ElastiCache Valkey 跨账号跨 Region 停机迁移 Hands-On

stop Account A writers
-> create final snapshot
-> export RDB to Account A S3
-> copy RDB to Account B / target Region S3
-> create B2 from RDB
-> validate
-> switch application

SOURCE_PROFILE=account-a
SOURCE_REGION=ap-east-1
SOURCE_REPLICATION_GROUP=A1
SOURCE_BUCKET=ACCOUNT-A-SOURCE-REGION-BUCKET

DESTINATION_PROFILE=account-b
DESTINATION_REGION=ap-southeast-1
DESTINATION_REPLICATION_GROUP=B2
DESTINATION_BUCKET=ACCOUNT-B-DESTINATION-REGION-BUCKET

MIGRATION_ID="$(date -u +%Y%m%dT%H%M%SZ)"
SNAPSHOT_NAME="a1-migration-${MIGRATION_ID}"
EXPORT_NAME="a1-export-${MIGRATION_ID}"

ElastiCache subnet group
security group
Valkey parameter group
KMS key
user group/ACL, if used
destination S3 bucket

valkey-cli --tls -h SOURCE-PRIMARY-ENDPOINT -p 6379 DBSIZE

valkey-cli --tls -h SOURCE-PRIMARY-ENDPOINT -p 6379 INFO keyspace

valkey-cli --tls -h SOURCE-PRIMARY-ENDPOINT -p 6379 INFO memory | egrep '^(used_memory|used_memory_human|used_memory_dataset|used_memory_dataset_perc|used_memory_rss):'

used_memory_dataset:
    best in-memory estimate of key/value dataset bytes

used_memory:
    dataset plus Valkey allocator/internal overhead

used_memory_rss:
    operating-system resident memory
    not the migration payload size

DBSIZE / INFO keyspace:
    current key count

aws elasticache describe-replication-groups --profile "${SOURCE_PROFILE}" --region "${SOURCE_REGION}" --replication-group-id "${SOURCE_REPLICATION_GROUP}" --query 'ReplicationGroups[0].NodeGroups[].NodeGroupMembers[?CurrentRole==`primary`].ReadEndpoint' --output table

BytesUsedForCache:
    cache-engine allocated bytes per node

CurrItems:
    item count per node

DatabaseMemoryUsagePercentage:
    memory utilization percentage, not byte size

aws elasticache create-snapshot --profile "${SOURCE_PROFILE}" --region "${SOURCE_REGION}" --replication-group-id "${SOURCE_REPLICATION_GROUP}" --snapshot-name "${SNAPSHOT_NAME}"

aws elasticache describe-snapshots --profile "${SOURCE_PROFILE}" --region "${SOURCE_REGION}" --snapshot-name "${SNAPSHOT_NAME}" --show-node-group-config --query 'Snapshots[0].{Status:SnapshotStatus,Engine:Engine,Version:EngineVersion,NodeType:CacheNodeType,Shards:NodeSnapshots,KmsKeyId:KmsKeyId}'

aws elasticache copy-snapshot --profile "${SOURCE_PROFILE}" --region "${SOURCE_REGION}" --source-snapshot-name "${SNAPSHOT_NAME}" --target-snapshot-name "${EXPORT_NAME}" --target-bucket "${SOURCE_BUCKET}"

aws s3api list-objects-v2 --bucket "$SOURCE_BUCKET" --prefix "$EXPORT_NAME" --profile "$SOURCE_PROFILE" --region "$SOURCE_REGION" --query 'Contents[].{Key:Key,Bytes:Size,Modified:LastModified}' --output table

# Bash 数组：替换成已核对的本次全部对象键；不要扫描并复制桶内所有 RDB。
RDB_KEYS=('REPLACE_EXACT_EXPORT_KEY.rdb')
(
  set -euo pipefail
  (( ${#RDB_KEYS[@]} > 0 )) || exit 1
  for key in "${RDB_KEYS[@]}"; do
    [[ "$key" != REPLACE_* && "$key" == "$EXPORT_NAME"* && "$key" == *.rdb ]] || exit 1
    aws s3 cp "s3://${SOURCE_BUCKET}/${key}" "s3://${DESTINATION_BUCKET}/${EXPORT_NAME}/${key}" --source-region "$SOURCE_REGION" --region "$DESTINATION_REGION" --profile "$DESTINATION_PROFILE" --only-show-errors
    source_size=$(aws s3api head-object --bucket "$SOURCE_BUCKET" --key "$key" --profile "$DESTINATION_PROFILE" --region "$SOURCE_REGION" --query ContentLength --output text)
    target_size=$(aws s3api head-object --bucket "$DESTINATION_BUCKET" --key "$EXPORT_NAME/$key" --profile "$DESTINATION_PROFILE" --region "$DESTINATION_REGION" --query ContentLength --output text)
    [[ "$source_size" == "$target_size" ]] || exit 1
  done
)

aws s3 ls "s3://${DESTINATION_BUCKET}/${EXPORT_NAME}/" --profile "${DESTINATION_PROFILE}" --region "${DESTINATION_REGION}" --recursive

RDB_ARN="arn:aws:s3:::${DESTINATION_BUCKET}/${EXPORT_NAME}/${RDB_KEYS[0]}"

aws elasticache create-replication-group --profile "${DESTINATION_PROFILE}" --region "${DESTINATION_REGION}" --replication-group-id "${DESTINATION_REPLICATION_GROUP}" --replication-group-description 'Migrated from Account A A1' --engine valkey --engine-version TARGET-COMPATIBLE-VALKEY-VERSION --cache-node-type cache.r7g.large --num-node-groups 1 --replicas-per-node-group 1 --automatic-failover-enabled --multi-az-enabled --cache-subnet-group-name account-b-valkey-subnets --cache-parameter-group-name account-b-valkey-parameters --security-group-ids sg-0123456789abcdef0 --at-rest-encryption-enabled --kms-key-id arn:aws:kms:ap-southeast-1:222222222222:key/DESTINATION-KEY-ID --transit-encryption-enabled --snapshot-arns "${RDB_ARN}"

--user-group-ids account-b-valkey-users

aws elasticache wait replication-group-available --profile "${DESTINATION_PROFILE}" --region "${DESTINATION_REGION}" --replication-group-id "${DESTINATION_REPLICATION_GROUP}"

aws elasticache describe-replication-groups --profile "${DESTINATION_PROFILE}" --region "${DESTINATION_REGION}" --replication-group-id "${DESTINATION_REPLICATION_GROUP}" --query 'ReplicationGroups[0].{Status:Status,ClusterEnabled:ClusterEnabled,ConfigurationEndpoint:ConfigurationEndpoint,NodeGroups:NodeGroups}'

PING
DBSIZE
sample GET/HGETALL/LRANGE/SMEMBERS/ZRANGE/XINFO
sample PTTL
INFO keyspace
INFO memory

1. keep A1 writes stopped
2. update application endpoint/secret to B2
3. restart client connection pools
4. run read/write/delete smoke tests
5. resume writes only on B2
6. monitor errors, latency, memory and evictions

[ ] node-based ElastiCache Valkey confirmed
[ ] Account B subnet/security/parameter/KMS/user-group resources prepared
[ ] source and destination S3 buckets are in their cache Regions
[ ] ElastiCache export/import S3 permissions tested
[ ] all A1 writers stopped
[ ] final snapshot status = available
[ ] every RDB shard copied to Account B
[ ] B2 created with compatible version/topology/capacity
[ ] key samples and TTL validated
[ ] application switched and connection pools restarted
[ ] only B2 accepts writes after cutover