Generate the data-plane cutover runbook — the steps that move actual data (snapshot shares, KMS grants, AMI shares, DataSync, DMS, S3 sync, snapshot-restore, ECR push, secret values), freeze writes during cutover, swap DNS / promote replicas, and validate the copy. Consumes data-migration-plan.json for sizing, strategy, freeze windows, and validation criteria. Phase 1 (Pre-Staging) → 2 (Bulk Transfers) → 3 (Application Data) → 4 (Cutover: freeze + promote + swap) → 5 (Data Validation). Produces cutover-checklist-data-plane.md + .json. Runs AFTER the control-plane runbook completes.
How this skill is triggered — by the user, by Claude, or both
Slash command
/aws-migration-architect:cutover-data-planeThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill produces the runbook for **moving data into the already-provisioned target shape**. Every step here is a real data operation. The control-plane runbook must complete first.
This skill produces the runbook for moving data into the already-provisioned target shape. Every step here is a real data operation. The control-plane runbook must complete first.
data-migration-planner (reads data-migration-plan.json)cutover-control-plane (the data-plane runbook depends on target containers existing)data-migration-plan.json exists (this is the primary input — sizing, strategy, windows, validation all live here)migration-plan.json, resource-ownership.json, dependency-graph.json, hardcoded-values.json existcutover-checklist-control-plane.json exists (the data-plane references its handoff criteria)| Input | Source | Required |
|---|---|---|
data-migration-plan.json | data-migration-planner | yes (primary) |
migration-plan.json | migration-planner | yes |
resource-ownership.json | inventory | yes |
dependency-graph.json | dependency-analyzer | yes |
hardcoded-values.json | dependency-analyzer | yes |
cutover-checklist-control-plane.json | cutover-control-plane | yes |
cutover-checklist-data-plane.md — printable runbook for the operatorcutover-checklist-data-plane.json — validates against schemas/cutover-checklist-data-plane.schema.json. Consumed by the cutover-executor.Setup that has to happen before any data moves. Mostly cross-account permission grants:
aws rds modify-db-snapshot-attribute --attribute-name restore --values-to-add <target-acct>aws kms create-grant ... --grantee-principal arn:aws:iam::<target-acct>:root --operations Decrypt DescribeKeyaws ec2 modify-image-attribute --launch-permission "Add=[{UserId=<target-acct>}]"aws ec2 modify-snapshot-attributePre-staging steps are typically reversible (revoke grant, remove launch permission). Mark as irreversible: false.
The big movers. This is usually the longest phase by wall-clock:
For each datastore in data-migration-plan.json where strategy.mode in ["bulk", "bulk-plus-delta", "snapshot-restore"]:
| Strategy.tool | Operation | long_running | Poll |
|---|---|---|---|
aws-s3-sync | s3-sync | true (for large) | aws s3 ls --summarize |
s3-batch-replication | s3-batch-replication | true | aws s3control describe-job |
aws-rds-snapshot-share (restore part) | snapshot-restore | true | aws rds describe-db-instances (Status field) |
aws-dms | dms-start | true | aws dms describe-replication-tasks |
aws-datasync | datasync-start | true | aws datasync describe-task-execution |
dynamodb-export-import | dynamodb-export → dynamodb-import | true | aws dynamodb describe-export / describe-import |
ec2-snapshot-share (volume creation) | snapshot-restore | false (fast) | n/a |
For each step, inline:
command — the exact AWS CLI calllong_running: true if applicable + poll_cmd + poll_terminal_statestime_box_minutes from data-migration-plan.datastores[].transfer_estimate.bulk_phase_hours * 60datastore_arnirreversible: false (sync/restore can be cleaned up by deleting the target)Non-storage data that apps depend on:
ecr-push (push images to target ECR)lambda-code-upload (upload deployment artifact to target deployment bucket)secret-put-value — operator supplies value file path at runtimeThe actual switch. This phase contains the freeze windows. Steps here are often irreversible: true:
For each tier-1/tier-2 datastore with freeze_window.required: true (per data-migration-plan.json):
freeze-writes — enforce per freeze_window.notes (e.g. set RDS parameter to default_transaction_read_only=true, attach bucket-policy denying writes)bulk-plus-delta strategies) — re-run sync to catch writes during bulkdms-promote / rds-promote-read-replica if applicableroute53-change — apply the pre-staged change-batch JSON to flip traffictraffic-shift — verify ALB request counts shiftingAll steps in this phase carry irreversible: true for irreversible ops (route53-change after TTL propagation, dms-promote, deleted-source-data steps).
Per the validation methods in data-migration-plan.datastores[].validation:
For each datastore:
methods[] (row-count, object-count, byte-count, checksum-sample, checksum-full, key-list-diff, smoke-query, application-replay)acceptance_criteriaFinal go/no-go gate at phase 5 end:
freeze_windows[] at the top of the JSON aggregates every freeze window from data-migration-plan.json. Each entry maps to a step in Phase 4. The cutover-executor reads freeze_windows[] to:
For every step where owner_team is set on the corresponding datastore in data-migration-plan.json, inject an approval gate. For Phase 4 cutover steps with irreversible: true, mandatory second-confirmation per the cutover-executor's high-risk dialog.
Pre (Phase 1 only):
handoff_to_data_plane.criteria[] verifiedtarget-cutover-data-plane.json IAM policy attached to target profilePost (Phase 5 end):
data-migration-plan.datastores[].rollback.retain_source_for_hours/aws-migration-architect:auditkms-grant which is data-plane because it's a permission for data movement specifically).terraform apply steps. Module applies are control-plane.aws iam create-role or aws iam attach-role-policy — control-plane.datastore_arn unless they're genuinely cross-datastore (e.g. global health-check creation in Phase 1).data-migration-plan.json — that's where freeze windows are computed.Calls cutover-data-plane-builder to render the per-phase steps from data-migration-plan.json and migration-plan.json.
npx claudepluginhub pavankishore1987/aws-migration-architect --plugin aws-migration-architectGuides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.