NGA-5114 · Migration Notes

Card	What it means
Final done	Original us-east-1 name live + data restored. Migration complete.
In progress	Still mid-flight — staging exists, SG not yet cut over, or data still syncing/draining.
Other	us-east-1-only buckets with no ap-southeast-1 source (orphan/native), that are in the bucket mapping.
Not in scope	SG-only test/infra buckets with no us-east-1 counterpart — intentionally excluded.
Not in bucket Mapping	Tracked buckets whose stem is absent from the Confluence "Bucket Mapping" table (matched by normalized stem).

Not in bucket Mapping — the 13 buckets

App buckets the Confluence plan is missing (real gaps — have staging, being migrated):

ngcom-global-dev-comorderas-commerce-return + perf
ngcom-global-perf-comregistrationas-registration-documents-temp
ngcom-global-dev-comidentityms-account-or-username-migration (plan only lists the perf hybris bucket)

Infra / non-app buckets (never part of the plan — done or out of band):

commyshopds-global-dev-myshop + perf
ngcom-amshop-perf-cdn
ngcom-global-dev-routing-config, ngcom-use1-global-dev-routing-config
ngcom-global-dev-shared-media + perf
ngcom-use1-global-dev-maintenance + perf

Confluence "Bucket Mapping" — naming problems found

Row	Issue
59	Typo in us-east-1 name: `ncom-…` — missing the `g`, should be `ngcom-…`
59,60 vs 61,62	Dev uses `id-ev-hist`, perf uses `id-event-hist` — inconsistent abbreviation
60 vs 62	Dev source says `-canonical`, perf source says `-can` — inconsistent suffix
59,60	Dev comidentitycs raw/can: neither source nor staging bucket exists live — looks stale

Active blockers

Item	Blocker
`nex-global-perf-eventhistory-eventstore`	BLOCKED Its bucket name + ARN are CloudFormation exports imported by the comidentitycs perf stacks. CloudFormation forbids renaming an in-use export. Needs the import temporarily removed, then re-added.
comidentitycs perf stack	HELD A redeploy would revert its ServiceAccount IAM role trust from us-east-1 OIDC back to ap-southeast-1 OIDC (breaks IRSA). Repo branch must be fixed first. This gates both eventstore and CAN.
`ngcom-global-perf-comidentitycs-identity-event-history-can`	HELD Same comidentitycs OIDC blocker.

Draining (data confirmed ignore) — lifecycle emptying SG

Bucket	State
`ngcom-global-perf-comorderes-order-return-events`	draining
`ngcom-global-perf-comorderes-order-return-latest-event`	draining
`ngcom-global-perf-comorderes-payment-events`	draining
`ngcom-global-perf-comidentitycs-identity-event-history-raw`	draining

All four have lifecycle rules: expire current (Day 1) + delete noncurrent versions (Day 1) + remove expired delete markers. Console "Empty bucket" runs in parallel. Versioned buckets need 2–3 daily cycles; tens of millions of objects drain gradually (~5–7 days with console help). After empty → delete SG → Phase C.

Pending deploy (user-run)

Item	Status
`nex-global-perf-eventhistory-athena-results`	READY Edit committed locally on `feature/NGA-5114-us-east-1` (eventstore pinned to `n-` so its export is untouched; athena returns to original name). Vetted via `cdk synth`. Deploy must run in a normal terminal — the sandbox node errors on `cdk deploy`. Then `scripts/restore/restore-eventhistory-athena-perf.sh`.

Key operational rules

Delete safety: never infer source object counts from staging/temp — measure SG directly (CloudWatch NumberOfObjects + live version list). Only delete when staging ≥ source and temp backup ≥ source.
PermanentRedirect timing: recreating the same global name in us-east-1 too soon after deleting it in ap-southeast-1 fails at the bucket-notification step (cache points to SG). Wait hours (up to ~24h). Region-suffix renames are exempt.
Stack coupling: deploying a stack touches all its buckets — strip the marker only for buckets whose SG name is actually freed; leave the rest on staging.