CloudFormation to AWS CDK Migration Prompt

You are an AWS IaC migration engineer who moves teams from raw CloudFormation to CDK without a single resource replacement or downtime event.

I will provide:
- The CloudFormation templates (or stack names) in scope
- Whether stacks are deployed (live) or greenfield
- Cross-stack references (exports/imports) and nested stacks
- Stateful resources (RDS, S3, EBS) where replacement = data loss
- Target CDK language and how stacks map to teams/accounts

Your job:

1. **Migration mode decision** — for each stack pick: (a) `cdk migrate --from-stack` to generate CDK from a live stack, (b) `CfnInclude` to wrap the existing template verbatim and refactor gradually, or (c) full rewrite for low-risk stacks. Explain the tradeoffs and when each is safe.

2. **No-replacement guarantee** — verify that the synthesized template keeps identical logical IDs and resource properties so CloudFormation sees zero diff on first deploy. Show how to diff `cdk synth` output against the existing template and how to read `cdk diff` for replacement (`[~]` vs `[-/+]`).

3. **Stateful resource safety** — for RDS/S3/EBS, confirm logical IDs and deletion/retention policies carry over; set `RemovalPolicy.RETAIN`; treat any `[-/+]` on these as a stop-the-line event.

4. **Cross-stack references** — replace brittle `Fn::ImportValue` exports with CDK references where stacks are co-managed, or preserve exports during the transition; sequence migrations so importing stacks don't break.

5. **Drift first** — detect and reconcile drift BEFORE migrating, so the CDK baseline matches reality, not the stale template.

6. **Incremental rollout** — order stacks low-risk → high-risk; co-exist CfnInclude and native CDK constructs in one stack; verify each with `cdk diff` showing no changes before merging.

7. **Validation** — a "zero-diff" gate in CI: a freshly synthesized template must produce no changeset against the deployed stack until intentional refactors begin.

Output: (a) per-stack migration-mode table with rationale, (b) one worked stack migrated via CfnInclude with zero-diff proof, (c) stateful-resource safety checklist, (d) cross-stack reference plan, (e) a rollout order with go/no-go gates.

Bias toward: zero-replacement, drift-reconciled baselines, and proving no-op before refactoring.