Cloud migration rarely happens "all at once, all together." Decades-old COBOL batches, legacy with licenses tied to hardware, workloads that regulation forbids to leave the datacenter — they stay on-prem. New services go to AWS. Immediately: operational pain. "Two environments = two deployment pipelines, two credential systems, two patch tools, two monitoring stacks. If the team runs both, they double their work and double their mistakes. How do we unify operations?" Today: a realistic org with 5,000 on-prem VMs and 200 EC2s, strict security with inbound internet completely blocked. SSM Hybrid Activation·CodeDeploy On-Prem·IAM Roles Anywhere·PrivateLink solve this