The ticket
Leadership booked a weekend. Junior started imaging every VM in 10.20.30.0/24. pay-api on 10.20.30.40 is the only thing the business named. dc01 is not an app. You stop the boil-the-ocean plan before the first replica starts.
AWS Prescriptive Guidance 6 Rs: rehost (lift), replatform (managed service under the same app), repurchase (SaaS), refactor (rewrite), retire, retain. Azure CAF uses rehost / refactor / rearchitect / rebuild / replace — same decision, different labels. One R per app, scored against Well-Architected (cost, security, reliability, ops, performance). Rehosting pay-api first, then refactoring, is valid. “Lift everything this weekend” is not an R.
On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40.
Mental model
| R | Meaning | This lab · pay-api |
|---|---|---|
| Rehost | Lift the VM as-is (Azure Migrate / AWS MGN) | Wave-1 candidate — keep domain join over VPN |
| Replatform | Same app, swap a piece (RDS / Azure SQL) | Later — DB is not wave-1 |
| Repurchase | Drop and shop SaaS | No — payments is custom |
| Refactor | Rewrite for PaaS / containers | Wave-2+ after it survives rehost |
| Retire | Turn it off | Not pay-api. Maybe that 2008 print box |
| Retain | Leave on-prem on purpose | dc01 10.20.30.10 stays until identity is hybrid |
Azure Well-Architected does not pick the R for you. It scores the R you picked.
Assessment pay-api
How to choose
| If | Pick | Trap |
|---|---|---|
| OS is supportable, app is a black box | Rehost wave-1 | Rewriting during the freeze window |
| You only want a managed DB | Replatform after rehost soaks | Moving VM + DB + DNS the same night |
| Vendor has a SaaS SKU you already bought | Repurchase | Fake “SaaS” that is still your VM |
| OS is rotting or you need horizontal scale | Refactor / rebuild — scheduled, not panic | Calling it rehost |
| Nobody can name an owner | Retire or retain | Migrating orphans “in case” |
Runbook
Side A — inventory one app
Name, owner, OS, listeners, cert CN, who authenticates, who it calls. For
pay-api: VM10.20.30.40, HTTPS,pay-api.techclick-lab.in,TECHCLICK\svc-pay, on-prem DB stays.Side B — write the R
Rehost to Azure spoke
10.41.0.0/16or AWS app VPC10.51.0.0/16. Refactor is a later change request. Retaindc01.Side C — freeze the wave
Wave-1 =
pay-apionly. Publish that sentence. Do not add “and the jump box, and WSUS, and the old HR VM.”
app: pay-api on-prem: 10.20.30.40 r_now: rehost r_later: refactor (PaaS) after soak retain: dc01 10.20.30.10 not_wave_1: anything else on 10.20.30.0/24
Four failures
1 · One R for the estate
“We are a rehost shop.” That sentence hides retain and retire. It also hides the app that must be rebuilt.
2 · Refactor during cutover
New runtime + new IP + new DNS + new IdP. You cannot tell which change killed payments.
3 · Migrating leftovers
Domain controllers, print queues, and “that box under the desk” are not wave-1. Retain or retire.
4 · Azure vs AWS as the R
The cloud brand is a landing, not a strategy. You can rehost to either. The R is still rehost.
How to prove it
1) Every in-scope name has one written R. 2) Wave-1 is only pay-api. 3) dc01 is retain. 4) Nobody has a weekend “lift the DC” ticket still open.
Traps
| Phrase | Translation |
|---|---|
| Lift and shift everything | No R was chosen |
| Cloud-native first | Often an unfunded rewrite |
| We will decide after it is in Azure | You already chose rehost — write it down |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview
Sources
- AWS Prescriptive Guidance — 6 Rs overview (rehost, replatform, repurchase, refactor, retire, retain).
- AWS Prescriptive Guidance — Migration strategy.
- Azure Cloud Adoption Framework — Migrate.
- Azure Well-Architected Framework — score the R you picked.
Related: Azure landing zone · AWS Org / OU.