How to move from AWS managed services to a VPS

Is it worth moving?

Managed services handle patching, backups and scaling for you and charge for it. If your load is steady and predictable, a VPS can do the same job for much less money. In return, those responsibilities become yours, and one server is a single point of failure.

You don't have to move everything. You can keep using AWS-specific services such as translation or speech-to-text and move only the app and the database.

1. Take inventory

• Which AWS services are in use, and what exactly does each one do?
• What are the real traffic, CPU, memory and disk numbers?
• Where does each piece of data live, and how big is it?
• Which services connect to each other, and through which addresses?

2. Build and harden the server

Don't work as root. Create a normal user, allow SSH by key only, open only the ports you need in the firewall, and turn on automatic security updates.

ufw default deny incoming
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

Running the app with Docker Compose makes the environment easy to rebuild. A reverse proxy such as Caddy gives you automatic HTTPS.

example.com {
  reverse_proxy app:3000
}

3. Move and back up the database

Export the database, import it on the new server, and test the app against it first. For MySQL, use --single-transaction to get a consistent dump. A backup is not enough on its own: prove it by restoring it.

mysqldump --single-transaction --routines -u USER -p DBNAME > backup.sql

Send the nightly backup to separate storage off the server. A backup that sits on the server's own disk disappears with the server.

4. Cut over

1. A few days before, lower the TTL on your DNS records.
2. Announce a short maintenance window and stop writes on the old app.
3. Take the final database dump, load it on the new server and verify it.
4. Point DNS at the new server.
5. Keep the old environment for about a week so you can roll back if something goes wrong.

5. Watch it afterwards

Set up an uptime check, disk and memory alerts, and regular log review. On a managed service AWS did this for you. Now it is your job.