We Migrated from AWS to GCP in 2026: 1-Year Retrospective of 25% Lower Costs and Better Performance

import boto3
import hashlib
import logging
import os
from google.cloud import storage
from botocore.exceptions import ClientError
from google.api_core import exceptions as gcp_exceptions
from tenacity import retry, stop_after_attempt, wait_exponential

# Configure logging for audit trails
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.FileHandler("migration_validation.log"), logging.StreamHandler()]
)
logger = logging.getLogger(__name__)

# Initialize AWS S3 client with retry logic
s3_client = boto3.client(
    "s3",
    region_name="us-east-1",
    aws_access_key_id=os.getenv("AWS_ACCESS_KEY_ID"),
    aws_secret_access_key=os.getenv("AWS_SECRET_ACCESS_KEY")
)

# Initialize GCP Storage client
gcs_client = storage.Client.from_service_account_json(
    os.getenv("GCP_SERVICE_ACCOUNT_KEY_PATH")
)

@retry(
    stop=stop_after_attempt(3),
    wait=wait_exponential(multiplier=1, min=2, max=10),
    reraise=True
)
def get_s3_object_md5(bucket: str, key: str) -> str:
    """Fetch MD5 checksum of an S3 object using streaming to avoid memory issues for large files."""
    md5_hash = hashlib.md5()
    try:
        response = s3_client.get_object(Bucket=bucket, Key=key)
        for chunk in response["Body"].iter_chunks(chunk_size=8192):
            md5_hash.update(chunk)
        return md5_hash.hexdigest()
    except ClientError as e:
        logger.error(f"S3 error fetching {bucket}/{key}: {e}")
        raise

@retry(
    stop=stop_after_attempt(3),
    wait=wait_exponential(multiplier=1, min=2, max=10),
    reraise=True
)
def get_gcs_object_md5(bucket: str, blob_name: str) -> str:
    """Fetch MD5 checksum of a GCS object, handling both small and large files."""
    md5_hash = hashlib.md5()
    try:
        bucket_obj = gcs_client.bucket(bucket)
        blob = bucket_obj.blob(blob_name)
        # Stream download to avoid memory pressure
        with blob.open("rb") as f:
            for chunk in iter(lambda: f.read(8192), b""):
                md5_hash.update(chunk)
        return md5_hash.hexdigest()
    except gcp_exceptions.GoogleAPIError as e:
        logger.error(f"GCS error fetching {bucket}/{blob_name}: {e}")
        raise

def validate_replication(s3_bucket: str, gcs_bucket: str, prefix: str = "") -> dict:
    """
    Validate that all objects in an S3 bucket (with optional prefix) are replicated to GCS
    with matching MD5 checksums. Returns a dict with validation results.
    """
    results = {
        "total_objects": 0,
        "matched": 0,
        "mismatched": 0,
        "missing": 0,
        "errors": []
    }

    # List all S3 objects with the given prefix
    try:
        paginator = s3_client.get_paginator("list_objects_v2")
        for page in paginator.paginate(Bucket=s3_bucket, Prefix=prefix):
            for obj in page.get("Contents", []):
                s3_key = obj["Key"]
                results["total_objects"] += 1
                gcs_blob_name = s3_key  # Assume flat replication, adjust if namespace differs

                try:
                    s3_md5 = get_s3_object_md5(s3_bucket, s3_key)
                    gcs_md5 = get_gcs_object_md5(gcs_bucket, gcs_blob_name)
                    if s3_md5 == gcs_md5:
                        results["matched"] += 1
                        logger.info(f"Matched: {s3_key}")
                    else:
                        results["mismatched"] += 1
                        logger.error(f"Mismatch: {s3_key} (S3: {s3_md5}, GCS: {gcs_md5})")
                except Exception as e:
                    results["errors"].append(f"{s3_key}: {str(e)}")
                    logger.error(f"Validation error for {s3_key}: {e}")
    except ClientError as e:
        logger.critical(f"Failed to list S3 objects in {s3_bucket}: {e}")
        raise

