The old-region decommissioning checklist

Each yes scores one point.

1. 1.Databases and read replicas RDS and Aurora instances, plus their manual snapshots. Automated snapshots go with the instance.
2. 2.EBS volumes and snapshots Including volumes in the available state.
3. 3.AMIs The image first, then the snapshots behind it.
4. 4.AWS Backup vaults and recovery points Vault Lock in compliance mode blocks deletion until retention ends. Those end dates go in the log.
5. 5.S3 buckets Log buckets, replication targets, and old static sites, plus their versioned objects.
6. 6.DynamoDB tables, global table replicas, and backups
7. 7.ElastiCache and OpenSearch snapshots
8. 8.Container images in ECR
9. 9.Queues and topics SQS queues and SNS topics.
10. 10.Secrets and parameters Secrets Manager secrets and Systems Manager Parameter Store entries.
11. 11.CloudWatch log groups Application logs often hold personal data.
12. 12.Lambda functions and layers
13. 13.CloudFormation stacks and leftover Terraform state Whatever the old region's code still describes goes too, so nobody re-applies it.
14. 14.Elastic IPs, load balancers, and NAT gateways They keep billing after the traffic is gone.
15. 15.KMS keys Deletion goes last. AWS waits 7 to 30 days before it removes a key. After that, nobody can read the data the key protected.
16. 16.The forgotten test environment Every team gets the question. There's usually one.

I leave out closing the old AWS accounts on the same day. They stay, empty and locked down by the region policy, for a full quarter. If nothing surprising turns up by then, they can go.