The easiest platform to enter may be the hardest one to leave.
Lock-in is measurable
The UK Competition and Markets Authority found that egress fees, interoperability barriers and software licensing restricted switching and multi-cloud. AWS and Microsoft later announced changes after regulatory engagement, while the CMA said further work remained.
Account control is infrastructure control
In 2025, one AWS customer reported losing access to ten years of work during a verification dispute. Support described resources as terminated; after public escalation, AWS restored the account and data.
On 19 May 2026, Google Cloud suspended Railway's production account through an automated action, without a notice immediately before it. Workloads on AWS and Railway's own hardware became unreachable too, because their routing depended on a control plane inside that account.
Open the Railway incident dossier →
The boundary
Each is one company's account, not evidence of a systemic suspension or deletion policy. The 2025 AWS account was restored after public escalation; Railway regained access within minutes but needed hours to recover. The useful question is narrower: can your recovery process operate when the provider account cannot?
Your managed service has a lifecycle you do not control
On 31 March 2026, AWS moved nine services or features into maintenance, announced four service sunsets, and ended support for an Amazon Chime SDK feature. Existing users of maintenance services could continue, but new customers lost access; sunset customers were told to plan migrations to alternatives.
Read the AWS service availability update →
The boundary
Planned lifecycle changes are not outages, and AWS published migration guidance and offered support. The lock-in question is whether your own replacement cost and timeline were known before the provider set the deadline.
Test the exit
- Export data into usable, documented formats.
- Inventory managed APIs and proprietary services.
- Calculate contract, egress and refactoring cost.
- Recover identity outside the primary account.
- Run the workload in its target environment.