Module 10 · SAA-C03

Migration and data transfer

The 7R strategies, Application Migration Service, DMS, DataSync, Transfer Family, Storage Gateway, Snow Family: bringing servers, databases and data to AWS.

DomainResilient architectures
DomainHigh-performing architectures
DomainCost-optimized architectures
9 diagrams
10 scenarios
11 services

5-minute essentials

7 strategies (7R): Retire, Retain, Rehost, Relocate, Repurchase, Replatform, Refactor.The question describes a situation and asks for the strategy: move the app unchanged to EC2 = rehost; switch to a managed service = replatform; rewrite cloud-native = refactor; move to SaaS = repurchase.
Rehost (lift and shift) is fastest for large numbers of servers: Application Migration Service (MGN) replicates continuously at block level, then cuts over in minutes.MGN replaced CloudEndure Migration; it is now part of AWS Transform ("AWS Transform MGN").
Replatform examples: self-installed SQL Server to Amazon RDS for SQL Server, an app to containers without changing code.Few changes, less operational work; unlike refactor, the architecture is not redesigned.
DMS migrates database data; the source keeps running during the migration. Three task types: full load, full load + CDC, CDC only.Near-zero downtime: full load + CDC, then cut over once the target catches up.
When changing engines (Oracle → Aurora PostgreSQL), convert the schema first with DMS Schema Conversion or AWS SCT, then DMS migrates the data.DMS does not rewrite stored procedures / code from another engine on its own.
DataSync: copies files / objects over the network (NFS, SMB, HDFS, object storage → S3, EFS, FSx), TLS encryption, integrity checks, runs on a schedule, copies only changes.On-premises sources need a DataSync agent (VM); copying between AWS services in the same account needs no agent.
Transfer Family: managed SFTP, FTPS, FTP, AS2, storing directly in S3 or EFS.A partner already sends files via SFTP and you don't want them to change anything: Transfer Family.
Storage Gateway is a long-term hybrid bridge: S3 File Gateway (NFS/SMB → S3), FSx File Gateway, Volume Gateway (iSCSI, cached / stored), Tape Gateway (replaces tape).Unlike DataSync (one-time / scheduled transfer): Storage Gateway lets on-premises apps keep using storage, with a local cache.
Offline transfer when the network is not enough: the SAA exam still uses Snowball Edge. In practice Snowball Edge no longer accepts new customers; AWS suggests DataSync (online) or Data Transfer Terminal (bring drives to an AWS data transfer site).Quick math: 100 TB over a 100 Mbps link takes about 3 months; in that case shipping a device is usually faster.
Assess before migrating: Application Discovery Service collects configuration, usage and network connections of on-premises servers; Migration Hub aggregates the data and tracks progress.Both have stopped accepting new customers (Migration Hub since Nov 7, 2025); new customers use AWS Transform. The SAA-C03 exam may still use ADS + Migration Hub as the answer for the assessment step.
Network path for large, long-running migrations: Direct Connect (stable) or VPN (quick to set up).DataSync, DMS, MGN can run over Direct Connect / VPN and VPC endpoints so traffic avoids the public internet.

Diagrams

Application Migration Service: continuous replication, then cutover

An agent on the source server sends block-level changes to a lightweight replication server in a staging subnet. Test launch first, cut over when ready: the real EC2 instance boots from the latest replica.

Step by step

The agent replicates the source server's disks to the staging subnet, then keeps sending changes continuously.
Launch a test copy to verify the application works, while the source keeps serving.
Cutover: stop writes at the source, boot an instance from the latest replica, point DNS to AWS; downtime is a few minutes.

Changing engines: convert the schema first, DMS moves the data

Schema Conversion (or SCT) translates tables, views and stored procedures to the target engine. The DMS replication instance reads the source and writes the target; the source keeps serving.

Step by step

Convert the schema and code (PL/SQL → PL/pgSQL) to Aurora PostgreSQL; parts that cannot be converted automatically appear in a report for manual fixing.
DMS loads all data, then keeps applying changes (CDC) read from Oracle's redo log.

DMS full load + CDC: near-zero-downtime cutover

The application writes to the source throughout. Once the target catches up, pause writes briefly, wait for latency to reach 0, and switch the connection string.

DataSync: copy NAS to EFS / S3 over Direct Connect

An agent (VM) next to the NAS reads NFS / SMB and sends over TLS to DataSync. The task runs on a schedule, copies only changes and verifies integrity.

