AWS Production-Grade Migration: Resource Cleanup (Part 5)
Overview
In this comprehensive guide, we’ll systematically clean up all AWS resources created during our migration project. Following the proper deletion order is critical to avoid dependency errors and ensure you stop incurring charges. This final phase completes our production-grade migration journey with cost optimization and resource management best practices.
Estimated Time: 30-40 minutes
Region: ap-south-1 (Mumbai)
Difficulty: Beginner
Why This Matters for Cloud Migration
Proper resource cleanup is essential for:
- Cost optimization - Preventing unexpected charges from forgotten resources
- Security best practices - Removing unnecessary access points and credentials
- Resource management - Learning proper AWS resource lifecycle management
- Production readiness - Understanding cleanup procedures for real-world scenarios
- Cost consciousness - Developing habits for cost-effective cloud operations
⚠️ Critical Warnings
- This is destructive and irreversible! Once deleted, resources cannot be recovered.
- Follow the exact order - Deleting resources out of order will fail due to dependencies.
- Verify you’re in the correct region - ap-south-1 (Mumbai)
- Take final backups if you need to keep any data
- Document everything before deletion for your portfolio/resume
- Check the “Success” status after each step before proceeding
Cost Impact
Following this guide will eliminate ALL ongoing charges from this project:
Current Daily Costs (if all resources running):
- Source EC2 (t2.micro): ~$0.28/day
- Source RDS (db.t3.micro): ~$0.41/day
- Target EC2 (migrated, t2.micro): ~$0.28/day
- Target RDS Multi-AZ (db.t3.micro): ~$0.82/day
- DMS Replication Instance (if running): ~$0.86/day
- Load Balancer (if created): ~$0.60/day
- NAT Gateway (if created): ~$1.08/day
- Total: $3-4/day or $90-120/month
After cleanup: $0/day ✅
Pre-Cleanup Checklist
Before starting deletion, complete these tasks:
Documentation
Backups (if needed)
Verification
Cleanup Order Overview
Phase 1: Stop Active Services (DMS, Replication)
↓
Phase 2: Delete Compute Resources (EC2, MGN)
↓
Phase 3: Delete Database Resources (RDS, DMS)
↓
Phase 4: Delete Network Resources (ALB, VPC Peering)
↓
Phase 5: Delete VPC Components (Subnets, IGW, SGs)
↓
Phase 6: Verify and Final Cleanup
Phase 1: Stop Active Services
Step 1.1: Delete DMS Resources
⚠️ Do this first to stop DMS charges immediately
Delete Migration Tasks
- Go to DMS Console → Database migration tasks
- If any tasks are running, select them and Actions → Stop
- Wait for status to change to “Stopped”
- Select each task:
migrate-legacy-to-production
- Actions → Delete
- Confirm deletion
- Wait for deletion to complete
Delete DMS Replication Instance
- Go to Replication instances
- Select
legacy-to-production-replication - Actions → Delete
- Confirm deletion
- Wait 5-10 minutes for deletion to complete
- ✅ Verify: Instance should disappear from list
💰 Cost Impact: Saves ~$26/month
Delete DMS Endpoints
- Go to Endpoints
- Select
legacy-db-source-endpoint - Actions → Delete
- Confirm deletion
- Repeat for
production-db-target-endpoint - ✅ Verify: Both endpoints deleted
Delete DMS Subnet Groups
- Go to Subnet groups
- Select
dms-target-subnet-group - Actions → Delete
- Confirm deletion
Step 1.2: Archive MGN Source Servers
- Go to Application Migration Service Console
- Go to Source servers
- Select your source server
- If status is “Cutover complete”, proceed
- Actions → Mark as archived
- Confirm archiving
- This removes the server from active view but keeps history
💰 Cost Impact: Stops MGN replication charges (if any were still running)
Phase 2: Delete Compute Resources
Step 2.1: Terminate EC2 Instances
Order matters: Terminate in this sequence:
Terminate Test Instances (if any)
- Go to EC2 Console → Instances
- Find instances with names like
mgn-test-* - Select them (checkbox)
- Instance state → Terminate instance
- Confirm by typing “terminate”
- Wait for state to change to “Terminated”
Terminate Migrated/Cutover Instance
- Find instance:
migrated-web-server (or mgn-cutover-*) - Select it
- Instance state → Terminate instance
- Confirm termination
- Wait for state to change to “Terminated”
💰 Cost Impact: Saves ~$8.50/month per instance
Terminate Bastion Host (if created)
- Find instance:
target-bastion-host - Select it
- Instance state → Terminate instance
- Confirm termination
Terminate Source Web Server
- Find instance:
on-prem-web-server - Select it
- Instance state → Terminate instance
- Confirm termination
- Wait for state to change to “Terminated”
⚠️ Wait 5 minutes before proceeding to ensure all instances are fully terminated.
