Skip to main content
OpsRoadmaps

Checklists / database-migration

Database Migration Checklist

Change production data shape without downtime: expand, migrate, contract — and rehearse the backup restore.

9 steps · 9 required · last reviewed (next review 2027-03-19) · updated 2026-09-21

Related focus areas:DataOpsReleaseOpsSRE

Roadmaps covering the same ground:Incident Management MaturityObservability MaturityPlatform Engineering AdoptionProduction-Ready KubernetesResilience and DR ImprovementSRE Adoption

Sign in to run this checklist

A bad migration is the most expensive class of failure in software operations: it can lose data, corrupt state, and take hours to notice. The expand/contract pattern (add the new, dual-write/backfill, then remove the old) runs through this whole list.

The rehearsal item is not paranoia. A backup you have never restored is a rumor.

  1. Migration is reversible or forward-compatible (expand/contract; no destructive step in the same deploy)

    required

    The old code and the new code must both work against the new schema, or a failed app deploy becomes a failed schema change.

  2. Migration runs against a production-sized copy first, with timing measured

    required

    An ALTER TABLE that takes 400ms in staging can lock a production table for 20 minutes — size, not syntax, decides.

  3. Backup is taken AND a restore from it is rehearsed recently

    required

    The restore is the only part of a backup that matters; the migration window is exactly when you will need it.

  4. Long-running migrations lock behavior is understood (lock_timeout set, big tables batched)

    required

    A lock timeout turns a stuck migration into a failed one instead of a traffic outage.

  5. Dual-write or backfill strategy exists for data movement

    required

    Data does not move itself; deciding dual-write vs backfill is deciding whether a crash mid-migration loses writes.

  6. Application is deployed and verified BEFORE the contract (drop) step

    required

    Dropping the old column while the old code still reads it is an instant outage with a very obvious log line.

  7. Migration runs inside the deploy pipeline, not a laptop session

    required

    Manual migrations are unrepeatable, unaudited, and run with whatever permissions the human has.

  8. Rollback plan states explicitly whether data is recoverable

    required

    'Restore from backup' loses everything since the backup; say so in writing before anyone clicks deploy.

  9. Verification query proves the new shape (row counts, constraints, sample reads)

    required

    A successful exit code says the migration ran, not that the data is right.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-19 — adapt them to your own environment.