Step by step

The agent reads files from the NAS and sends them TLS-encrypted over Direct Connect (or internet / VPN), optionally through a VPC endpoint.
DataSync writes to EFS or S3 and verifies checksums; later runs copy only changed files.

Offline transfer when the network is not enough

Calculate first: 600 TB over 200 Mbps takes about 9 months. In that case copy to a device and carry it to AWS. The SAA exam uses Snowball Edge; new customers now use Data Transfer Terminal or a partner.

Step by step

Calculate the time over the network: it will not meet the deadline.
Copy to the device on site, ship it, and AWS imports the data into S3.

Storage Gateway: on-premises apps using AWS storage

The gateway (VM or appliance) sits on site with a cache. File Gateway turns files into S3 objects; Volume Gateway provides iSCSI volumes with EBS snapshots; Tape Gateway replaces a tape library.

Step by step

File Gateway: NFS / SMB file share, each file becomes an S3 object, recently used files are cached.
Tape Gateway: backup software writes to virtual tape; archived tapes move to S3 Glacier.
Volume Gateway: iSCSI volumes (cached or stored), backed up as EBS snapshots.

Transfer Family: managed SFTP storing directly in S3

Partners keep their clients and SSH keys. Files land in S3; a managed workflow or S3 events handle further processing (scan, unzip, load data).

Step by step

Partners connect as before (SFTP, AS2…), authenticating with SSH keys or a custom identity provider.
Files are stored in S3; an event triggers processing.

Choosing a 7R strategy for each application

Ask these questions in turn for each application in the portfolio. For large-scale migrations, AWS recommends rehost, relocate or replatform first and modernizing later; refactor takes the most effort.

Step by step

Nobody uses it, no value left: retire, cutting cost and security risk.
An equivalent SaaS exists: repurchase (drop and shop).
Self-installed SQL Server moves to Amazon RDS for SQL Server: replatform.
No changes, move the server as is: rehost with Application Migration Service (MGN).

Assessing and tracking migration: Discovery Service, Migration Hub, AWS Transform

Discovery Service collects configuration, performance and connections between servers to group applications into waves; Migration Hub aggregates status from MGN and DMS in one place in the home Region. Neither accepts new customers (Migration Hub since 11/07/2025); new customers use AWS Transform.

Step by step

VMware VMs: the Agentless Collector is installed once via vCenter and collects configuration and CPU, RAM, disk usage.
To learn which servers talk to which (to group applications): install the Discovery Agent on each server.
During migration, MGN and DMS report status to Migration Hub so you can track each application's progress.
New customers: the two services above are closed to sign-ups; use AWS Transform for similar assessment and tracking.

Quick comparisons

The 7 migration strategies (7R)

Strategy	Meaning	Example / tool
Retire	Shut down applications that no longer have value	App nobody has used in 90 days
Retain	Keep as is, do not migrate yet	Depends on special hardware, just upgraded, waiting for a SaaS version
Rehost	Move as is (lift and shift)	Application Migration Service, VM Import/Export
Relocate	Move the whole platform to its cloud version, no new hardware, no app changes	VMware to Elastic VMware Service; move instances to another VPC / account
Repurchase	Drop the old app, buy a different product (usually SaaS)	Self-hosted CRM → SaaS CRM
Replatform	Move and optimize partially (lift, tinker and shift)	SQL Server → RDS for SQL Server; VM → container
Refactor	Redesign in a cloud-native way	Monolith → microservices, serverless

Choosing a data transfer tool

What to migrate	Tool	Notes
Servers (VM, physical, other cloud) as is	Application Migration Service	Continuous block replication, cutover in minutes
Database data, source keeps running	DMS (full load + CDC)	Different engine: Schema Conversion / SCT first
Files / objects over the network, one-time or scheduled	DataSync	NFS, SMB, HDFS, object storage, other clouds
Receive files via SFTP / FTPS / FTP / AS2	Transfer Family	Stores in S3 or EFS
On-premises app using AWS storage long term	Storage Gateway	Local cache
Hundreds of TB when the network is not enough	Physical device (Snowball Edge in the exam; new customers: Data Transfer Terminal)	Encryption is mandatory

