CAD Business-Critical Application Migration to AWS

As a Cloud Engineer at NXP Semiconductors, I worked on migrating business-critical applications from on-premises infrastructure to AWS as part of a large-scale program to decommission five data centers, modernize operating systems, and introduce stricter network security boundaries.

One of my most challenging projects involved migrating a mission-critical product specification validation platform used daily by hundreds to thousands of semiconductor engineers.

This PHP-based application connects Cadence simulation results with product specifications, automatically validating requirements when design simulations pass. Any significant outage could disrupt design activities across the organization.

I was responsible for technical architecture analysis, infrastructure migration, cloud deployment, database replication, and implementing the connectivity required between isolated security environments.

Given the application's criticality and the migration deadlines, we adopted a rehosting strategy with live database replication, enabling a controlled transition from on-premises infrastructure to AWS without service interruption.

Project Context - Major Cloud migration to AWS

NXP was undergoing a major infrastructure transformation, replacing five on-premises data centers with AWS environments while upgrading applications from Red Hat Enterprise Linux 7 to RHEL 8. The migration also introduced a new security architecture designed to isolate semiconductor design environments from the rest of the corporate infrastructure.

One of the applications assigned to me was particularly sensitive. It allows engineers to validate product specifications using simulation results generated by Cadence. The platform connects technical design activities with product requirements defined by engineering and business stakeholders. The application had two generations, Gen 1 and Gen 2, both still hosting active projects despite their different architectures and maturity levels.

Planning the application migration

Before starting the migration, I performed a technical assessment of the application and its dependencies. My work included:

• Mapping application components, servers, databases, and Redis dependencies.
• Identifying network connectivity requirements and integrations with other internal applications.
• Analyzing the dependencies between both application generations and their environments.
• Documenting the existing architecture and designing the target AWS architecture.
• Identifying the appropriate AWS security zones for each component.

I consolidated this information into a Technical Architecture Document, which became the reference for infrastructure deployment and migration planning.

Designing Secure Connectivity Across Network Zones

One of the most challenging aspects was adapting the application to NXP's new network segmentation model. The platform needed to connect two environments with very different security requirements:

• Secure Design Environment: Where semiconductor engineers execute Cadence simulations and generate technical results.
• Corporate and Business Environment: Where product specifications are managed and reviewed by engineering managers and business stakeholders.

The application needed to exchange information between these environments without compromising the isolation of sensitive design infrastructure. I worked closely with network and security architects to define and implement the required connectivity. We introduced a controlled communication path using a proxy combined with Data Loss Prevention (DLP) technology.

This architecture allowed legitimate simulation results to pass between environments while inspecting and filtering traffic to prevent unauthorized data transfers, including potential extraction of sensitive design IP (Intellectual Properties, e.g. the CAD design files).

Rehosting the Application on AWS

Because of strict data center closure deadlines and the additional complexity of upgrading from RHEL 7 to RHEL 8, we decided to prioritize migration reliability over architectural modernization. Rather than introducing new AWS-native services or redesigning the application, we adopted a rehosting approach. I reproduced the existing application infrastructure on AWS, including:

• Web servers (EC2): Hosting the internally developed PHP application.
• Database servers (EC2): Preserving the application's existing data architecture.
• Redis servers (EC2): Supporting the application's caching and runtime dependencies.
• System configuration: Adapting the environment to RHEL 8.
• Network connectivity (VPC): Integrating the application into the new security zones and infrastructure,
• Filesystem Storages (FSx) & Data Transfer (Datasync): Doing a full copy then incremental the day of the migration

The objective was to preserve application behavior while changing the underlying infrastructure and operating system. This approach helped limit application-level changes, which was especially important given the coexistence of Gen 1 and Gen 2.

Implementing Live Database Replication and Zero-Downtime Cutover

The most critical requirement was maintaining application availability throughout the migration. Because the platform was used continuously by engineering teams around the world, a prolonged service interruption was not acceptable.

To address this, I implemented a database replication architecture spanning the existing on-premises environment and the new AWS infrastructure. This allowed the cloud databases to remain synchronized with production data while the original application continued operating.

The migration strategy involved:

• Deploying the target application infrastructure on AWS.
• Establishing database replication between on-premises and cloud environments.
• Maintaining data synchronization while preparing the cloud environment.
• Verifying application connectivity and dependencies in the new infrastructure.
• Preparing the production cutover from the existing data center to AWS.

By keeping production data replicated during the transition, we were able to perform the migration without interrupting the service used by CAD engineers. This was particularly important for an application directly involved in validating semiconductor product specifications.

• Planning and managing a complete technical cloud migration in AWS,
• Creating a complete PHP application infrastructure in AWS (EC2, FSx, VPC),
• Performing data migration using AWS Datasync, and MySQL Replicas,
• Defining connectivity requirements, coordinating firewall and proxy team to put in place a secure connectivity rule

• Migrated a business-critical engineering application to AWS: Rehosted the application infrastructure, including PHP web servers, databases, and Redis services, while preserving existing application behavior.
• Enabled a zero-downtime migration: Implemented live database replication between on-premises and AWS environments, allowing production traffic to transition without disrupting engineering activities.
• Modernized the operating environment: Migrated application infrastructure from RHEL 7 to RHEL 8 as part of the broader cloud transformation.
• Implemented secure cross-zone communication: Worked with network and security architects to establish proxy-based connectivity with DLP controls between isolated engineering and corporate environments.