    return results

if __name__ == "__main__":
    # Production S3 bucket and target GCS bucket
    S3_SOURCE_BUCKET = "production-user-uploads-2026"
    GCS_TARGET_BUCKET = "production-user-uploads-2026"
    VALIDATION_PREFIX = "media/"  # Validate only media uploads first

    logger.info(f"Starting replication validation for {S3_SOURCE_BUCKET} → {GCS_TARGET_BUCKET}")
    validation_results = validate_replication(S3_SOURCE_BUCKET, GCS_TARGET_BUCKET, VALIDATION_PREFIX)
    logger.info(f"Validation complete: {validation_results}")

# terraform/modules/gke-cluster/main.tf
# Provision a cost-optimized GKE Standard cluster with Committed Use Contracts (CUC)
# and preemptible node pools for batch workloads.

terraform {
  required_version = ">= 1.6.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

# Enable required GCP APIs
resource "google_project_service" "container" {
  project = var.project_id
  service = "container.googleapis.com"
  disable_on_destroy = false
}

resource "google_project_service" "compute" {
  project = var.project_id
  service = "compute.googleapis.com"
  disable_on_destroy = false
}

# Create a VPC for the GKE cluster to isolate network traffic
resource "google_compute_network" "gke_vpc" {
  project                 = var.project_id
  name                    = "${var.cluster_name}-vpc"
  auto_create_subnetworks = false
  mtu                     = 1460
}

# Create a subnet for the GKE cluster
resource "google_compute_subnetwork" "gke_subnet" {
  project                  = var.project_id
  name                     = "${var.cluster_name}-subnet"
  ip_cidr_range            = var.subnet_cidr
  region                   = var.region
  network                  = google_compute_network.gke_vpc.id
  private_ip_google_access = true

  secondary_ip_range {
    range_name    = "pods-range"
    ip_cidr_range = var.pods_cidr
  }

  secondary_ip_range {
    range_name    = "services-range"
    ip_cidr_range = var.services_cidr
  }
}

# Provision Committed Use Contract (CUC) for compute resources to reduce costs by 30-50%
resource "google_compute_resource_policy" "cuc_policy" {
  project  = var.project_id
  name     = "${var.cluster_name}-cuc-policy"
  region   = var.region
  description = "CUC for GKE node pools, 1-year term"

  group_placement_policy {
    vm_count = 10  # Commit to 10 nodes minimum
    availability_domain_count = 3
  }

  # 1-year commitment for cost savings
  lifecycle {
    create_before_destroy = true
  }
}

# Primary node pool (production workloads, on-demand instances)
resource "google_container_node_pool" "primary_pool" {
  project    = var.project_id
  name       = "${var.cluster_name}-primary-pool"
  cluster    = google_container_cluster.gke_cluster.id
  location   = var.region
  node_count = var.primary_node_count

  node_config {
    machine_type    = var.primary_machine_type  # n2-standard-32
    disk_size_gb    = 200
    disk_type       = "pd-ssd"
    service_account = google_service_account.gke_nodes.email
    oauth_scopes = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]
    labels = {
      "workload-type" = "production"
      "cost-center"   = var.cost_center
    }
    tags = ["gke-node", "production"]
  }

  # Autoscaling configuration
  autoscaling {
    min_node_count = var.primary_min_nodes
    max_node_count = var.primary_max_nodes
  }

  # Apply CUC policy to this node pool
  resource_labels = {
    "cuc-policy" = google_compute_resource_policy.cuc_policy.name
  }
}