DataSync vs Storage Gateway

	DataSync	Storage Gateway
Purpose	Migrate / copy data	On-premises apps use AWS storage day to day
How it runs	Task runs once or on a schedule	Always on, NFS / SMB / iSCSI / VTL
Local cache	No	Yes
Exam example	Move 50 TB of NAS to EFS, then retire the NAS	Back up to virtual tape instead of a tape library; file server backed by S3

DMS: three task types

Type	What it does	Use when
Full load	Copies existing data once	Writes may be paused during the migration
Full load + CDC	Copies everything, then keeps applying new changes	Near-zero downtime needed
CDC only	Only applies changes from a given point	Data already loaded another way (for example a native backup)

Exam scenarios

1A company has 800 VMware servers to move to AWS within 6 months, without modifying applications and with minimal downtime per server.

Show answer

Right: Rehost with AWS Application Migration Service (MGN)
Continuous block replication, test launch, cutover in minutes, servers grouped by application and wave.

Wrong: Rewrite each application as a serverless architecture
Refactoring is slow and risky for 800 servers; it also violates the no-changes requirement.

Wrong: Create an AMI for each server by hand
No continuous replication, large downtime, does not scale.

2Migrate on-premises Oracle to Aurora PostgreSQL; the application may be down for only a few minutes.

Show answer

Right: DMS Schema Conversion (or SCT) converts the schema, then DMS full load + CDC, cut over when latency is near 0
The source runs throughout; it only stops while switching connections.

Wrong: Use DMS full load only
Writes must be paused for the entire copy.

Wrong: Use DMS only, without converting the schema
Different engine: stored procedures and data types need conversion.

3Migrate on-premises MySQL to Amazon RDS for MySQL, same engine, keeping downtime low.

Show answer

Right: DMS full load + CDC (or MySQL native replication)
Homogeneous: only the data needs to be moved and changes caught up.

Wrong: Use SCT to convert the schema
Same engine, no schema conversion needed.

4Every night, new folders on an on-premises NAS (NFS) must be synced to Amazon EFS over Direct Connect, with integrity checks.

Show answer

Right: AWS DataSync (on-premises agent, scheduled task, copies only changes)
TLS encryption, integrity checks, runs over DX / VPC endpoint.

Wrong: Snowball Edge every week
A physical device does not suit daily syncing when a network link already exists.

Wrong: A custom rsync script on EC2
You must handle parallelism, retries, encryption and integrity checks yourself.

5A partner sends order files via SFTP every day; the company wants to drop its self-managed SFTP server and store the files in S3, with the partner changing nothing.

Show answer

Right: AWS Transfer Family (SFTP) storing into S3, keeping the old domain name / SSH keys
Managed SFTP; a managed workflow or S3 events process files after they arrive.

Wrong: Ask the partner to upload to S3 with the AWS CLI
Changes the partner's process.

6You need to move 600 TB of data to S3, the internet link is only 200 Mbps, and it must finish in 3 weeks.

Show answer

Right: Offline transfer with physical devices (exam answer: multiple Snowball Edge devices); in practice new customers use Data Transfer Terminal or a partner
When the network lacks the bandwidth for the deadline, carry the data on devices.

Wrong: DataSync over the internet
200 Mbps ≈ 2 TB/day, which takes about 9 months.

7The tape library for backups is aging; the current backup software must stay, and the backups must live on low-cost AWS storage.

Show answer

Right: Storage Gateway Tape Gateway (virtual tape → S3, long-term archive to S3 Glacier)
The backup software sees a virtual tape library and needs no change.

Wrong: DataSync copying backup files to S3
The backup software writes to tape (VTL), not files.

8An on-premises app needs to write files over SMB, with data stored in S3 for analytics; access to recent files must be fast.

Show answer

Right: S3 File Gateway (SMB / NFS, local cache, files become S3 objects)
The app uses a normal file share while the data lives in S3.

Wrong: Mount S3 directly over the internet
S3 is not an SMB file share.

9An internal application nobody has used in the past 6 months runs on an unsupported OS. Which strategy?

Show answer

Right: Retire
Shut it down, cutting cost and security risk.

Wrong: Rehost to EC2
Spends money running something with no value.

10Before moving 300 servers, you need to know which server depends on which and the real utilization to choose EC2 sizes.

Show answer

Right: Per the exam: Application Discovery Service (agent or agentless collector) + Migration Hub; for new customers today: AWS Transform
You need real utilization and network connections between servers to map dependencies, split waves and size EC2. ADS and Migration Hub no longer accept new customers; AWS suggests AWS Transform for similar functions.

