OCI Migration Architect cheat sheet

OCI Cloud Adoption Framework divides work into four pillars (Architecture, People, Process, Technology) and four phases: Assess, Plan, Design, Deploy; assessment artifacts feed the Plan phase, not Deploy.

AWS-to-OCI mapping: EC2→Compute, VCN→VCN, ELB→Load Balancer/Network Load Balancer, S3→Object Storage, RDS→Base Database Service or Autonomous Database, DynamoDB→NoSQL Database, Route 53→DNS, IAM→IAM, CloudWatch→Monitoring, Direct Connect→FastConnect.

Azure-to-OCI mapping: Blob Storage→Object Storage, Azure SQL Database→Autonomous Database or Base Database Service, Azure VNet→VCN, NSG→Network Security Group, ExpressRoute→FastConnect, Azure AD→OCI IAM identity federation, AKS→Container Engine for Kubernetes (OKE).

On-premises mapping: VMware ESXi→OCI VMware Solution (OCVS), Oracle Exadata→Exadata Database Service or Exadata Cloud@Customer, Oracle RAC→RAC on OCI bare metal or Autonomous Database, F5/HAProxy→Load Balancer or Network Load Balancer.

Migration strategy taxonomy (6 Rs): Rehost (lift and shift), Replatform (minor tuning), Repurchase (replace with SaaS), Refactor/Re-architect, Retire, Retain; each workload gets exactly one strategy with documented rationale.

Discovery inventory fields per workload: current platform, OS/version, CPU/RAM/storage, network dependencies, RTO/RPO, licensing model, data volume, and business owner; missing fields block migration-wave planning.

Assessment scoring: rate each workload on business criticality, technical complexity, and migration effort (1-5); high criticality + low complexity = early wave; high complexity = refactor/retain candidate.

Total cost of ownership comparison must include compute, storage, egress, licensing (BYOL vs. license-included), support, and staff/training; OCI pricing calculator and Cost Estimator produce the baseline.

OCI VMware Solution (OCVS) supports live vMotion of VMs from on-premises vSphere to OCVS SDDC over FastConnect or VPN, enabling rehost with near-zero downtime; check OCVS region availability and shape limits before committing.

VCN CIDR must not overlap with on-premises or other peered VCNs; plan /16 per VCN and /24 per subnet; overlapping CIDRs block VPN/FastConnect routing and require NAT or re-IP.

FastConnect provides private dedicated connectivity (1 Gbps or 10 Gbps per port, up to 8 ports per cross-connect group); VPN over internet is the fallback; FastConnect + IPSec VPN over the private virtual circuit gives encryption.

Route tables are per-subnet; each rule specifies destination CIDR/Service and target (Internet Gateway, NAT Gateway, Service Gateway, DRG, Local Peering Gateway); most-specific prefix wins.

Internet Gateway for public subnets; NAT Gateway for outbound-only traffic from private subnets; Service Gateway for Oracle Services Network (Object Storage, Autonomous Database) without internet traversal.

Security lists apply at the subnet level (stateful by default); NSGs apply at the VNIC level and are preferred for tiered apps; both are allow-only, no explicit deny rules.

Availability domains are physically isolated datacenters within a region; fault domains are groupings within an AD; design for multi-AD for HA and cross-region for DR; some regions have a single AD.

Load Balancer (Layer 7, flexible bandwidth 10 Mbps–8 Gbps) for HTTP/HTTPS; Network Load Balancer (Layer 4, preserves source IP, supports UDP) for TCP/UDP and extreme performance.

Object Storage tiers: Standard, Infrequent Access, Archive, and auto-tiering; replication is asynchronous cross-region; bucket versioning and lifecycle policies support migration rollback.

Block Volume performance scales with VPUs/GB (Lower Cost, Balanced, Higher Performance, Ultra High Performance); boot volumes default to Balanced; size for IOPS before migration, not after.

Oracle Database migration tools: Data Pump (expdp/impdp) for logical, RMAN for physical backup/restore, GoldenGate for minimal-downtime replication, Zero Downtime Migration (ZDM) for automated on-premises-to-OCI, and Data Guard for standby-based cutover.

Autonomous Database migration paths: Data Pump, GoldenGate, ZDM, or Oracle Data Pump via Object Storage; check compatibility (no direct upgrade from very old releases, no OS-level access, no SYSDBA).

ZDM supports physical (RMAN/Data Guard) and logical (Data Pump/GoldenGate) modes; physical requires same endianness and compatible database version; logical supports cross-platform and cross-version.

Non-Oracle databases: MySQL→MySQL HeatWave, PostgreSQL→PostgreSQL on OCI (Base Database) or Autonomous Database (with compatible features), SQL Server→SQL Server on OCI or Base Database; assess feature gaps before replatform.

GoldenGate extracts from source, replicates to target with conflict handling; use for active-active or minimal-downtime cutover; requires supplemental logging on source and a stable network path.

Application migration order: migrate database first (or in parallel with replication), then application tier, then DNS cutover; stateless tiers migrate first when possible to reduce risk.

Containerized apps: OKE for Kubernetes; Container Instances for simple workloads; Container Registry for images; use OCI DevOps for CI/CD pipelines; ensure image architecture matches shape (x86 vs. Arm).

File and object data: OCI File Storage for NFS/SMB shares; Object Storage for bulk data; use OCI Data Transfer Service or rsync/rclone for large datasets; verify checksums post-transfer.

Licensing: BYOL requires Oracle Linux or supported OS and valid support contract; license-included shapes simplify but cost more; check core-count licensing for RAC and Exadata.

Wave planning: group workloads by dependency, business unit, and risk; each wave has entry/exit criteria, rollback plan, and a named owner; first wave = low-risk, low-dependency workloads.

Cutover runbook steps: freeze changes, final replication sync, validate data, switch DNS/load balancer, smoke test, monitor, then decommission source; each step has a rollback trigger and time budget.

Replication lag monitoring: GoldenGate lag, Data Guard apply lag, and RMAN incremental apply must be near zero before cutover; define acceptable lag threshold (e.g., <5 minutes) and abort if exceeded.

DNS cutover: lower TTL to 60–300 seconds at least 24 hours before cutover; use weighted or failover routing to shift traffic gradually; keep old records for rollback window.

Rollback plan must include a tested path back to source, data reconciliation for writes made post-cutover, and a decision deadline (e.g., 4 hours) before rollback becomes too costly.

Post-migration validation: row counts, checksums, application smoke tests, performance baselines, and security posture; compare against pre-migration metrics.

Observability: OCI Monitoring metrics, Logging, Notifications, and Application Performance Monitoring; set alarms for CPU, memory, latency, error rate, and replication lag.

FinOps: use budgets and cost-tracking tags per workload; rightsize shapes after 30 days of production data; schedule non-production shutdowns; review egress and storage tier usage.

Decommissioning: revoke credentials, remove DNS records, archive backups per retention policy, update CMDB and runbooks, and document lessons learned for the next wave.