# Preemptible node pool for batch/stateless workloads (70% cost reduction)
resource "google_container_node_pool" "preemptible_pool" {
  project    = var.project_id
  name       = "${var.cluster_name}-preemptible-pool"
  cluster    = google_container_cluster.gke_cluster.id
  location   = var.region
  node_count = var.preemptible_node_count

  node_config {
    machine_type    = var.preemptible_machine_type  # n2-standard-16
    disk_size_gb    = 100
    disk_type       = "pd-standard"
    preemptible     = true
    service_account = google_service_account.gke_nodes.email
    oauth_scopes = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]
    labels = {
      "workload-type" = "batch"
      "cost-center"   = var.cost_center
    }
    tags = ["gke-node", "preemptible"]
  }

  autoscaling {
    min_node_count = var.preemptible_min_nodes
    max_node_count = var.preemptible_max_nodes
  }
}

# GKE cluster configuration
resource "google_container_cluster" "gke_cluster" {
  project                  = var.project_id
  name                     = var.cluster_name
  location                 = var.region
  remove_default_node_pool = true
  initial_node_count       = 1  # Temporary, replaced by node pools

  network    = google_compute_network.gke_vpc.id
  subnetwork = google_compute_subnetwork.gke_subnet.id

  ip_allocation_policy {
    cluster_secondary_range_name  = "pods-range"
    services_secondary_range_name = "services-range"
  }

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = false
    master_ipv4_cidr_block  = var.master_cidr
  }

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }
}

# Service account for GKE nodes
resource "google_service_account" "gke_nodes" {
  project      = var.project_id
  account_id   = "${var.cluster_name}-gke-nodes"
  display_name = "GKE Nodes Service Account"
}

# Grant necessary permissions to the GKE nodes service account
resource "google_project_iam_member" "gke_nodes_logging" {
  project = var.project_id
  role    = "roles/logging.logWriter"
  member  = "serviceAccount:${google_service_account.gke_nodes.email}"
}

resource "google_project_iam_member" "gke_nodes_monitoring" {
  project = var.project_id
  role    = "roles/monitoring.metricWriter"
  member  = "serviceAccount:${google_service_account.gke_nodes.email}"
}

# prometheus/aws-gcp-comparison-rules.yml
# Prometheus alerting and recording rules to compare AWS and GCP workload performance
# post-migration. Includes latency, error rate, and cost metrics.

groups:
  - name: aws_gcp_migration_comparison
    interval: 30s
    rules:
      # Recording rules: normalize metrics from both clouds
      - record: http_request_duration_seconds:p99:ratio
        expr: |
          (
            histogram_quantile(0.99, sum(rate(http_request_duration_seconds_bucket{cloud="gcp"}[5m])) by (le, service)) /
            histogram_quantile(0.99, sum(rate(http_request_duration_seconds_bucket{cloud="aws"}[5m])) by (le, service))
          ) * 100

      - record: http_request_error_rate:ratio
        expr: |
          (
            sum(rate(http_requests_total{cloud="gcp", status=~"5.."}[5m])) by (service) /
            sum(rate(http_requests_total{cloud="gcp"}[5m])) by (service)
          ) /
          (
            sum(rate(http_requests_total{cloud="aws", status=~"5.."}[5m])) by (service) /
            sum(rate(http_requests_total{cloud="aws"}[5m])) by (service)
          ) * 100

      - record: node_cpu_usage:ratio
        expr: |
          (
            avg(rate(node_cpu_seconds_total{cloud="gcp", mode="idle"}[5m])) by (instance) /
            avg(rate(node_cpu_seconds_total{cloud="gcp"}[5m])) by (instance)
          ) /
          (
            avg(rate(node_cpu_seconds_total{cloud="aws", mode="idle"}[5m])) by (instance) /
            avg(rate(node_cpu_seconds_total{cloud="aws"}[5m])) by (instance)
          ) * 100

      # Alert: GCP p99 latency is worse than AWS (regression)
      - alert: GCPLatencyRegression
        expr: http_request_duration_seconds:p99:ratio > 110
        for: 5m
        labels:
          severity: critical
          team: platform
        annotations:
          summary: "GCP p99 latency is 10% higher than AWS for {{ $labels.service }}"
          description: "Service {{ $labels.service }} has p99 latency ratio of {{ $value }}% (GCP vs AWS). Investigate immediately."

