Case Study
AWS Cross-Region Migration Case Study: How We Moved Moneyflex from UAE to Frankfurt with Zero Data Loss
An AWS cross-region migration under real time pressure: full production infrastructure, a lost encryption key, and an 8-day deadline.
The Challenge: Migrating Production AWS Infrastructure Under Regional Instability
A plan. Then reality.
Moneyflex needed a complete AWS cross-region migration, and they needed it done in eight days. Their production environment was running in a region facing growing instability, and waiting was no longer an option for a fintech platform that can't afford downtime.
The original plan was to move to Bahrain (me-south-1) to stay close to Middle East users and minimize latency. But after a closer technical review, the team pivoted to Frankfurt (eu-central-1) instead, trading a small amount of regional latency for a more mature service footprint, stronger redundancy, and broader compliance coverage. That decision shaped everything that followed.
Facing a similar migration challenge?
Talk to our teamScope of the AWS Migration: Services Migrated from UAE to Frankfurt
The migration touched nearly every layer of Moneyflex's production stack: compute, storage, database, networking, and security.
EC2 virtual machines running core application services
Application Load Balancer and routing configuration
S3 buckets holding application and user data
Production RDS databases, including the encrypted instance
IAM policies and role mappings rebuilt in the new account region
Auto Scaling Groups reconfigured for the new environment
WAF rules re-applied to maintain the existing security posture
Migration Strategy by AWS Service (EC2, RDS, S3, IAM, WAF)
Every service had a different migration path, depending on how tightly it was coupled to region-specific resources.
| Component | Approach | Why |
|---|---|---|
| EC2 instances | AMI copy across regions, then relaunch | Preserves exact instance configuration without rebuilding from scratch |
| Load Balancer | Rebuilt fresh in Frankfurt | ALBs are region-bound and can't be copied directly |
| S3 buckets | Cross-region replication, then cutover | Keeps data available throughout the transfer window |
| RDS (standard) | Snapshot copy across regions | Standard AWS-supported path for unencrypted/standard instances |
| RDS (encrypted, no key) | Manual mysqldump/pg_dump export | Snapshot copy isn't possible without the original KMS key |
| IAM | Policies and roles recreated manually | IAM is account-wide but role bindings needed re-validation per service |
| WAF | Rule sets re-applied post-migration | Ensures the new environment isn't exposed during cutover |
The Critical Issue: Recovering from a Lost KMS Encryption Key
Midway through the migration, the team hit the moment that defined the entire project: the customer-managed KMS key used to encrypt the production RDS instance could not be located.
This single issue threatened the entire 8-day timeline. A standard snapshot migration was no longer an option, and the team had to find another way to move a live, encrypted production database without losing a single record.
How We Migrated RDS Without Snapshot Copy Access
- 1 Connected directly to the live, already-decrypted RDS instance, bypassing the need for the missing key entirely.
- 2 Ran a full logical export using mysqldump/pg_dump instead of a storage-level snapshot.
- 3 Validated the export against row counts and checksums to confirm zero data loss before proceeding.
- 4 Provisioned a fresh, newly-encrypted RDS instance in Frankfurt under a new, properly-documented KMS key.
- 5 Imported the data, re-ran validation, and cut application traffic over only after a clean match.
Migration Timeline: 8-Day Execution Plan
All work was executed in a tight daily window (1:00–3:00 PM KSA) to avoid disrupting Moneyflex's live traffic patterns.
Environment audit & Frankfurt account setup
Baseline review of the existing UAE infrastructure and provisioning of the target environment.
EC2 AMI copy & relaunch
Application servers copied and brought up in the new region.
S3 replication started
Cross-region replication initiated to keep storage in sync throughout the migration window.
IAM & security baseline rebuilt
Roles, policies, and access bindings recreated and validated in Frankfurt.
RDS migration attempt & KMS key issue discovered
Standard snapshot copy failed, and the encryption key recovery problem surfaced here.
Manual RDS export & re-encryption
Logical export, validation, and import into a newly-encrypted RDS instance.
Go-live cutoverCritical
Traffic switched from UAE to Frankfurt after final validation checks passed.
Post-migration monitoring & sign-off
24-hour monitoring window confirmed stability before formal project closeout.
Results: Migration Outcomes and Key Metrics
Despite an unplanned, project-threatening encryption key issue, the migration stayed on schedule and delivered a clean cutover with zero data loss.
"Sherdil Cloud kept us informed at every step, even when things didn't go to plan. Losing that encryption key could have set us back weeks. Instead, we were live in Frankfurt on schedule, with zero data loss."
Interested in cloud migration services for your own infrastructure, or want to understand how to choose the right AWS region before you move? Our team can walk you through the same process we used here.
Frequently Asked Questions
How long does an AWS cross-region migration typically take?
A production AWS cross-region migration usually takes anywhere from a few days to several weeks, depending on infrastructure complexity. Moneyflex's full-stack migration from UAE to Frankfurt was completed in 8 days, including unplanned recovery work after a lost encryption key.
What happens if you lose the KMS key for an encrypted RDS instance?
If the customer-managed KMS key for an encrypted RDS instance is lost, AWS cannot decrypt the storage, and standard snapshot-based migration becomes impossible. The data isn't gone, but it's inaccessible through normal recovery paths. Teams typically fall back on logical exports like mysqldump or pg_dump from a live, already-decrypted connection.
Can RDS snapshots be copied across AWS regions?
Yes, RDS snapshots can normally be copied across regions, but only if the snapshot is unencrypted or its KMS key is available in the destination region. When the original key is lost, cross-region snapshot copy is blocked entirely, forcing a manual data export and reimport instead.
What is the difference between migrating to Bahrain (me-south-1) vs Frankfurt (eu-central-1)?
Bahrain (me-south-1) keeps infrastructure closer to Middle East users with lower regional latency, while Frankfurt (eu-central-1) offers a more mature AWS service footprint, broader compliance certifications, and stronger redundancy. Moneyflex moved to Frankfurt for the added infrastructure maturity and stability after regional instability affected their original region plan.
Facing your own AWS cross-region migration?
From planning to cutover, we handle the infrastructure so you don't have to gamble on downtime.