# Cloud reversibility scorecard — AWS

Use this before signing a multi-year AWS commitment (EDP/PPA) or fielding a
procurement "exit / reversibility" question. Score each workload, not the whole
estate — reversibility is per-workload.

Score each row **0** (locked), **1** (portable with effort), **2** (portable).
Sum per workload. **≥16** = genuinely reversible; **9–15** = reversible with a
funded project; **≤8** = effectively locked — price the lock-in into the contract.

| Dimension                  | What "2" looks like                                                                                                                                                                                                      | Score |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- |
| **Compute portability**    | Runs in OCI containers (ECS/EKS/Fargate) or plain VMs; no Lambda-only business logic                                                                                                                                     |       |
| **Data store portability** | Postgres/MySQL/Redis-compatible (RDS/Aurora-MySQL/Valkey) vs DynamoDB/Timestream/Neptune proprietary APIs                                                                                                                |       |
| **Object storage**         | S3 API used through an abstraction; no S3-only features (Object Lambda, S3 Select) in the hot path                                                                                                                       |       |
| **IaC portability**        | Terraform/OpenTofu modules; not 100% CloudFormation/CDK-only                                                                                                                                                             |       |
| **Identity**               | App auth not bound to Cognito-only flows; SSO via OIDC/SAML to an external IdP                                                                                                                                           |       |
| **Messaging/events**       | Kafka (MSK) or AMQP vs EventBridge/SQS-only choreography                                                                                                                                                                 |       |
| **Observability**          | OpenTelemetry export vs CloudWatch-only instrumentation                                                                                                                                                                  |       |
| **AI/inference**           | Model calls behind a gateway/abstraction vs Bedrock-only SDK calls in app code                                                                                                                                           |       |
| **Egress posture**         | Data volume + AWS free-DTO-on-exit request path known (Support credit; typically **90 days** to complete once approved; EU Data Act Addendum path for in-scope EU switches); CloudFront/DX/Snow DTO often **not** waived |       |
| **Contract**               | Exit assistance, data-return format, and notice period written into the MSA                                                                                                                                              |       |

## How to read the score

- **≥16 — Reversible.** You can credibly threaten to leave, which is the point.
  Keep one annual restore-elsewhere drill so the claim stays true.
- **9–15 — Reversible with a project.** Document the project cost and time. That
  number _is_ your switching cost — negotiate the commit discount against it.
- **≤8 — Locked.** Fine, if chosen deliberately for the managed-service leverage.
  Not fine if discovered during an outage or a price change. Re-price the risk.

## Notes

- Reversibility is **insurance**, not a migration plan. The goal is a defensible
  position in procurement and a real fallback — not multi-cloud by default.
- The EU Data Act (Reg. 2023/2854) phases switching/egress charges to **zero by
  12 Jan 2027** and mandates a **30-day** porting window for EU customers. That
  shifts cost-of-leaving from "egress bill" to "engineering re-platform time" —
  which is exactly what this scorecard measures.
- AWS already waives data-transfer-out-to-internet charges for customers leaving
  AWS (request credits via AWS Support). Egress is rarely the binding cost.