Sold by: Firemind
Quick Launch
AWS Free Tier
A free, read-only assessment of your Microsoft Azure estate for migration to AWS. Grant keyless, Reader-only access and Firemind maps every workload to its AWS target, recommends a migration path for each, and returns a draft wave plan, licensing findings and the inputs for your AWS business case.
Overview
Overview: The Microsoft Azure to AWS Migration Assessment, built on Firemind's IT Operations Engine, reads the configuration of the Azure subscriptions you choose and tells you, workload by workload, how it should move to AWS, what stands in the way, and what it would take to run it once it lands. You receive a migration plan for every workload, free and with no commitment.
What the assessment covers
- Virtual machines, scale sets and their disks
- Azure Kubernetes Service clusters and container apps
- App Service and Azure Functions
- Azure SQL Database, SQL Managed Instance, Azure Database for PostgreSQL and MySQL, and Cosmos DB
- Storage accounts, Service Bus and Event Hubs, assessed from configuration
- Virtual networks, network security groups, load balancers and DNS zones
- Azure OpenAI and other AI services
- Windows Server and SQL Server licensing position
Typical targets include Amazon EC2 for virtual machines, Amazon EKS for AKS, AWS Lambda for Azure Functions, Amazon ECS on AWS Fargate or AWS Elastic Beanstalk for App Service, Amazon RDS for SQL Server and Amazon Aurora for relational databases, Amazon SQS and Amazon SNS for Service Bus, and Amazon Bedrock for Azure OpenAI.
What you receive
- An inventory of every workload in scope, grouped into applications by dependencies and tags
- A recommended migration path for each workload, from rehost, relocate and replatform to repurchase, refactor, retain or retire, with the AWS target and the reason
- Dependencies and blockers, with the evidence behind each finding
- Windows Server and SQL Server licensing findings: where licence-included, bring-your-own-licence or a move to an open-source engine changes the plan
- A draft wave plan, ordered so lower-risk workloads move first
- Right-sized AWS estimates, ready to load into the AWS Pricing Calculator, including the post-migration annual run rate that MAP eligibility is based on
- A run-readiness view: what it would take to operate each workload once it lands on AWS
- A readout with a Firemind cloud architect, and a summary you can take into a Migration Acceleration Program (MAP) Assess conversation with your AWS account team
Access: read-only, and your data stays out of scope
Access is keyless and read-only. You create a dedicated Microsoft Entra ID application with a federated credential that trusts Firemind's OpenID Connect identity, so no client secret is issued, and assign it the built-in Reader role on the subscriptions or management groups you choose. Reader covers configuration only and holds no data-plane permissions, so blob contents, Key Vault secrets, database rows and log contents stay out of scope.
Optionally, deploy the IT Operations Engine read-only AWS role with Quick Launch so the assessment also checks the AWS landing zone your workloads would move into. It reads configuration and metadata only and makes no changes. If you already run the IT Operations Engine Free Assessment, this step is already done.
How it works
- Subscribe here. It is free, no card, no commitment.
- Create the read-only connection in Azure. Firemind provides an Azure CLI script, which you review and run. It creates a dedicated Microsoft Entra ID application with a federated credential, so no client secret is issued, and assigns it the Reader role on the subscriptions you choose.
- Optionally, deploy the read-only AWS role using Quick Launch. It registers with Firemind automatically.
- Firemind returns your assessment and a readout with a Firemind cloud architect.
- Delete the Entra ID application or its role assignments whenever you choose. Access ends with it.
Scope: Every subscription in your Microsoft Entra ID tenant, with no resource cap. Bring as much of your estate as you can: the more the assessment sees, the more complete your plan and business case.
Next step: Microsoft Azure to AWS Migration by Firemind on AWS Marketplace takes the plan through a full MAP Assess, landing zone, migration and operations, delivered as a private offer.
About Firemind: AWS Premier Tier Services Partner with the AWS Migration and Modernization Competency. 200+ clients since 2018, ISO 27001 certified, in partnership with AWS, NVIDIA and Anthropic. Core markets: UK and Ireland, Finland, Germany and the Netherlands.
Highlights
- Every Azure workload mapped to AWS: a recommended migration path for each, from rehost to refactor or retire, with its AWS target, dependencies, blockers and a draft wave plan.
- Keyless and read-only: a federated Entra ID application with no client secret, holding the built-in Reader role only, so blob contents, Key Vault secrets and database rows stay out of scope.
- Licensing and business case: Windows Server and SQL Server licensing findings, plus right-sized AWS estimates ready for the AWS Pricing Calculator and a MAP Assess conversation.
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Quick Launch
Leverage AWS CloudFormation templates to reduce the time and resources required to configure, deploy, and launch your software.
