How we migrated millions of S3 assets with zero downtime

Context

A global platform team needed to migrate a critical S3 bucket powering static asset delivery — including scripts, stylesheets, and images — for multiple web applications. The assets served millions of requests via CloudFront and were distributed across legacy AWS accounts with inconsistent configurations.

The goal: consolidate infrastructure, improve security, and migrate to a new AWS organization — without affecting end-user experience.

Challenge

This wasn’t a lift-and-shift. Every S3 object key, CloudFront behavior, and access path had to remain intact. The team needed:

• Zero downtime
• No broken links or failed asset loads
• CloudFront parity across environments
• Repeatability via infrastructure as code
• Rollback capability at any point in the process

Solution

We designed a blue-green deployment model that ran two environments in parallel — the legacy setup and the new target stack — with full readiness for rollback.

Key components of the strategy:

• S3 Replication Rules: kept old and new buckets in sync automatically
• S3 Batch Operations: enabled mass tagging, object verification, and cleanup
• CloudFront Infrastructure via Terraform: ensured identical behavior between environments
• Automated Validation: powered by log scans and object diffing before switching traffic
• DNS-Based Cutover: safely routed traffic to the new setup with the option to revert instantly

This was all delivered with a focus on traceability, modular automation, and security best practices.

Outcome

• The migration completed without any disruption to asset delivery
• CloudFront behaviors and S3 keys remained identical
• Terraform now manages the entire asset delivery pipeline
• Internal observability improved via Athena queries and structured logging
• The system is now easier to monitor, scale, and maintain

How We Validated It Worked

To verify the success of the migration:

• We used Athena to scan real CloudFront logs and confirm all key assets were still being served correctly
• We ran test queries on both old and new S3 environments to verify parity
• And thanks to the blue-green architecture, we had full rollback control — though we never had to use it