IaC and CI/CD Migration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A converter drafts a dialect, it does not move production

The converters draft a translation: CloudFormation to Terraform, Terraform to Pulumi, ARM to Bicep, Bicep to Terraform, Compose to Kubernetes, or a docker run line to Compose. Pick one pair. The tool does not log in and does not apply. You still read every name.

One resource or one service is the sample. A whole production stack is not the sample. If the draft drops a name you need, or invents a name you did not have, the draft is unfinished. The source file remains the source until a later window says otherwise.

Two tools managing one live resource will fight. The migration is done only when one tool owns it, and that cut is a later ticket with a backup of state and a person watching. This hour ends at the diff.

Secrets do not survive the conversion inside the file. If the source had a secret, rotate it. The destination gets a reference. prompt-for-this is the placeholder. It is not the value you copy across.

One pair, one diff, no second apply

Choose the pair and the one object. Run the converter. Read the output beside the source. Write what matched and what the tool flagged for a person. A flag is not a failure to hide. It is a line in the ticket.

Check the dangerous lines yourself: a world-open rule, an owner identity, a public service, a secret, a destroy. The destination does not gain a permission the source lacked unless the ticket says so in a sentence.

If the pair is Compose to Kubernetes, the manifest guide reviews the result. If the pair is a pipeline dialect, the CI guide reviews the stop before apply. You do not apply the destination to prove the converter.

Keep the source. A deleted source the same hour is how you lose the only description that matched production. State backup, if state exists, is named and not committed.

# Conversion note. One pair. One object.
# The converter does not apply.
# Do not let two tools own one live resource.
# Keep the source file.
# Rotate a secret that was in the source.
# prompt-for-this is not a copied password.

A change you can finish

A later lab may create the destination beside nothing important. Production cutover is not this page.

Rollback of the writing hour is discarding the draft. Rollback of a cutover you did not start is unnecessary, and that is the point.

Pick one converter pair.
Pick one object you can read.
Convert and read the flags.
Diff names, rules, and identities.
Remove secrets and new wide permissions.
Keep the source and any state backup note.
Do not apply either side in this window.

Mistakes that outlive the command

an IaC or pipeline migration fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Converting a whole production stack as the first try.
Applying the draft to see if it works.
Two tools updating one live resource.
Deleting the source the same hour.
Copying a secret into the destination file.
Ignoring a flag.
A new 0.0.0.0/0 the converter invented.
A new administrator the converter invented.
State committed to git.
A customer file used as the sample.
Six converters in one hour.
A cutover clock before the diff is reviewed.

Decisions to write down before the window

One decision for an IaC or pipeline migration: One pair is chosen. One object is chosen. The flags are in the ticket. Names were compared. No new world-open rule remains. No new admin identity remains. Secrets were not copied. The source still exists. State backup is named, or there is no state. Nothing was applied. A second owner tool is not pointed at production. And a second person read the diff.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for an IaC or pipeline migration. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. an IaC or pipeline migration is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

Conversion checks before any cutover ticket

Confirm this before you call the change done: The pair and the object are named. The source and the draft are both in the note. Flags are listed. A world-open line was removed. An admin identity was removed. No secret is in the draft. The source file was not deleted. Nothing was applied. Production still has one owner tool. State is not in git. The sample was not customer data. The next step is a review, not a clock. The hostname in the prompt matches the hostname in the ticket for an IaC or pipeline migration. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for an IaC or pipeline migration happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.