Overview — federal cloud migration beyond the slideware
Every federal agency has a cloud strategy slide deck. Far fewer have a cloud portfolio that actually delivers cost savings, mission agility, and defensible security. The gap is not strategy — it is disciplined execution: a per-workload 7Rs decision, a landing zone that inherits FedRAMP controls, waves that ship every 8-12 weeks, reconciled cutovers, and honest cost reporting to the sponsor. That's the work.
Precision Delivery Federal LLC helps agencies close that gap. We are a SAM.gov registered small business (UEI Y2JVCZXT9HP5, CAGE 1AYQ0, NAICS 541512). Our cloud migration practice is grounded in hands-on engineering, not just advisory slides. We write the Terraform, we build the CI/CD, we author the SSP updates, we run the cutovers at 2 AM.
Federal Cloud Migration Playbook
Our technical stack
| Layer | Primary | Alternates | When we use it |
|---|---|---|---|
| Target clouds | AWS GovCloud (US) | Azure Government, Azure Gov IL5, AWS Secret | Per agency / IL requirement. |
| Landing zone | AWS Control Tower + SCPs | AWS LZA for GovCloud, Azure Landing Zones | Multi-account / multi-subscription baselines. |
| IaC | Terraform + terragrunt | CloudFormation, Bicep, Pulumi | Terraform default for multi-cloud portability. |
| Discovery | AWS Application Discovery Service | Azure Migrate, CAST Highlight | Portfolio inventory + dependency mapping. |
| Data migration | AWS DMS, Snowball Edge | Azure Data Box, AzCopy, rsync at scale | Scale-dependent. |
| Server migration | AWS MGN (formerly CloudEndure) | Azure Migrate, Carbonite Migrate | Rehost use cases. |
| Containerization | EKS, ECS | AKS, OpenShift | Replatform to containers when justified. |
| CI/CD | GitHub Actions, GitLab CI | AWS CodePipeline, Azure DevOps | Federal GitHub or GitLab tenants preferred. |
| Observability | CloudWatch + Grafana + OpenTelemetry | Azure Monitor, Datadog Government | Unified telemetry across clouds. |
| FinOps | AWS Cost Explorer + CUR | Azure Cost Management, CloudHealth | Agency-level chargeback and showback. |
Federal use cases
Data-center exit
shuttering a government data center and migrating workloads to GovCloud in waves.
Commercial-to-GovCloud repatriation
workloads built in commercial AWS / Azure moved to GovCloud for compliance.
IL5 build-out for DoD mission systems
Azure Government IL5 landing zones supporting DoD components. DoD page.
VA modernization cloud target
landing zone for VA modernization workstreams. VA page.
USDA mission cloud
mixed SaaS + PaaS + IaaS consolidation. USDA page.
FedRAMP-high for HHS workloads
CMS and NIH program migrations.
Cloud-native greenfield for SBIR pilots
new capabilities built natively in GovCloud.
EPA environmental data platform migration
DOI / BLM geographic data platform migration
DHS component IT consolidation
Reference architectures
1. FedRAMP High landing zone in AWS GovCloud
Organization with accounts for: Management, Log Archive, Audit, Security Tooling, Network, Shared Services, and per-workload Workload accounts (Dev/Test/Prod). SCPs enforce region restrictions (GovCloud-only), deny root actions, and require KMS encryption on all data services. CloudTrail Organization Trail lands in the Log Archive account S3 with MFA-delete; AWS Config aggregator surfaces drift. Networking: Transit Gateway hub-and-spoke, PrivateLink for data services, egress through a centralized inspection VPC with AWS Network Firewall. Every workload account inherits these controls; the SSP references the landing zone baseline directly.
2. Azure Government IL5 landing zone
Management Group hierarchy: Root → Platform → Landing Zones → Decommissioned. Azure Policy enforces IL5 baseline: region restrictions, CMK requirements, private endpoints, Defender for Cloud. Bastion-only access. Networking via vWAN with regional hubs and Azure Firewall Premium. Log Analytics workspace with Sentinel for SOC integration.
3. Hybrid data-center-to-cloud wave
A data-center with 200 applications gets decomposed into 25 waves of ~8 applications each. Wave 1: low-risk static content sites (rehost). Wave 2: stateless web apps (replatform to ECS). Wave 3-5: data-heavy apps (replatform with RDS migration). Wave 6+: higher-risk tier-1 systems (refactor using strangler-fig patterns — see our legacy modernization capability).
Delivery methodology
- Mobilize (2-4 weeks) — stakeholder alignment, governance model, CCB formation.
- Discover (4-8 weeks) — portfolio inventory, dependency mapping, business criticality rating.
- Decide (2-4 weeks) — 7Rs decision per app, wave plan, landing zone design.
- Land (4-6 weeks) — build the landing zone, CI/CD, shared services.
- Migrate (ongoing, wave-by-wave) — 8-12 week waves, each ending with a measurable closeout.
- Optimize — rightsizing, RI/SP purchases, Graviton/ARM evaluation, architecture improvements.