✅ Verify: All instances show “Terminated” status
Step 2.2: Release Elastic IPs (if any)
- Go to EC2 → Elastic IPs
- For each Elastic IP not associated with an instance:
- Select it
- Actions → Release Elastic IP addresses
- Confirm release
💰 Cost Impact: Elastic IPs cost $0.005/hour when not attached (~$3.60/month)
Step 2.3: Delete EC2 Key Pairs (optional)
⚠️ Only do this if you’re completely done with the project
- Go to EC2 → Key Pairs
- Select
on-prem-web-key - Actions → Delete
- Confirm by typing the key pair name
- Also delete the .pem/.ppk file from your local computer
Step 2.4: Clean Up MGN Resources
- Go to Application Migration Service
- Go to Settings → Replication settings template
- If any custom templates exist, delete them (default is fine)
- The archived source server will remain in history but won’t incur charges
Phase 3: Delete Database Resources
Step 3.1: Create Final Snapshots (Optional)
If you want to keep the data for future reference:
Snapshot Production Database
- Go to RDS Console → Databases
- Select
production-db - Actions → Take snapshot
- Snapshot name:
production-db-final-snapshot-2025-10-17 - Click Take snapshot
- Wait for status to show “Available” (5-10 minutes)
Snapshot Source Database
- Select
legacy-db - Actions → Take snapshot
- Snapshot name:
legacy-db-final-snapshot-2025-10-17 - Click Take snapshot
💰 Cost Impact: Snapshots cost $0.095/GB-month (for ~20GB = ~$2/month)
To save costs, delete snapshots after a few days if not needed
Step 3.2: Delete RDS Databases
⚠️ This is irreversible! Data will be permanently lost.
Delete Production Database (Multi-AZ)
- Go to RDS Console → Databases
- Select
production-db - Actions → Delete
- A dialog appears with options:
- Create final snapshot:
- Choose No if you created one in Step 3.1
- Choose Yes if you skipped Step 3.1
- Retain automated backups: Uncheck (they cost money)
- Acknowledgment: Type
delete me in the text box
- Click Delete
- Wait 10-15 minutes for Multi-AZ deletion (takes longer than single-AZ)
💰 Cost Impact: Saves ~$25/month
Delete Source Database
- Select
legacy-db - Actions → Delete
- Configure deletion:
- Create final snapshot: No (or Yes if you want)
- Retain automated backups: Uncheck
- Type
delete me
- Click Delete
- Wait 5-10 minutes for deletion
💰 Cost Impact: Saves ~$12/month
✅ Verify: Both databases should disappear from the list
Step 3.3: Delete RDS Subnet Groups
- Go to RDS Console → Subnet groups
- Select
target-production-db-subnet-group - Actions → Delete
- Confirm deletion
- Repeat for
on-prem-db-subnet-group
Step 3.4: Delete Automated Backups (if any remain)
- Go to RDS Console → Automated backups
- Select any backups listed
- Actions → Delete
- Confirm deletion
💰 Cost Impact: Backups cost $0.095/GB-month
Step 3.5: Delete Manual Snapshots (if you don’t need them)
⚠️ Only do this if you’re sure you don’t need the data
- Go to RDS Console → Snapshots
- Select each snapshot you created
- Actions → Delete snapshot
- Confirm deletion
Phase 4: Delete Network Resources
Step 4.1: Delete Application Load Balancer (if created)
- Go to EC2 Console → Load Balancers
- Select
migrated-app-alb (if you created one) - Actions → Delete load balancer
- Type
confirm to confirm deletion - Click Delete
- Wait 2-3 minutes for deletion
💰 Cost Impact: Saves ~$18/month
Step 4.2: Delete Target Groups
- Go to EC2 → Target Groups
- Select
migrated-web-tg (if you created one) - Actions → Delete
- Confirm deletion
Step 4.3: Delete NAT Gateways (if created)
⚠️ NAT Gateways are expensive (~$32/month) - make sure to delete!