Wrong: Choose EC2 sizes from current hardware specs
Usually heavily oversized.

Quick picks

What do you need to migrate?

When you need	Use
Many servers, no application changes	Application Migration Service (rehost) · see diagram
Database with the same engine, low downtime	DMS full load + CDC · see diagram
Database with a different engine	DMS Schema Conversion / SCT + DMS · see diagram
Files / objects over the network, one-time or periodic	DataSync · see diagram
Partner sends files via SFTP / FTPS / AS2	Transfer Family · see diagram
On-premises app uses file shares / volumes / virtual tape on AWS long term	Storage Gateway · see diagram
Hundreds of TB, network too slow for the deadline	Offline transfer with devices (Snowball Edge in the exam) · see diagram
Assessment, dependency mapping, wave planning	Per the exam: Application Discovery Service + Migration Hub; new customers: AWS Transform · see diagram
Application nobody uses anymore	Retire · see diagram
Replace a self-hosted app with SaaS	Repurchase · see diagram

Common pitfalls

Choosing refactor when the question wants speed with no code changes: that is rehost.
Using DMS for a different-engine database and skipping the schema conversion step (Schema Conversion / SCT).
Choosing DMS full load when the question requires minimal downtime: you need full load + CDC.
Using Storage Gateway for a one-time data move after which the source is retired: that is DataSync.
Using DataSync when an on-premises app needs daily cached access to files on AWS: that is Storage Gateway.
Making the partner change their process instead of setting up Transfer Family SFTP.
Choosing network transfer when the bandwidth calculation shows it will not meet the deadline.
Forgetting that on-premises DataSync needs an agent (VM) running near the data source.
Believing Snowball Edge still accepts new customers: only existing customers can use it now; older exam questions may still have Snowball as the answer.
Choosing EC2 sizes from old hardware instead of real usage data.

Services in this module

Numbers that change (checked against AWS docs)

Snowball Edge is no longer offered to new customers; AWS suggests DataSync (online), Data Transfer Terminal (bring your device) or partners. Snowball Edge Storage Optimized: 210 TB, network up to 100 Gbit/s. checked 2026-10-16 ↗
Data Transfer Terminal: book a slot, bring your storage device to an AWS site, upload to S3 or EFS over a high-speed connection, and you keep the device the whole time. checked 2026-10-16 ↗
DataSync works with NFS, SMB, HDFS, object storage, S3, EFS, the FSx family and other clouds' storage. checked 2026-10-16 ↗
DataSync: on-premises sources need an agent (VM); data is TLS-encrypted in transit and integrity is always verified; copying between AWS services in the same account needs no agent. checked 2026-10-16 ↗
Transfer Family supports SFTP, FTPS, FTP, AS2 and browser-based transfers; stores in S3 or EFS. checked 2026-10-16 ↗
Application Migration Service (now AWS Transform MGN): continuous block replication of physical, virtual and other-cloud servers; cutover typically takes minutes. checked 2026-10-16 ↗
DMS migrates data once or with ongoing change replication; convert the schema for a different engine with DMS Schema Conversion or AWS SCT. checked 2026-10-16 ↗
DMS has full load + CDC and CDC only tasks; CDC reads the source's transaction log and is not true real-time replication (latency can be minutes). checked 2026-10-16 ↗
The 7 strategies: retire, retain, rehost, relocate, repurchase, replatform, refactor / re-architect. checked 2026-10-16 ↗
Storage Gateway includes S3 File Gateway, FSx File Gateway, Tape Gateway, Volume Gateway (cached and stored). checked 2026-10-16 ↗
AWS Migration Hub has stopped accepting new customers since 11/07/2025; AWS suggests AWS Transform for similar features. checked 2026-10-19 ↗
AWS Application Discovery Service no longer accepts new customers; AWS suggests AWS Transform. The Agentless Collector works through vCenter (VMware VMs only); the Discovery Agent is installed on each server and additionally records network connections and processes. checked 2026-10-19 ↗
The 7R are retire, retain, rehost, relocate, repurchase, replatform, refactor / re-architect; refactor is the most complex and is not recommended for large-scale migrations. checked 2026-10-19 ↗
Application Discovery Service no longer accepts new customers; AWS suggests AWS Transform. checked 2026-10-19 ↗

Practice this module →