Runbook template
The cutover runbook
A one-page cutover runbook for moving data to an EU region: the countdown, go and no-go criteria, and a rollback with an owner per line.
Stateless services move in an afternoon. The data and the DNS cutover take the planning. I'm starting to see the same shortcut in a lot of plans: a Sunday night maintenance window that turns into Monday.
Without downtime means without customer-visible downtime. A short write freeze of seconds to a few minutes, announced and measured, is usually the price. Every wave gets a rehearsal against a copy, with a stopwatch. The rollback runs for real in that rehearsal, before the real night.
From the talk: Leaving us-east-1: moving a startup into the EU without downtime
The countdown
| When | Step | Owner | Done |
|---|---|---|---|
| T minus 7 days | We lower the DNS TTL to 60 seconds on every record that moves. | ||
| T minus 7 days | We start continuous replication: a cross-region read replica, or change data capture with a database migration service. We watch the lag. | ||
| T minus 7 days | We start object storage replication for new objects and a batch copy for existing ones. | ||
| T minus 3 days | We rehearse the full wave against a copy, with a stopwatch, and run the rollback too. | ||
| T minus 1 day | Go or no-go meeting against the criteria below. Customers hear about the short write freeze. | ||
| T minus 1 hour | We confirm replication lag, object counts, and checksums. On-call staff stand ready on both sides. | ||
| T 0 | We freeze writes and wait for zero replication lag. | ||
| T plus a few minutes | We promote the EU database and point the application at it. | ||
| T plus a few minutes | We shift traffic with weighted DNS: 10%, then 50%, then 100%, with an error-rate check at each step. | ||
| T plus 1 hour | We verify error rates, latency, a test transaction end to end, and writes landing in the EU. | ||
| T plus 1 day | The old region stays read-only until the rollback window closes. |
The go or no-go check
Every answer has to be yes. One no moves the date.
Each yes scores one point.
- 1.Replication lag stayed under the agreed limit for the last 24 hours.
- 2.The rehearsal freeze fit inside the window we promised customers.
- 3.We ran the rollback for real in the rehearsal, and it worked.
- 4.Object counts and checksums match on both sides.
- 5.Every step in the countdown has a named owner who is available.
- 6.Customers know the time and length of the write freeze.
Rollback
The trigger exists before the night. One example: an error rate above the baseline for five minutes.
- We shift the DNS weights back to the old region. Low TTLs make this take effect in about a minute.
- We freeze writes again. Short, like the first one.
- We reverse the replication. The writes that landed in the EU copy back to the old database before it takes traffic again.
- We unfreeze in the old region and verify. Same checks as the cutover.
- We write down what happened. The next rehearsal starts from that note.
What I leave out on purpose
I leave out dual writes from application code across regions, multi-master databases, and a custom sync service. Each one adds a failure mode to debug during the most stressful hour of the project. Replication with a tested rollback is simpler to run and simpler to reason about.
Next step
I highly recommend bringing your largest database's size and its writes per second to a thirty-minute call. I'll estimate the freeze and the replication path that fits. How long a freeze could your customers live with?
Book a callThese takeaways are an engineer's reading of the rules and the tools. I wrote them to help teams decide what to build. They aren't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.
Other takeaways from this talk
Template
Migration readiness map
A one-page map of every workload and data store before a move to an EU region, plus a Terraform policy that denies non-EU regions.
Checklist
Residency evidence pack
The five attachments that answer most data-location questions in a security questionnaire, and how to keep them true every quarter.
Checklist
Old-region decommissioning checklist
What to find and delete in the old AWS region after a move to the EU: snapshots, vaults, log buckets, images, secrets, and the test stack.
Let's talk.
A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?
Prefer email or phone? hello@netninjas.eu or +31 6 45984313