- Go to VPC Console → NAT Gateways
- Filter by VPC:
aws-target-vpc - Select any NAT Gateways
- Actions → Delete NAT gateway
- Type
delete to confirm - Click Delete
- Wait 5 minutes for deletion
- Repeat for
on-prem-vpc if you created any there
💰 Cost Impact: Saves ~$32/month per NAT Gateway
Release NAT Gateway Elastic IPs
After NAT Gateway deletion:
- Go to EC2 → Elastic IPs
- Find any unassociated Elastic IPs (were used by NAT Gateways)
- Select each one
- Actions → Release Elastic IP addresses
- Confirm release
Step 4.4: Delete VPC Peering Connection
- Go to VPC Console → Peering connections
- Select
on-prem-to-target-peering - Actions → Delete peering connection
- Confirm deletion
- ✅ Verify: Status changes to “Deleted”
Phase 5: Delete VPC Components
⚠️ Order is critical in this phase!
Step 5.1: Delete Target VPC (aws-target-vpc)
We’ll delete the target VPC first since it has more components.
Delete Network Interfaces (if any remain)
- Go to EC2 Console → Network Interfaces
- Filter by VPC:
aws-target-vpc - For each interface with status “Available” (not “In-use”):
- Select it
- Actions → Delete
- Confirm deletion
⚠️ If deletion fails with “in use” error:
- Wait 5 minutes and retry (terminated instances take time to release interfaces)
- Check if any Lambda functions or other services are using the VPC
Delete Security Groups (Target VPC)
⚠️ Cannot delete the default security group
- Go to VPC Console → Security Groups
- Filter by VPC:
aws-target-vpc - Select these security groups (in order):
target-bastion-sg (if exists)target-dms-sgtarget-web-sgtarget-db-sg
- For each one:
- Actions → Delete security groups
- Confirm deletion
If deletion fails: Security groups reference each other
- Go to each SG’s Inbound rules
- Remove any rules that reference other security groups
- Then retry deletion
Delete Subnets (Target VPC)
- Go to VPC Console → Subnets
- Filter by VPC:
aws-target-vpc - Select ALL subnets:
- Public subnets (2)
- Private app subnets (2)
- Private DB subnets (2)
- Actions → Delete subnet
- Confirm deletion
If deletion fails:
- Check for remaining network interfaces
- Check for Lambda functions in the VPC
- Check for RDS instances (should be deleted in Phase 3)
Delete Route Tables (Target VPC)
- Go to VPC Console → Route Tables
- Filter by VPC:
aws-target-vpc - Select all route tables EXCEPT the default (main) route table
- Actions → Delete route table
- Confirm deletion
Delete Internet Gateway (Target VPC)
- Go to VPC Console → Internet Gateways
- Find the IGW attached to
aws-target-vpc - Select it
- Actions → Detach from VPC
- Confirm detachment
- Wait for status to change to “Detached”
- Select it again
- Actions → Delete internet gateway
- Confirm deletion
Delete VPC (Target VPC)
- Go to VPC Console → Your VPCs
- Select
aws-target-vpc - Actions → Delete VPC
- Type
delete to confirm - Click Delete
- ✅ Verify: VPC is deleted
💰 Cost Impact: VPCs themselves are free, but this ensures no hidden resources remain
Step 5.2: Delete Source VPC (on-prem-vpc)
Repeat the same process for the source VPC:
Delete Network Interfaces (Source VPC)
- Go to EC2 → Network Interfaces
- Filter by VPC:
on-prem-vpc - Delete all interfaces with status “Available”
Delete Security Groups (Source VPC)
- Filter by VPC:
on-prem-vpc - Delete in order:
on-prem-web-sgon-prem-db-sg
Delete Subnets (Source VPC)
- Filter by VPC:
on-prem-vpc - Select all subnets:
on-prem-public-subnet-1aon-prem-private-subnet-1a
- Actions → Delete subnet
Delete Route Tables (Source VPC)
- Filter by VPC:
on-prem-vpc - Delete non-default route tables:
on-prem-public-rton-prem-private-rt (if you renamed it)
Delete Internet Gateway (Source VPC)
- Find IGW attached to
on-prem-vpc: on-prem-igw - Actions → Detach from VPC
- Wait for detachment
- Actions → Delete internet gateway
Delete VPC (Source VPC)
- Select
on-prem-vpc - Actions → Delete VPC
- Type
delete to confirm - Click Delete
- ✅ Verify: VPC is deleted
Phase 6: Clean Up Supporting Services
Step 6.1: Delete CloudWatch Log Groups
- Go to CloudWatch Console → Logs → Log groups
- Delete these log groups (if they exist):
/aws/dms/tasks/migrate-legacy-to-production/aws/lambda/* (if any were created)/aws/rds/instance/legacy-db/*/aws/rds/instance/production-db/*
- For each log group:
- Select it
- Actions → Delete log group(s)
- Confirm deletion
💰 Cost Impact: Log storage costs $0.50/GB-month
Step 6.2: Delete CloudWatch Alarms
- Go to CloudWatch → Alarms → All alarms
- Select any alarms you created for this project
- Actions → Delete
- Confirm deletion
Step 6.3: Delete IAM Roles and Users (Optional)
⚠️ Only delete if they were created specifically for this project
Delete DMS IAM Roles
- Go to IAM Console → Roles
- Search for and delete:
dms-vpc-role (if it exists and not used by other DMS tasks)dms-cloudwatch-logs-role (if exists)
⚠️ DO NOT delete these default AWS service roles:
AWSApplicationMigrationReplicationServerRoleAWSApplicationMigrationConversionServerRole- These are used by MGN service and may be needed if you use MGN again
Delete MGN IAM User
- Go to IAM Console → Users
- Select
mgn-replication-user - Delete user
- Confirm by typing the username
Step 6.4: Clean Up S3 Buckets (if any)
Check if MGN or DMS created any S3 buckets:
- Go to S3 Console
- Look for buckets with names like:
aws-application-migration-service-*dms-*
- If you find any:
- Click on the bucket
- Empty the bucket first (select all objects and delete)
- Then Delete the bucket
Step 6.5: Delete Systems Manager Parameters (if any)
- Go to Systems Manager → Parameter Store
- If you stored any database credentials or configuration
- Select each parameter
- Actions → Delete
Phase 7: Final Verification
Step 7.1: Verify All Resources Deleted
Go through each service and verify nothing remains:
EC2 Resources
VPC Resources
RDS Resources
DMS Resources
MGN Resources
CloudWatch
IAM
Step 7.2: Check AWS Cost Explorer
- Go to Cost Explorer (Services → AWS Cost Management → Cost Explorer)
- View Last 7 Days costs
- Click Service to filter
- Verify these services show declining or $0 costs:
- Amazon EC2
- Amazon RDS
- AWS Database Migration Service
- Amazon VPC (should always be $0)
- RDS Data Transfer
- Set up a Budget or Alert to notify you if costs exceed $1/day
Step 7.3: Check AWS Billing Dashboard
- Go to Billing Dashboard
- Click Bills
- Select current month
- Expand each service and verify:
- No unexpected charges
- No running resources you forgot about
- Check Free Tier usage to see what resources you used
Step 7.4: Final Resource Inventory
Run these AWS CLI commands to verify (if you have AWS CLI installed):
