Migrate workloads from AWS or Azure to OCI — IAM translation, networking mapping, compute image import, and data migration.
Use when planning an AWS-to-OCI or Azure-to-OCI migration, translating cloud concepts, or importing custom images.
Trigger with "oraclecloud migration", "aws to oci", "azure to oci", "oci migration deep dive".
Migrate workloads from AWS or Azure to OCI — IAM translation, networking mapping, compute image import, and data migration.
Use when planning an AWS-to-OCI or Azure-to-OCI migration, translating cloud concepts, or importing custom images.
Trigger with "oraclecloud migration", "aws to oci", "azure to oci", "oci migration deep dive".
Migrating to OCI from AWS or Azure requires translating IAM concepts (roles to policies, accounts to compartments), networking (VPC to VCN, Security Groups to NSGs), and compute (AMI to custom image). OCI's migration tooling is underdocumented compared to AWS Migration Hub or Azure Migrate. This skill provides comprehensive concept mapping tables, custom image import procedures, network topology translation, IAM policy translation, and data migration patterns — everything needed for a controlled cloud migration.
Purpose: Translate AWS/Azure architecture into OCI equivalents and execute the migration using OCI CLI and Python SDK, with verification at each step.
AWS IAM roles use JSON policies attached to entities. OCI uses human-readable policy statements attached to compartments:
# AWS: Allow EC2 instances to read S3
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": "arn:aws:s3:::my-bucket/*"
}
# OCI equivalent:
allow dynamic-group app-instances to read objects in compartment prod where target.bucket.name='my-bucket'
Common IAM translations:
AWS Policy
OCI Policy Statement
AdministratorAccess
allow group admins to manage all-resources in tenancy
ReadOnlyAccess
allow group readers to inspect all-resources in tenancy
AmazonEC2FullAccess
allow group compute-admins to manage instances in compartment prod
AmazonS3ReadOnlyAccess
allow group readers to read objects in compartment prod
AmazonVPCFullAccess
allow group net-admins to manage virtual-network-family in compartment prod
# Create an OCI IAM policy
oci iam policy create \
--compartment-id "$COMPARTMENT_OCID" \
--name "app-compute-policy" \
--description "Allow app team to manage compute in prod" \
--statements '["allow group app-team to manage instances in compartment prod","allow group app-team to use volumes in compartment prod"]'
Step 5: Network Topology Translation
Translate an AWS VPC with public/private subnets into an OCI VCN:
After migration, review oraclecloud-reference-architecture to validate the OCI topology, then run oraclecloud-prod-checklist to ensure the migrated environment meets production standards.
