migration cost" budget line. Vendor charges grounded in data (Azure invoice line items in the baseline) are allowed.
• **Generate is opt-in**: Design and Estimate always run. Terraform, migration scripts, and docs are produced only after the user chooses Execute at the post-Estimate decision gate (`run_mode: decide_and_execute`).

---

Definitions

• **"Load"** = Read the file using the Read tool and follow its instructions. Do not summarize or skip sections.
• **`$MIGRATION_DIR`** = The run-specific directory under `.migration/` (e.g. `.migration/0315-1030/`). Set during Discover.
• **`$AZURE_SUBSCRIPTION`** = The subscription id passed explicitly on every `az` command. Never rely on the CLI's ambient active-subscription context.
• **Canonical type** = an ARM resource type string (`Microsoft.Web/sites`). All mapping tables key off these, never off Terraform types; `azurerm_*` is translated during discovery.

---

Phase Structure (frontmatter)

Phase and unit files carry a YAML frontmatter block that declares how the phase is composed — its inputs, the fragments it runs, the assembler that combines them, what it produces, its gates, and what it requires/advances-to.