# Check EC2 instances
aws ec2 describe-instances --region ap-south-1 --query 'Reservations[].Instances[?State.Name!=`terminated`].[InstanceId,State.Name,Tags[?Key==`Name`].Value|[0]]' --output table
# Check RDS instances
aws rds describe-db-instances --region ap-south-1 --query 'DBInstances[].DBInstanceIdentifier' --output table
# Check VPCs (should only see default)
aws ec2 describe-vpcs --region ap-south-1 --query 'Vpcs[?IsDefault==`false`].[VpcId,Tags[?Key==`Name`].Value|[0]]' --output table
# Check NAT Gateways (should be empty)
aws ec2 describe-nat-gateways --region ap-south-1 --query 'NatGateways[?State!=`deleted`].[NatGatewayId,State]' --output table
# Check DMS replication instances (should be empty)
aws dms describe-replication-instances --region ap-south-1 --query 'ReplicationInstances[].ReplicationInstanceIdentifier' --output table
Troubleshooting Deletion Issues
Issue: “DependencyViolation” when deleting subnet
Solution:
- Network interfaces still exist in the subnet
- Go to EC2 → Network Interfaces
- Filter by subnet ID
- Delete all available network interfaces
- Wait 5 minutes and retry subnet deletion
Issue: Cannot delete security group
Solution:
- Check Inbound rules for references to other security groups
- Remove those rules first
- Another resource (EC2, RDS, Lambda) might still be using it
- Check all services for any remaining resources in the VPC
Issue: Cannot delete VPC - “has dependencies”
Solution:
- Not all resources deleted yet
- Systematically go through:
- Instances (must be terminated, not just stopped)
- RDS databases
- Network interfaces
- NAT Gateways
- Internet Gateway (must be detached)
- VPC endpoints (if any)
- Lambda functions in VPC
Issue: RDS deletion takes forever
Solution:
- Multi-AZ databases take 15-20 minutes to delete
- Final snapshot creation adds 5-10 minutes
- Check RDS Console → Events for progress
- If stuck for >30 minutes, contact AWS Support
Issue: Costs still appearing after cleanup
Solution:
- Some costs are billed retrospectively (show up 1-2 days later)
- EBS snapshots cost money even after instances deleted
- Elastic IPs cost money if not released
- Check Cost Explorer → Service for detailed breakdown
- Delete any remaining snapshots if not needed
Issue: Cannot find a resource to delete
Solution:
- Make sure you’re in the correct region (ap-south-1)
- Some resources like EC2 snapshots might be in different regions
- Use AWS Resource Groups & Tag Editor to find all tagged resources
- Check CloudFormation stacks (if any were created)
Post-Cleanup Actions
Step 1: Document Your Learning
Create a summary document with:
- Project Overview: What you built and migrated
- Services Used: MGN, DMS, RDS Multi-AZ, VPC Peering, EC2
- Challenges Faced: Any issues you encountered and how you solved them
- Key Learnings: What you learned about AWS migration services
- Time and Cost: Total time spent and approximate costs incurred
Step 2: Update Your Portfolio
Add this project to your resume/portfolio:
- Title: “AWS Cloud Migration using MGN and DMS”
- Description: “Performed lift-and-shift migration of web application and database from on-premises to AWS using Application Migration Service and Database Migration Service. Implemented Multi-AZ RDS for high availability and VPC peering for secure connectivity.”
