Institutional digital asset platform · AWS MAP business case
An agentless VMware discovery, a third-party IdP-to-Identity Center SAML fix, and a Directional Business Case for an institutional financial platform.
At a glance
- Problem
- An institutional digital asset and accounting platform running on-premises in VMware needed a full evaluation for migration to AWS under the Migration Acceleration Program (MAP). To win executive sponsorship and AWS MAP co-funding, the engineering and finance leadership required empirical utilization baselines, right-sized EC2 compute recommendations, licensing optimization models, and a formal 6-pillar Migration Readiness Assessment (MRA). The client's existing third-party SAML integration blocked access to AWS Transform workspaces, and strict financial compliance demanded a zero-agent discovery methodology.
- Approach
- Designed and executed a dual-path discovery approach using automated RVTools exports alongside an agentless AWS Transform OVA collector deployed directly into the private VMware vCenter cluster. To break the authentication deadlock, built an identity bridge that connects the enterprise IdP to AWS IAM Identity Center through SAML and SCIM sync, so it works alongside the existing access setup. The ingested telemetry was evaluated in AWS Transform to produce a 3-year Directional Business Case (DBC), licensing comparison (BYOL vs. License Included), and a phased 7Rs workload migration roadmap.
- What this enables
- Establishes the factual, technical, and financial foundation required to pass AWS MAP Assess milestone audits, qualifying for co-funding grants and providing the engineering organization with a sequenced wave roadmap.
Key results
Automating VMware discovery and modeling 3-year cloud TCO for digital asset accounting
The problem
An institutional digital asset and accounting platform running on-premises in VMware needed a full evaluation for migration to AWS under the Migration Acceleration Program (MAP). To win executive sponsorship and AWS MAP co-funding, the engineering and finance leadership required empirical utilization baselines, right-sized EC2 compute recommendations, licensing optimization models, and a formal 6-pillar Migration Readiness Assessment (MRA). The client's existing third-party SAML integration blocked access to AWS Transform workspaces, and strict financial compliance demanded a zero-agent discovery methodology.
The architectural solution
Designed and executed a dual-path discovery approach using automated RVTools exports alongside an agentless AWS Transform OVA collector deployed directly into the private VMware vCenter cluster. To break the authentication deadlock, built an identity bridge that connects the enterprise IdP to AWS IAM Identity Center through SAML and SCIM sync, so it works alongside the existing access setup. The ingested telemetry was evaluated in AWS Transform to produce a 3-year Directional Business Case (DBC), licensing comparison (BYOL vs. License Included), and a phased 7Rs workload migration roadmap.
- 01 VMware vCenter cluster Read-only service account interfaces with vSphere API to extract hypervisor inventory and performance peaks across compute, memory, and datastores.
- 02 Agentless discovery appliance AWS Transform OVA collector runs within the private hypervisor network, streaming hourly hardware metrics and SQL metadata without installing OS agents.
- 03 Identity Center SAML bridge Enterprise IdP federates with AWS IAM Identity Center via SAML 2.0 and automated SCIM user provisioning, satisfying AWS Transform workspace access requirements.
- 04 Business case & TCO engine AWS Transform normalizes server specs, models 3-year Reserved Instances, evaluates BYOL vs License-Included licensing, and outputs executive reports.
Quantifying the cloud business case without disrupting operations
Financial and crypto accounting platforms operate under stringent regulatory and uptime constraints. When evaluating a cloud transition under the AWS Migration Acceleration Program (MAP), executive leadership required proof that moving to AWS would deliver both structural cost reductions and operational scalability, without introducing security vulnerabilities or unbudgeted licensing penalties.
The discovery process had to answer three critical questions:
- What is the true on-premises resource utilization? Rather than allocating AWS instances based on allocated vCPU and RAM (which leads to massive over-provisioning), the assessment required empirical utilization percentiles (average vs. peak CPU, memory, and disk throughput).
- What will AWS cost compared to on-premises over 3 to 5 years? Detailed total cost of ownership (TCO) modeling across compute, storage, data transfer, and support.
- Is the organizational structure ready for cloud operations? Maturity scoring across security, governance, platform, operations, people, and business pillars.
Implementation notes
- Dual-path discovery selection: Implemented Path 1 (rapid point-in-time inventory extraction via RVTools
.xlsxparsing) for immediate sizing sanity checks, coupled with Path 2 (agentless collector OVA deployed in vCenter) to record multi-day workload utilization cycles. - Identity Center integration: AWS Transform requires IAM Identity Center. The existing direct third-party-to-IAM SAML role federation did not support Transform workspaces. The enterprise IdP was configured in IAM Identity Center via SAML + SCIM, enabling both setups to coexist without interrupting active developer access.
- Licensing strategy analysis: Compared Microsoft Windows Server and SQL Server Bring-Your-Own-License (BYOL) against AWS License-Included pricing, identifying optimal instance types (e.g. AWS Graviton vs x86 for database tiers) to minimize core-licensing liabilities.
7Rs portfolio analysis and target state design
The collected inventory was systematically mapped across the 7Rs migration strategies:
- Rehost (Lift & Shift): Legacy operational utility servers with limited life expectancy.
- Replatform (Lift & Reshape): Relational databases transitioned from self-managed SQL Server VMs to Amazon RDS Multi-AZ, eliminating hypervisor maintenance.
- Refactor (Cloud Native): High-throughput financial transaction ledgers and calculation engines targeted for containerization on Amazon EKS Graviton ARM64.
- Retire: Decommissioned legacy staging and orphaned test environments identified during the vCenter datastore sweep.
Preserving data confidentiality in discovery
The discovery tool operated strictly on read-only API permissions, collecting resource capacity, CPU/RAM utilization curves, disk throughput, and network connection metadata (source/destination IP and port). It collected zero application data, financial transaction payloads, database records, or customer personal information (PII).
Passing the MAP Assess milestone gate
The assessment concluded with the delivery of the executive Directional Business Case (DBC) PDF generated from AWS Transform, the formal Migration Readiness Assessment (MRA) scorecard, and a phased migration wave roadmap. These deliverables satisfied all AWS MAP governance gates, securing executive approval to proceed to the Mobilize phase.
Questions about this case study?
Happy to go deeper on any part of this: the architecture, the trade-offs, or the decisions behind it.
anupojuprudhvi@gmail.com