A Coinbase MongoDB migration meant finding one of a handful of engineers with production access to hand-run a script over tens of millions of records.

Coinbase runs a mix of datastores — MongoDB, Postgres, Redis — and MongoDB migrations had consistently been troublesome. A migration usually means adding new fields, updating data to match changed assumptions in the code, or removing fields that are no longer used. Until about a week before this was written, the process to do one was almost entirely by hand.

The steps read like a relay race: write the migration and get it reviewed, then find one of the very limited number of engineers with production access and ask them to run it. Then hand that same engineer a separate script to iterate over every record — sometimes tens of millions of them — and apply the updates. Then a third custom script to clean up. And if anything went wrong, you went back to that same engineer to stop it.

This worked when Coinbase was tiny and broke as it grew. In Coinbase’s own words, ad-hoc processes tend to fail when scaled. A 50-plus person engineering team funneling every migration through a handful of engineers with production access meant migrations ate a real chunk of those few people’s time.

So the team asked what an ideal process would actually require. Their answer was a short list of principles: a migration should never require manually running a single line of code on production; it should be runnable by any engineer, not just the few cleared for production data; error handling should be built into every step, assuming a machine can die mid-migration; all migration code should be unit-tested; and beyond writing the code, there should be little-to-no manual work at all.

After a few weeks of work, they condensed the whole thing into an admin panel with a few selections. An engineer now adds the migration to the codebase with unit tests, sends it through code review, and kicks it off from the panel. When it finishes, they get a notification via the error-tracking software, then remove the migration and trigger a final cleanup that wipes the migration metadata. Errors are handled in the background, and a one-click killswitch stops a migration if the database needs maintenance.

The payoff Coinbase names is that engineers no longer need production access to run a migration — which lets them keep the set of people with that access small. The stated goal is to automate away as much manual work as possible, cutting errors and freeing engineers for more productive work. The migration tool is, underneath, a way to hand out capability without handing out production keys.

Automating a risky manual task isn’t mainly about speed — it’s about letting more people do it safely so fewer people need the dangerous access in the first place.