CBA builds Lumos, an AI-driven accelerator to prepare applications for cloud

CBA has built a multi-agent workflow that covers every step required to prepare an application for migration to the cloud, enabling the bank to move “20-to-30” applications a quarter.

CBA's Ash Moollan.

The workflow is branded ‘Lumos’ and is essentially an “AI-first” reimagining of the application modernisation and migration process.

“Twelve (12)-to-18 months ago, I stood in front of my team and I said, ‘We're going to migrate X number of applications to the cloud' … and everyone in my team, including myself, felt like that task was daunting,” general manager of cloud acceleration within the office of the CTO Ash Moollan told an AWS financial services symposium in Sydney.

“So, we thought about how we [could] apply an engineering-led approach and mindset to how we migrate applications to the cloud. What would it look like to migrate this AI-first, agent-first, the smart way?

“Essentially, for every step of that [migration] journey, we've put AI first and agentic first in how we pull that together.”

The work, conducted in collaboration with AWS’ professional services arm ProServe, came about as a way to both make the standard AWS migration framework “CBA-relevant” and to increase the volume of application migrations that were possible in a specific timeframe.

“Last year, my team migrated about 10-ish applications in one year. Our ambition was -  let’s just say - to do more,” Moollan said.

“Where we ended up at the end of this quarter, we're now migrating in the ballpark of 20 to 30 applications per quarter.”

Moollan said that in the past year, his team had scoped “370 legacy applications” as potential modernisation and migration candidates.

“We've done a bunch of application assessments and let me tell you, it was not easy,” he said, likening the process to “documentation archaeology” to understand the application well enough to proceed with its modernisation and migration to cloud.

Aside from fragmented documentation, a slide displayed other challenges slowing CBA’s application modernisation and cloud migration efforts, including cloud readiness assessments taking six or more weeks per application and the time and effort needed to remediate technical debt.

Lumos - built into the bank’s cloud migration portal - is designed to help with this and more - using AI agents to handle particular steps, with a human in the loop to provide oversight and request additional changes where needed.

AI agents are used across the assessment to migration workflow: for requirements gathering, network and code analysis, solution architecture and cyber document generation, code transformation, UI testing and continuous feedback steps.

To start, an agent summarises and analyses a conversation with an application owner, drawing out key points and converting them into requirements.

Moollan said this ensured there was no miscommunication or mistakes made in scoping a migration candidate.

Another agent is used to analyse and understand the codebase of the application, to describe “what this application actually does, the various functions, capabilities and how [these are]”, and to understand “any network connectivity that it discovered as part of that code analysis”, such as API calls, database and storage connections and so on.

This allows the cloud readiness of the application to be determined, highlighting any potential issues in the code that require remediation or dependencies that require upgrading. 

Moollan said that an AI-generated component diagram and sequence diagram is also produced to show how the application functions.

Once the application is understood and determined to be a modernisation and cloud migration candidate, “a number of agents” work together to create design and cyber documentation.

A writer agent prepares the documents, ensuring they are CBA-relevant by running checks against the bank’s technical knowledge base, and a validator agent “reviews the content written by the first agent, and it'll orchestrate between a workflow agent to do at least three iterations to refine and upgrade the quality of what is being produced,” Moollan said.

Moollan noted there is also a human in the loop to challenge what has been written and have it refined further.

The result is then fed to another agent “trained on cyber knowledge” to prepare “a security zone diagram on which resources should be deployed in what security zone within the organisation”, and to generate required documentation.

In addition to using agents to build an understanding of what an application does and how to migrate it to the cloud, agents are also involved in making changes to the application to prepare it.

Agents “prepare the code base” for work that is then carried out by other agents. 

“There's an agent that uses the open source OpenRewrite [auto-refactoring engine] that does a code transformation and a framework upgrade, and there's the AWS Q Developer CLI [which] reviews the code that OpenRewrite produces and makes changes if there are issues with it, so these two work hand in hand in order to upgrade that application,” Moollan said.

Moollan said a number of iterations were typically required, and changes were only accepted and merged into the codebase with human oversight.

Once Lumos has done its work, the DevOps Hosting Platform or DHP is used to deploy the application to the cloud and for ‘day two’ operations. 

DHP previously landed CBA the iTnews Benchmark Award for Finance in 2024.

Moollan said that through Lumos, engineers could access a “visual designer for DHP that creates a cloud environment in a drag-and-drop way that is CBA compliant.”

The bank is continuing to optimise the Lumos workflow.

Moollan said one of the optimisations is to change the underlying technology powering multi-agent orchestration.

“In the earlier days, we experimented with CrewAI and Pydantic as our agent orchestration framework,” he said.

“AWS just announced [Amazon Bedrock] AgentCore, so we're working quite heavily in the background now to migrate from Pydantic to AgentCore.”

In addition to enabling more multi-agent orchestration, Moollan flagged some additional work around Lumos’ ability to handle “large legacy codebases” and the addition of more unit and system tests.

Ry Crozier attended the AWS financial services symposium as a guest of AWS.