      # Alert: GCP error rate is higher than AWS
      - alert: GCPErrorRateHigher
        expr: http_request_error_rate:ratio > 120
        for: 5m
        labels:
          severity: critical
          team: platform
        annotations:
          summary: "GCP error rate is 20% higher than AWS for {{ $labels.service }}"
          description: "Service {{ $labels.service }} has error rate ratio of {{ $value }}% (GCP vs AWS). Check pod logs and GCP health dashboards."

      # Alert: GCP CPU usage is higher than AWS (inefficient resource allocation)
      - alert: GCPCPUUsageHigher
        expr: node_cpu_usage:ratio < 90  # Lower idle time = higher usage
        for: 15m
        labels:
          severity: warning
          team: platform
        annotations:
          summary: "GCP CPU usage is 10% higher than AWS for {{ $labels.instance }}"
          description: "Instance {{ $labels.instance }} has CPU usage ratio of {{ $value }}% (GCP vs AWS). Consider resizing nodes or optimizing workloads."

      # Alert: Cost anomaly detected (GCP spend > 110% of AWS baseline)
      - alert: GCPCostAnomaly
        expr: |
          sum(rate(gcp_billing_estimated_charge{project="prod-2026"}[1h])) by (service) /
          sum(rate(aws_billing_estimated_charge{project="prod-2026"}[1h])) by (service) * 100 > 110
        for: 1h
        labels:
          severity: warning
          team: finance
        annotations:
          summary: "GCP spend is 10% higher than AWS baseline for {{ $labels.service }}"
          description: "Service {{ $labels.service }} has GCP spend ratio of {{ $value }}% vs AWS. Review resource allocation and CUC coverage."

  - name: migration_success_metrics
    interval: 1m
    rules:
      # Record total cost savings
      - record: migration:cost_savings_percent
        expr: |
          (1 - (sum(rate(gcp_billing_estimated_charge[30d])) / sum(rate(aws_billing_estimated_charge[30d])))) * 100

      # Record total latency improvement
      - record: migration:latency_improvement_percent
        expr: |
          (1 - (avg(http_request_duration_seconds:p99{cloud="gcp"}) / avg(http_request_duration_seconds:p99{cloud="aws"}))) * 100

      # Alert: Migration targets not met
      - alert: MigrationTargetsNotMet
        expr: |
          migration:cost_savings_percent < 20 or
          migration:latency_improvement_percent < 25
        for: 24h
        labels:
          severity: critical
          team: platform
        annotations:
          summary: "Migration targets not met: Cost savings {{ $value }}% (target 25%), Latency improvement {{ $value }}% (target 30%)"
          description: "Post-migration metrics are below target thresholds. Review workload configuration and cost optimization policies."

# application.yml
spring:
  cloud:
    gcp:
      spanner:
        instance-id: prod-spanner-instance
        database-id: payment-db
        connection-pool:
          max-size: 50
          min-size: 10
          idle-timeout: 30000

resource "google_compute_resource_policy" "cuc_1y" {
  name     = "prod-compute-cuc-1y"
  region   = "us-central1"
  group_placement_policy {
    vm_count = 20
    availability_domain_count = 3
  }
}

// OpenTelemetry configuration for Spring Boot
@Configuration
public class OtelConfig {
    @Bean
    public OpenTelemetry openTelemetry() {
        return OpenTelemetrySdk.builder()
            .setMeterProvider(PrometheusMeterProvider.builder().build())
            .setTracerProvider(SdkTracerProvider.builder()
                .addSpanProcessor(BatchSpanProcessor.builder(
                    OtlpGrpcSpanExporter.builder()
                        .setEndpoint("otel-collector:4317")
                        .build())
                .build())
            .build())
            .build();
    }
}