- Technologies: AWS MGN, DMS, RDS PostgreSQL, Multi-AZ, VPC, EC2, CloudWatch, Migration Hub
- Outcome: Successfully migrated application with zero data loss and minimal downtime
Step 3: Get AWS Certification (Recommended)
This project gives you hands-on experience for these certifications:
- AWS Certified Solutions Architect - Associate
- AWS Certified Database - Specialty
- AWS Certified Migration - Specialty
Step 4: Practice Again (Optional)
Consider re-doing this project with variations:
- Migrate to containers (ECS/EKS instead of EC2)
- Use AWS Systems Manager Session Manager for access
- Implement blue-green deployment strategy
- Add CloudFront CDN and Route 53
- Use AWS Backup for centralized backup management
Cost Summary
Total Project Cost Estimate
Assuming you ran the project for 3 days:
| Resource | Daily Cost | 3-Day Total |
|---|
| Source EC2 (t2.micro) | $0.28 | $0.84 |
| Source RDS (db.t3.micro) | $0.41 | $1.23 |
| Target EC2 (t2.micro) | $0.28 | $0.84 |
| Target RDS Multi-AZ (db.t3.micro) | $0.82 | $2.46 |
| DMS Replication (1 day) | $0.86 | $0.86 |
| MGN (Free tier - 90 days) | $0.00 | $0.00 |
| Data Transfer (minimal) | $0.10 | $0.30 |
| Estimated Total | ~$2.75/day | ~$6.50 |
Final Cost: $5-10 for the entire project (very affordable for hands-on AWS experience!)
Final Checklist
Before closing this cleanup:
Emergency: “I’m Being Charged and Don’t Know Why”
If you’re seeing unexpected charges after cleanup:
- Go to Billing Dashboard → Bill Details
- Identify the service causing charges
- Common culprits:
- RDS Snapshots - Go to RDS Console → Snapshots → Delete all
- Elastic IPs - Go to EC2 → Elastic IPs → Release all unattached IPs
- NAT Gateways - Go to VPC → NAT Gateways → Delete all
- EBS Volumes - Go to EC2 → Volumes → Delete all “Available” volumes
- Load Balancers - Go to EC2 → Load Balancers → Delete all
- DMS Replication Instance - Go to DMS → Replication instances → Delete all
If Still Unsure:
- Go to AWS Support Center
- Create a Billing Support Case (free for all accounts)
- Explain: “I completed a learning project and cleaned up resources, but I’m seeing unexpected charges for [SERVICE]. Can you help identify what resources are still running?”
- AWS support typically responds within 24 hours
Nuclear Option: Delete Everything in the Region
⚠️ Last resort only! This will delete ALL resources in ap-south-1
# If you have AWS CLI and want to force-delete everything:
# DO NOT run this if you have production resources in this region!
# List all resources
aws resourcegroupstaggingapi get-resources --region ap-south-1
# Use AWS Nuke tool (third-party) to delete everything
# https://github.com/rebuy-de/aws-nuke
Conclusion
✅ Cleanup Complete!
You have successfully:
- Removed all migration project resources
- Stopped all ongoing charges
- Verified deletion of all components
- Documented your learning experience
- Prepared for AWS certifications
Thank you for being cost-conscious and following best practices for AWS resource management!
Additional Resources
AWS Documentation
Cost Management
Conclusion
In this comprehensive guide, we’ve successfully completed the final phase of our AWS migration journey by systematically cleaning up all resources. This hands-on approach demonstrates essential skills for cost optimization and resource management in cloud environments.
What we’ve accomplished:
- ✅ Systematic Resource Cleanup: Safely deleted all migration resources in the correct order
- ✅ Cost Optimization: Eliminated all ongoing charges from the migration project
- ✅ Security Best Practices: Removed unnecessary IAM users and access credentials
- ✅ Resource Management: Learned proper AWS resource lifecycle management
- ✅ Cost Monitoring: Set up billing alerts and cost tracking for future projects
- ✅ Documentation: Created comprehensive cleanup procedures for production use
Key Learning Outcomes:
- Understanding of AWS resource dependencies and deletion order
- Hands-on experience with cost optimization and resource management
- Security best practices for credential and access management
- Production-ready cleanup procedures for real-world scenarios
- Cost consciousness and billing management skills
This completes our comprehensive 5-part AWS migration series! You now have end-to-end experience with production-grade cloud migration, from initial setup through final cleanup.
This is Part 5 of a comprehensive AWS migration series. The complete migration journey is now finished! You’ve successfully learned production-grade AWS migration from start to finish.
If you encounter any issues during cleanup, refer to the Troubleshooting section or contact AWS Support.