Brownfield migration | Firemind
Brownfield migration

Move the estate you inherited.As code, through your pipeline.

Existing workloads moved into new accounts or regions, as code, through your pipeline.

AWS, Azure and Google Cloud
Read-only discovery first
Infrastructure as code
Pull request, not API
Your change process
Drift detection
The problem

Moving an estate you inherited is slow because nobody fully knows what is in it.

Dependencies are discovered when something breaks. The target gets built by hand and drifts from the source before the move is finished.

The IT Operations Engine reads the source estate first, generates the target as infrastructure code, and moves the state across using your cloud's native snapshot tooling. Your pipeline applies the code. Our engineers take the change through your change process.

What a migration has to get right

  • A complete picture of the source estate before anything moves, including the dependencies a naive move misses
  • A target that is generated rather than hand-built, so it cannot drift from the source mid-migration
  • State carried across with the cloud's own snapshot tooling rather than bespoke copy scripts
  • Each stage verified before the next runs, with the original left in place until the replacement is confirmed live
  • Cutover and merge decisions that stay with your team and your change process
What we do

Read the source, generate the target, move the state.

The engine reads the source estate first, generates the target as infrastructure code, and hydrates it from snapshots of the original. It writes the code and the evidence. Your pipeline applies it, and your change process approves it. That separation is deliberate.

Discovery
Infrastructure as code
Snapshot hydration
Drift detection
Change control

Find, fix, keep green

    • Find - Discovery of the source estate across every region and service, including the dependencies a naive move misses. When the engine decommissions a server it removes the volume and the network interfaces, and leaves alone the security group still used by something else. Drift detection shows what is not yet under code, so the migration starts from a known position.
    • Fix - The target is generated as infrastructure code and raised as a pull request. Snapshots of the source are shared to the target account and hydrate the new resources on first deployment. Each stage is verified before the next runs, and the original is not removed until the replacement is confirmed live.
    • Keep green - A migration ends. Once landed, the workload is operated under environment operations, cloud security and compliance assessment, where standing checks keep it in the state it arrived in.

Ready to prove the mechanism on one workload?

A scoping call is enough to pick the first workload and agree what a lab target looks like.

Scope a pilot →
How it starts

Read-only first. One workload into a lab.

Nothing production-facing moves until the mechanism has been proven somewhere it cannot hurt.

  • Read-only discovery

    We take read-only access to the source accounts and build the model of what is actually there, across every region and service.

    • Dependencies mapped before anything is planned
    • Drift detection against what is already under code
    • A known starting position, written down
  • One workload into a lab

    A single workload is generated as infrastructure code and moved into a lab target, so you can see the mechanism end to end before it touches production.

    • Target generated, not hand-built
    • Snapshots hydrate the new resources on first deployment
    • Each stage verified before the next runs
  • Production under your change process

    Once the pattern is proven, the same mechanism carries production workloads. The engine raises the pull request; your pipeline applies it and your change process approves it.

    • Pull request per move, reviewable in full
    • The original stays until the replacement is confirmed live
    • Cutover scheduled by you
What stays with you

Cutover decisions and the merge.

The engine writes the code and the evidence. The approval is yours, through your CAB.

You gain:

  • The engine raises the pull request. It does not apply the infrastructure code itself.
  • Resources already managed by Terraform are recognised, and changes are recommended through the repository rather than the API, so state does not drift.
  • Once the workload has landed, it is operated under environment operations, cloud security and compliance assessment.

FAQ

Questions.

No. It raises the pull request. Your pipeline applies it and your change process approves it. That is deliberate.

The engine recognises them and recommends changing them through the repository rather than the API, so state does not drift.

Start with read-only discovery of the source accounts.

Tell us which accounts are in scope and we will agree a first workload and a lab target. No obligation, and nothing moves until you say so.

Your benefits:

  • Read-only first - discovery before anything is planned or moved.
  • Generated, not hand-built - the target lands as infrastructure code.
  • Your pipeline applies it - the engine raises the pull request.
  • Proven in a lab - before anything production-facing moves.

What happens next?

Talk.

A focused discussion about the source estate and where it needs to go.

Discover.

Read-only discovery of the source accounts, and a first workload chosen with you.

Move.

One workload into a lab target, then production under your change process.

No obligation. Just a focused discussion about the estate you need to move.

We'll only use your details to respond to your enquiry. No newsletters unless you ask for them.