AWS Transform adds new network builds and security-group conversion

AWS announced two additional network-migration options for AWS Transform on October 21, 2026: building a new network from scratch and converting on-premises access rules into security groups for existing VPCs. These join its existing network migration and modernization workflow, according to the AWS announcement.

Separate network design from access-rule migration

For teams seeking a clean start, AWS says Transform builds a new network aligned with AWS best practices. For teams bringing access rules into an established AWS network, the service converts on-premises rules into security groups, detects stale rules and recommends optimizations.

AWS says the converted groups can be deployed into existing VPCs without redeploying the network stack. The practical distinction is scope: engineers can approach access-policy migration separately from rebuilding the network, rather than treating both as one infrastructure change.

Treat optimization recommendations as inputs to review, not proof that the resulting rules preserve every required application flow. Before deployment, validate converted rules against expected traffic, including infrequent administrative and recovery access. Even when a network-stack redeployment is unnecessary, plan connectivity checks and a rollback path for the security-group changes.

Availability and regional scope

The release notice describes the capabilities as available now and says they support migration to any AWS commercial or GovCloud Region. It does not explicitly label the update as preview or generally available.

That regional statement concerns migration destinations; it is not a list of Regions hosting the Transform service itself.

For migration planners, AWS now describes three paths: migrate and modernize an existing network, build a new network, or convert on-premises access rules for deployment into VPCs already in place.