A 47-server VMware estate, migrated to AWS: agent-accelerated.
A growing enterprise was running its whole business on an ageing, on-premises VMware estate, and VMware had become more expensive and less certain to stay on.
- 47 servers, mixed and sprawling: Windows and Linux, spanning business apps, databases, and infrastructure services, some of it end-of-life.
- A hand-built security stack: a six-server, self-run security operations cluster that the team had to patch, host, and babysit.
- VMware cost & uncertainty: rising licensing and a strategic need to get off the platform onto something modern.
- Migration is slow and risky by hand: discovering dependencies, planning waves, and rebuilding the network manually is where migrations stall.
They wanted off VMware and onto AWS, without a year-long project or a big-bang cutover.
We ran the migration with AWS Transform for VMware, an agentic AI service that discovers the estate, maps dependencies, plans the waves, translates the network to AWS, and rehosts the servers, with our engineers steering and signing off each step.
Discover
Agentic discovery of the VMware estate and a full dependency map: no guesswork about what talks to what.
Plan waves
An AI-generated migration plan: applications grouped and sequenced into five waves, an 8-server pilot first.
Landing zone & network
A Control Tower landing zone, and the VMware network translated to an Amazon VPC, with a Site-to-Site VPN for the migration.
Migrate
Iterative, wave-by-wave rehosting onto right-sized EC2. Both environments live until each cutover is signed off.
// AWS reports AWS Transform can cut migration execution time by up to 90% versus traditional methods. Human-in-the-loop throughout: nothing cuts over without engineer and client sign-off.
// server count and waves from the delivered plan; cost figures modelled (On-Demand, Frankfurt); the 90% figure is AWS's published benchmark for AWS Transform.
“An entire VMware estate moved to AWS, with the discovery, wave planning, and network design done by agentic AI, and a custom agent for the parts the presets don't cover.”
Agentic discovery & wave planning
AWS Transform for VMwareAWS Transform discovered the estate (via discovery collectors and the Export for vCenter tool), mapped every dependency, and generated a migration plan that grouped applications and sequenced them into waves, with an 8-server Linux pilot to validate the process before higher-risk workloads moved. Databases were isolated into their own wave with coordinated downtime.
AI network translation & landing zone
VMware → VPCThe service translated the on-premises VMware network into an Amazon VPC architecture, and we stood up an AWS Control Tower landing zone (multi-account, least-privilege IAM, MFA) plus a Site-to-Site VPN that kept both environments connected throughout the migration.
A custom migration agent
agent builder toolkitBeyond the presets, we built a custom transformation agent with AWS Transform's agent builder toolkit, encoding this estate's specifics: mapping the self-built six-server security cluster onto AWS-native equivalents, flagging the two end-of-life servers for as-is rehosting with explicit risk notes, and applying the client's tiered, deny-all security-group baseline consistently. The agent improves from each wave's results.
Cloud-native security modernisation
retire the SOC clusterRather than rehost the six-server security stack on EC2, we replaced it with AWS-native services: GuardDuty, Security Hub, AWS Network Firewall, Amazon Detective, AWS Config, and Inspector v2, so the client gets managed threat detection and compliance with nothing to patch or host, plus AWS Backup across every instance.
Two routes were modelled: rehost everything, or modernise security on the way in. They chose to modernise.
Rehost everything: migrate all 47 servers to EC2, including the six-server security cluster running inline, a faithful copy of on-prem, but still a stack the team has to operate. Modelled at roughly $8,500 / month of AWS infrastructure.
Modernise security (chosen): migrate the workloads, but replace the security cluster and select infrastructure with AWS-native services. Fewer servers to run, managed security, and a lower bill, modelled at roughly $6,800 / month, about $20k/year less, while removing six servers' worth of operational burden.
// modelled AWS estimates, On-Demand, Frankfurt. Committed-use pricing would reduce EC2 compute a further 30–40% after a stabilisation period.
AWS Transform for VMware
A generative-AI service (large language models + graph neural networks) that automates the full lifecycle: discovery, dependency mapping, network translation, wave planning, and EC2 rehosting, with human-in-the-loop controls.
Custom agents
AWS Transform's agent builder toolkit lets us build agents tailored to a client (their security model, their edge cases, their standards) that plug into the same agentic workflow and learn from each run.
Landing zone + EC2
AWS Control Tower governance, right-sized EC2 across two Availability Zones, AWS Backup on every instance, and cloud-native security, all defined and deployed as repeatable infrastructure.
services involved: aws