- Retire — formal decommissioning of source systems; ATO boundary updates.
Engagement models
Fixed-price landing zone
bounded 8-12 week build with defined deliverables.
Fixed-price per wave
predictable per-wave pricing for migration factories.
T&M migration program
for long-horizon portfolios.
TMF, WCF, and agency modernization funds
shape the business case + deliver.
Sub to prime
landing-zone and migration specialist inside a prime's team.
Maturity model
Level 1 — Ad hoc cloud usage
scattered accounts, no central governance.
Level 2 — Managed landing zone
multi-account org, baseline SCPs, central logging.
Level 3 — Productized landing zone
self-service account vending, reusable IaC modules, SSP-inheritance documented.
Level 4 — FinOps-integrated
chargeback, rightsizing, committed-use planning.
Level 5 — Platform engineering
internal developer platform with paved paths for compliant deployment.
Deliverables catalog
- Portfolio inventory (CSV + dependency graph).
- 7Rs decision matrix.
- Wave plan with dependencies.
- Landing zone IaC (Terraform modules).
- SCPs / Azure Policy baselines.
- Shared services (logging, monitoring, backup).
- Per-app migration runbooks.
- Reconciliation and validation reports.
- Cutover plans + rollback playbooks.
- SSP updates and ATO package inputs.
- Decommissioning checklists.
- Cost model + realized-savings reports.
Technology comparison — honest tradeoffs
| Option | Strengths | Weaknesses | Federal fit |
|---|---|---|---|
| AWS GovCloud | Broadest FedRAMP-High services, strong IL5, mature partners. | Region lag behind commercial, pricing premium. | Very high — default choice for many agencies. |
| Azure Government | Deep DoD IL5/IL6 footprint, strong M365 integration. | Fewer services vs commercial, pricing premium. | Very high — DoD and M365-heavy agencies. |
| Oracle Gov Cloud | Oracle DB lift-and-shift, JWICS / DoD niches. | Smaller ecosystem. | Medium — Oracle-heavy portfolios. |
| Google Public Sector | Assured Workloads, data analytics strength. | Limited FedRAMP-High services. | Medium — analytics-focused. |
| IBM Cloud for Government | IBM legacy integration. | Smaller ecosystem. | Low-medium. |
| On-prem Kubernetes (OpenShift) | Full sovereign control. | Ops burden on agency. | Case-by-case. |
Federal compliance mapping
Landing zones are designed so the workload's SSP inherits most baseline controls. Representative coverage:
AC-2, AC-3, AC-6
SSO (Login.gov, agency IdP), SCP / policy-enforced least privilege, break-glass procedures.
AU-2, AU-6, AU-12
CloudTrail Organization Trail / Azure Activity Log with immutable storage, centralized SIEM forwarding.
SC-7
centralized ingress/egress inspection, private endpoints for data services.
SC-12, SC-13, SC-28
KMS / Key Vault with CMKs, TLS 1.3 everywhere, at-rest encryption mandated by policy.
CP-9, CP-10
cross-account backups, DR runbooks tested at least annually.
CM-2, CM-3, CM-8
IaC as the authoritative configuration, drift detection, automated inventory.
IR-4, IR-5, IR-6
GuardDuty / Defender for Cloud / Sentinel integrated with the agency SOC.
Sample technical approach — 50-app portfolio migration
A federal agency wants to exit a leased data center within 24 months. Portfolio: 50 applications, mix of .NET / Java / LAMP / COBOL, ranging from static content sites to a mission case-management system.
Weeks 1-8: Mobilize + discover. Application Discovery Service agents on every VM; dependency graph built. Business criticality tier assigned per app; ATO status documented; data classification recorded.
Weeks 9-12: Decide. 7Rs decisions. 6 apps → retire (no longer used). 4 apps → retain (SaaS already). 18 apps → rehost via MGN. 14 apps → replatform (containerize or RDS). 6 apps → refactor (strangler-fig). 2 apps → repurchase (switch to SaaS equivalent).
Weeks 13-18: Land. FedRAMP High landing zone built. CI/CD factory for MGN cutovers. Shared services operational.
Weeks 19+: Migrate in waves of 8 apps, running 3 waves in parallel. Each wave: 6 weeks plan → 4 weeks build → 2 weeks cutover + validate. Rehost waves go first for velocity and confidence; replatform and refactor waves interleaved.
Month 24: final decommissioning. Data center terminated. Realized savings: TBD, reported monthly to the sponsor against the original business case.
Related capabilities, agencies, vehicles, insights
- Capabilities: Cloud Infrastructure, Cybersecurity & DevSecOps, Legacy Modernization, Data Engineering.
- Agencies: DoD, VA, USDA, DHS, HHS, Treasury.
- Vehicles: TMF, GSA MAS, SEWP, SBIR.
- Insights: The 7Rs in federal, Landing zone SSP inheritance, GovCloud vs Azure Government.
- Resources: FedRAMP landing zone reference, Migration wave-plan template.
- Case studies: federal health agency production ML (confirmed PP).