Pricing
This product is available free of charge. Free subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimensions summary
This listing uses a single pricing dimension billed at no cost. You get one free usage dimension, so there are no tiers, instance sizes, or usage-based add-ons to compare. The assessment reads your existing cloud estate and produces findings without changing anything. Because only this free dimension exists, pricing does not scale with the size of your estate, the number of accounts reviewed, or the volume of findings returned. You pay nothing to run the assessment through AWS Marketplace.
Top-of-mind questions for buyers
The assessment reads your cloud estate with read-only access and produces a baseline report. It covers estate topology, incident and alert volume by category, current resolution benchmarks, security findings and drift, and cost optimisation opportunities. Nothing in your environment changes during this assessment.
No. The assessment runs read-only and carries no operational risk. It reads what is actually running across your accounts and regions without modifying anything. The findings are evidenced from the live estate, not estimated, and no action executes against your infrastructure.
The discovery phase needs read-only access only. The agent deploys inside your cloud account using a role scoped to actions you define. It never requires credentials that exceed the boundary you set. Every permission is documented and auditable.
www.firemind.com+1
Helpful?
Vendor refund policy
This product is free. AWS Marketplace collects no fees from you and Firemind does not invoice for it, so there is nothing to refund. You can cancel your subscription at any time in the AWS Marketplace console, and you can revoke Firemind's access immediately by removing the connection you created. If you believe you have been charged for this product in error, contact Firemind at hello@firemind.com and we will respond within one business day.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Additional details
Usage instructions
Use Quick Launch above if you can. These steps are for buyers whose policy is to review and deploy CloudFormation themselves.
What gets created, and nothing else
- One IAM role, FaePlatformRole, which Firemind assumes to run the assessment
- Three IAM managed policies, all of them Deny, layered over the role's baseline
- One execution role and one Lambda function, used once to report the created role ARN back to Firemind, then never invoked again
- One custom resource that invokes that function
What the role can and cannot do
The baseline is the AWS managed SecurityAudit and ViewOnlyAccess policies. Three Deny policies sit over the top, covering object and storage data, database and stream contents, and secrets, key material and privilege escalation. An explicit Deny always wins in IAM evaluation, so this holds regardless of what the baseline would otherwise permit.
The role can list a bucket and count its objects, but cannot read one. It can describe a database, its engine and its encryption configuration, but cannot read a row. It cannot decrypt anything, read a secret or parameter value, download log contents, or open a session to a host. Remediation is disabled and the role holds no write permissions.
Steps
- Download the template from the URL shown in the Quick Launch panel and review it. Everything above is visible in the file.
- Create the stack in any region you like. The role is global, so the region only determines where the stack object lives. Assessment covers every region regardless.
- Acknowledge CAPABILITY_NAMED_IAM. The role name is fixed so that Firemind can derive the ARN without asking you for it.
- Set FaeTrustedAccountId to the Firemind account shown on the Quick Launch page, and FaeCallbackUrl to the registration endpoint shown there. Leave the remaining parameters at their defaults.
- On completion the stack reports the role back to Firemind automatically. If that call fails the stack rolls back, by design, so a silent half-configured state is not possible.
Trust
The trust policy is conditioned on an external ID equal to your own AWS account ID. Both sides derive it, so there is no secret to exchange and nothing to rotate.
Ending access
Delete the stack. That removes the role and every policy with it, and Firemind's access ends at that moment. No notice is required.
Support
Vendor support
For support, or questions about your assessment, contact Firemind at hello@firemind.com . We respond within one business day (UK business hours, Monday to Friday).
This assessment includes:
- Help setting up the read-only connection, including reviewing it with your security team before you run it
- A migration assessment and a readout with a Firemind cloud architect
- Help removing Firemind's access, and deleting any uploaded exports, when you are finished
There is no charge for this product and no paid support tier attached to it.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Move your Microsoft Azure workloads to AWS, from a MAP-aligned assessment through landing zone, wave-by-wave migration and operations. Identity, platform services and licensing are redesigned for AWS, not copied. Every change runs as governed code in your AWS account, and the same engine runs each wave once it lands.
A free assessment of your data centre estate for migration to AWS, with no agent to install. Upload your inventory exports and Firemind maps every server and application to its AWS target, recommends a migration path for each, and returns a draft wave plan and the inputs for your AWS business case.
A free assessment of your virtual machine estate, wherever it runs, for migration to Amazon EC2. Firemind sizes every machine from its configuration and utilisation, flags end-of-life operating systems and licensing choices, and returns a migration path and wave plan for each.
Move your serverless workloads to AWS, from a MAP-aligned assessment through landing zone, wave-by-wave migration and operations. Every trigger and binding is mapped and covered by a contract test. Every change runs as governed code in your AWS account, and the same engine runs each wave once it lands.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.