Selling my ecommerce business and the buyer wants all AWS infrastructure moved to their account before final payment. What steps protect me as the seller? I'm worried about handing over root access and then getting ghosted. We're talking EC2, RDS, S3 buckets with customer data, the whole stack. Attorney is involved but I want practical advice from people who've done this.
Cloud Transfer
What steps protect sellers when transferring cloud server infrastructure?
Never transfer root creds until funds are verified. Use an escrow service that explicitly covers digital assets. And get a written migration plan signed before you touch anything.
I've done two of these. The cleanest approach: create a temporary IAM user with limited permissions for the the buyer's migration team. They can pull what they need, but you keep root. Only hand over root AFTER closing.
What does your purchase agreement say about the data? If customer PII is in those S3 buckets, you might be on the hook for a breach during the transition period. Make sure liability is clearly allocated by timestamp.
Escrow. Escrow. Escrow. I don't care if the bwuyer seems nice and has a LinkedIn with 500 connections.
One more thing — snapshot everything before the migration starts. If the buyer's team bungles the transfer, you want a restore point. AWS charges for snapshots but it's cheaper than a lawsuit.
Honestly the technical part is easy. The hard part is your attorney and their attorney agreeing on what 'transfer complete' means. Nail that down or you'll be stuck in limbo for weeks.
Also, change your personal recovery email and phone off the AWS account before any transition begins. You'd be surprised how many people forget their root account is tied to their personal Gmail.
SoggyWaffle must have been burned before. But yeah, escrow is non-negotiable for anything over five figures.
Curious — is the buyer taking over the AWS account itsef or migrating resources to a brand new account? Those are very different risk profiles. Account handover means they see your billing history and every service you ever spun up, including that forgotten test instance from 2019.
This. Audit what's actually running. I found a crypto miner on a client's account once that they swore 'just appeared.' Turns out an old contractor left it. You don't want that becoming the buyer's problem and then your problem.
peppermintCaboose asks the right question. If it's account handover, you're basically selling the house and leaving the keys under the mat. If it's resource migration, you have way more leverage.
Whatever you do, don't do what I did on my first sale: I 'helpfully' started the migration myself without a signed plan. Buyer backed out and I'd already moved half the infra. Took three weeks to untangle. Don't be me.
Also make sure the escrow release is tied to a defined acceptance test. 'Buyer confirms migration works' is not a test. 'All production endpoints return 200 and database row counts match' is a test.
All good stuff. One extra: keep your own read-only access to the account for 30 days post-close as a condition of the deal. Just in case they 'discover' a problem and try to claw back money.