Skip to content

This is the multi-page printable view of this section. .

Return to the regular view of this page.

Cloud Exit Playbook

Reversible, staged practices for measuring and improving exit capability without beginning with a migration.

The playbook supports an operational conclusion: cloud exit is a staged, reversible engineering capability, not a leap into the dark. Begin by measuring recovery somewhere else; decide whether to migrate only after the constraints are visible.

Five practices

  1. Exit drill — restore a complete critical dataset elsewhere and time it.
  2. Data first — separate custody and recoverability from application migration.
  3. Inventory — map dependencies, semantics, contracts, and owners.
  4. Staging — move through replay, shadow, partial traffic, and reversible cutover.
  5. Negotiation — turn measured exit options into better contract terms.

The call to action is the first drill. It is useful even when the final decision is to stay with the current provider.

1 - The exit drill

Restore a complete critical dataset somewhere else, verify it, time it, and record every dependency.

The exit drill is the smallest useful measure of cloud exit capability. It does not change production traffic and should not require a migration project.

Objective

Produce a verified, usable copy of one critical dataset in an environment that does not depend on the original service’s control plane. Record elapsed time, human effort, cost, missing semantics, and every dependency that prevented a clean restore.

One-afternoon version

  1. Choose one dataset. Prefer important, bounded, and already backed up.
  2. Declare success. Counts, checksums, schema, permissions, recovery point, and one application query.
  3. Choose elsewhere. Another provider, a local host, colocation, or an independent open implementation.
  4. Start the clock. Include export preparation, transfer, restore, and verification.
  5. Do not improvise silently. Log missing credentials, undocumented steps, rate limits, and manual support.
  6. Verify independently. Use checksums plus semantic checks; “the command exited zero” is insufficient.
  7. Record the number. Report elapsed time, hands-on time, data age, total cost, and blockers.
  8. Clean up safely. Confirm retention and deletion requirements before removing the drill copy.

Scorecard

Field Record
Dataset and size What was actually included
Recovery point Age of the restored data
Elapsed time Start to verified usable copy
Hands-on time Human effort, by role
Direct cost Export, transfer, compute, storage, support
Missing semantics Roles, versions, policies, jobs, logs, keys
Blocking dependencies Provider-only services, identities, approvals, tools
Repeatability Scripted, documented, or one-off

Safety boundary

Use non-production credentials and an isolated target. Do not weaken retention, encryption, privacy, or access controls to make the drill pass. A failed drill is a useful result; it identifies the next capability to build.

2 - Data first

Establish independent custody, export, verification, and restore before moving application traffic.

Data is usually the slowest, heaviest, and least replaceable part of an exit. Separate its custody from the application cutover.

Sequence

  1. Define ownership, retention, recovery point, and deletion requirements.
  2. Maintain a documented export or replica outside the original control plane.
  3. Verify completeness with checksums and semantic tests.
  4. Rehearse restore on an independent implementation.
  5. Measure lag, throughput, cost, and the largest bounded recovery window.
  6. Only then design application replay or cutover.

“Data first” does not mean copying bytes while losing roles, schemas, versions, policies, keys, or audit context. C2 defines the completeness test.

3 - Dependency inventory

Map data, APIs, identities, control planes, contracts, people, and recovery ownership before planning a move.

An exit plan is only as complete as its dependency map.

Inventory layers

  • Data: stores, size, growth, versions, retention, backup, keys, owners.
  • Interfaces: protocols, SDK calls, provider extensions, quotas, events.
  • Identity: users, roles, policies, federation, secrets, break-glass access.
  • Control plane: provisioning, deployment, observability, DNS, certificates, billing.
  • Operations: on-call, runbooks, support paths, recovery objectives, drills.
  • Commercial: contracts, credits, commitments, notice periods, termination, licenses.
  • People: accountable owner, domain expert, approver, and replacement skill.

Mark each dependency portable, adaptable, replaceable, retained, or unknown. Unknowns are the first work queue, not a reason to invent certainty.

4 - Staged migration

Move through replay, shadow, partial traffic, bounded cutover, and rollback with explicit gates.

Do not make the first real test a full production cutover.

Gates

  1. Offline restore: data and configuration rebuild successfully elsewhere.
  2. Replay: recorded or synthetic workload verifies semantics and performance.
  3. Shadow: target receives a copy of live changes without serving users.
  4. Partial traffic: a bounded cohort uses the target with measurable rollback.
  5. Cutover: recovery point, freeze window, decision owner, and abort threshold are explicit.
  6. Stabilize: run both observability and recovery procedures for the agreed window.
  7. Decommission: remove old dependencies only after retention, rollback, and contract gates close.

Every gate has success evidence, an owner, an abort threshold, and a tested path back. A hybrid end state can be a deliberate architecture, not a failed exit.

5 - Negotiate with an exit option

Use measured portability, cost, and recovery evidence to improve terms without bluffing.

Negotiating power comes from a credible alternative, not an angry threat.

Bring evidence

  • A current dependency inventory and the scope that can actually move.
  • Exit-drill elapsed time, blockers, and independently verified data copy.
  • Like-for-like cost model with sensitivity rather than one headline ratio.
  • Commitment value remaining at each decision date.
  • Required export, incident, support, and contract remedies stated as testable terms.

Ask for capabilities, not favors

Prefer automatic egress waivers, documented bulk export, transferable credits, shorter commitments, portable interfaces, incident-report deadlines, and usable SLA remedies over one-time discretionary discounts. A concession that disappears with the account team is not exit capability.