2 instance(s) hosting the candidate workload
Containerizing a single, efficient, stable, poorly-understood, or compliance-constrained workload adds operational surface with no density or elasticity payoff — the decision tree refuses those cases.
Mitigation: Keep the original instances (stopped, not terminated) and the pre-migration AMIs/launch templates until the containerized workload has run a full billing cycle; cut traffic back to the instances if regressions appear.
Migration: MediumRollback: High
2 instance(s) on x86 families
This rests on ARM64 compatibility we have NOT confirmed: if any runtime dependency, vendor agent or native binary lacks a working ARM64 build, the move breaks for that instance. A family match alone is not proof the workload runs on ARM.
Mitigation: Relaunch the instance from the original x86 launch template / AMI; the change is a family swap, fully reversible.
Migration: MediumRollback: Low
NAT-gateway-heavy layout
VPC endpoints are NOT free: interface endpoints carry an hourly charge PLUS a per-GB data-processing fee, so below a traffic threshold the endpoint cost can EXCEED the NAT saving, and some destinations have no endpoint at all.
Mitigation: Remove the VPC endpoints and restore the original route tables; traffic falls back to the NAT gateway.
Migration: LowRollback: Low