AWSApplicationMigrationFullAccess
Last Modified
Aug 3, 2026
August 3, 2026 at 11:03 AM UTC
Version
v14
Total Versions
13
Created
Aug 3, 2026
Actions
52
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can take over existing resources that run as another role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- ssm:SendCommand: condition aws:ResourceTag/AWSApplicationMigrationServiceManaged, aws:ViaAWSService, on arn:aws:ec2:*:*:instance/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Full mgn access on every resource
Uses mgn:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
mgn:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"mgn:*"
],
"Resource": "*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"kms:ListAliases",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"ec2:DescribeKeyPairs",
"ec2:DescribeTags",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePlacementGroups",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeVolumes",
"ec2:GetEbsEncryptionByDefault",
"ec2:GetEbsDefaultKmsKeyId"
],
"Resource": "*"
},
{
"Sid": "VisualEditor3",
"Effect": "Allow",
"Action": "license-manager:ListLicenseConfigurations",
"Resource": "*"
},
{
"Sid": "VisualEditor4",
"Effect": "Allow",
"Action": "elasticloadbalancing:DescribeLoadBalancers",
"Resource": "*"
},
{
"Sid": "VisualEditor5",
"Effect": "Allow",
"Action": "iam:ListInstanceProfiles",
"Resource": "*"
},
{
"Sid": "VisualEditor6",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole",
"arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "ec2.amazonaws.com"
},
"Bool": {
"aws:ViaAWSService": "true"
}
}
},
{
"Sid": "VisualEditor7",
"Effect": "Allow",
"Action": [
"drs:DescribeSourceServers"
],
"Resource": "*"
},
{
"Sid": "VisualEditor8",
"Effect": "Allow",
"Action": [
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
}
}
},
{
"Sid": "VisualEditor9",
"Effect": "Allow",
"Action": [
"ssm:ListCommandInvocations"
],
"Resource": "*"
},
{
"Sid": "VisualEditor10",
"Effect": "Allow",
"Action": [
"ssm:DescribeInstanceInformation",
"ssm:GetCommandInvocation"
],
"Resource": "*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
}
}
},
{
"Sid": "VisualEditor11",
"Effect": "Allow",
"Action": [
"ssm:DescribeDocument",
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance",
"arn:aws:ssm:*:*:document/AWSMigration-*"
],
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
}
}
},
{
"Sid": "VisualEditor12",
"Effect": "Allow",
"Action": [
"drs:DisconnectSourceServer"
],
"Resource": "arn:aws:drs:*:*:source-server/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSApplicationMigrationServiceConfiguredDR": "false"
}
}
},
{
"Sid": "VisualEditor13",
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:PutParameter"
],
"Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*"
},
{
"Sid": "VisualEditor14",
"Effect": "Allow",
"Action": [
"servicequotas:GetServiceQuota"
],
"Resource": "*"
},
{
"Sid": "VisualEditor15",
"Effect": "Allow",
"Action": [
"ssm:GetAutomationExecution"
],
"Resource": "arn:aws:ssm:*:*:automation-execution/*"
},
{
"Sid": "VisualEditor16",
"Effect": "Allow",
"Action": [
"ssm:GetDocument"
],
"Resource": [
"arn:aws:ssm:*:*:document/AWSDisasterRecovery-InstallDRAgentOnInstance",
"arn:aws:ssm:*:*:document/AWSMigration-*"
]
},
{
"Sid": "VisualEditor17",
"Effect": "Allow",
"Action": [
"ssm:GetParameters"
],
"Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "ssm.amazonaws.com"
}
}
},
{
"Sid": "VisualEditor18",
"Effect": "Allow",
"Action": [
"ssm:StartAutomationExecution"
],
"Resource": [
"arn:aws:ssm:*:*:document/AWSMigration-*",
"arn:aws:ssm:*:*:automation-execution/*",
"arn:aws:ssm:*:*:automation-definition/AWSMigration-*:$DEFAULT"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "mgn.amazonaws.com"
}
}
},
{
"Sid": "VisualEditor19",
"Effect": "Allow",
"Action": "ssm:ListCommands",
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "ssm.amazonaws.com"
}
}
},
{
"Sid": "VisualEditor20",
"Effect": "Allow",
"Action": [
"ssm:DescribeParameters"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
}
}
},
{
"Sid": "FSxReadPermissions",
"Effect": "Allow",
"Action": [
"fsx:DescribeStorageVirtualMachines"
],
"Resource": [
"*"
]
},
{
"Sid": "AllowTagSVMWithMapKeys",
"Effect": "Allow",
"Action": [
"fsx:TagResource"
],
"Resource": "arn:aws:fsx:*:*:storage-virtual-machine/*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"map-migrated",
"aws-apn-id"
]
}
}
},
{
"Sid": "FSxDescribeOperations",
"Effect": "Allow",
"Action": [
"fsx:DescribeVolumes",
"fsx:DescribeSnapshots"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
}
}
},
{
"Sid": "FSxCreateVolume",
"Effect": "Allow",
"Action": "fsx:CreateVolume",
"Resource": [
"arn:aws:fsx:*:*:volume/*/*",
"arn:aws:fsx:*:*:storage-virtual-machine/*/*"
],
"Condition": {
"Null": {
"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
}
}
},
{
"Sid": "FSxDeleteVolumeAndTag",
"Effect": "Allow",
"Action": [
"fsx:DeleteVolume",
"fsx:TagResource"
],
"Resource": "arn:aws:fsx:*:*:volume/*/*",
"Condition": {
"Null": {
"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
}
}
},
{
"Sid": "FSxCreateSnapshot",
"Effect": "Allow",
"Action": "fsx:CreateSnapshot",
"Resource": [
"arn:aws:fsx:*:*:snapshot/*/*",
"arn:aws:fsx:*:*:volume/*/*"
],
"Condition": {
"Null": {
"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
}
}
}
]
},
"VersionId": "v14",
"IsDefaultVersion": true,
"CreateDate": "2026-08-03T10:57:21+00:00"
}
}Version History (18 recorded)
Raw history5 actions added
scope changed, no action added or removed
2 actions added
AWSApplicationMigrationFullAccess - Policy Version v11
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
2fddc5eAWSApplicationMigrationFullAccess - Policy Version v11
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
4dd8efaAWSApplicationMigrationFullAccess - Policy Version v10
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
1642db7Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 2, 2025
1e3ab1eUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 20, 2024
1884c3bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 20, 2023
52c4f26Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 20, 2023
6a1262bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 11, 2022
37ef86aUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 11, 2022
b368dedUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 31, 2022
18421ceUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 1, 2022
469c874Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 22, 2022
2190abeUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 7, 2021
56438e7