Cloud Migration Accelerator

Problem: Enterprises migrating thousands of legacy applications to a modern, hardened cloud environment face a wall of manual, repetitive work: discovering what each app actually depends on, deciding which apps are safe to move as-is, generating infrastructure code that matches a secure pattern, and cutting traffic over without downtime. Doing this by hand for a fleet of 1,000+ apps against a deadline is not realistic. Solution: Cloud Migration Accelerator is an agentic pipeline of four cooperating agents, Discovery, Planning, Blueprint/IaC, and Cutover, that automates a full AWS-to-AWS rehost migration end to end. Discovery scans a legacy AWS account (EC2, security groups, EBS, tags, SSM) and tiers every app GOLDEN, GRAY, or RED based on ten security and dependency findings (open SSH, unencrypted EBS, IMDSv1, missing network segmentation, hardcoded IPs, and more), using an LLM only for the borderline calls. Planning turns the dependency graph into a wave schedule that never moves a consumer before its provider, respecting weekly capacity and holiday freezes. Blueprint/IaC maps each legacy app's config onto a hardened Terraform "golden" module (private subnets, KMS-encrypted EBS, IMDSv2, SSM-only access) and runs a real terraform apply. Cutover shifts live traffic between the old and new instance behind one ALB in 10/50/100% steps, watching error-rate, latency, and health gates, and automatically rolls back within seconds if a wave misbehaves. We prove this two ways at once. A real slice: six real applications (three intentionally insecure sample apps plus Juice Shop, Gitea, and Vaultwarden) run in an actually provisioned legacy AWS account and are migrated live into a second, hardened AWS account, with real traffic shifted through a real Application Load Balancer and a real rollback exercised. A synthetic scale: roughly 1,000 generated app records flow through the same Discovery and Planning agents so the dashboard shows what fleet-scale planning looks like for an enterprise-sized estate, without needing 1,000 real EC2 instances. Target users are cloud migration teams and the enterprises they work for: anyone facing a multi-year, multi-thousand-app rehost program who needs a way to triage, sequence, and execute the move with an audit trail, instead of a spreadsheet and tribal knowledge. What makes it creative and unique is treating the LLM as a decision-maker that is never trusted to act directly: every AWS mutation goes through a typed, schema-validated tool call restricted to resources tagged for the project, so the agent can reason about ambiguous cases (which tier an app belongs to, what golden-module inputs fit it) while code, not the model, executes anything against real infrastructure. The project also demonstrates the full operational loop a real migration needs: live dependency detection, wave sequencing under capacity constraints, generated infrastructure-as-code with a human-readable diff, and gated, auto-rolling-back traffic cutover, all visible in a live console driven by real-time events rather than a mocked demo.