AWSApplicationMigrationNetworkMigrationMultiAccount
Last Modified
Sep 15, 2026
September 15, 2026 at 02:03 PM UTC
Version
v7
Total Versions
5
Created
Sep 15, 2026
Actions
196
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can grant itself more permissions
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:AttachRolePolicy: condition aws:CalledVia, aws:ResourceTag/CreatedBy, iam:PolicyARN, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition aws:CalledVia, iam:PassedToService, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
- cloudformation:CreateStack: condition aws:RequestTag/CreatedBy, aws:ResourceTag/CreatedBy, on arn:aws:cloudformation:*:*:stack/Nmd*
- iam:PassRole: condition aws:CalledVia, iam:PassedToService, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
- lambda:CreateFunction: condition aws:CalledVia, aws:RequestTag/CreatedBy, aws:ResourceTag/CreatedBy, on arn:aws:lambda:*:*:function:network-migration*
- lambda:InvokeFunction: condition aws:CalledVia, aws:ResourceTag/CreatedBy, on arn:aws:lambda:*:*:function:network-migration*
- iam:PassRole: condition aws:CalledVia, iam:PassedToService, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
- lambda:CreateFunction: condition aws:CalledVia, aws:RequestTag/CreatedBy, aws:ResourceTag/CreatedBy, on arn:aws:lambda:*:*:function:network-migration*
- lambda:AddPermission: condition aws:CalledVia, aws:ResourceTag/CreatedBy, on arn:aws:lambda:*:*:function:network-migration*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:UpdateStack: condition aws:ResourceTag/CreatedBy, on arn:aws:cloudformation:*:*:stack/Nmd*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (1)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 21248 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EC2CFNReadonlyPrefixList",
"Effect": "Allow",
"Action": [
"ec2:GetManagedPrefixListEntries"
],
"Resource": [
"arn:aws:ec2:*:*:prefix-list/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "NetworkAnalyzer",
"Effect": "Allow",
"Action": [
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeAvailabilityZones"
],
"Resource": [
"*"
]
},
{
"Sid": "CreatePermissionsByCFNNACL",
"Effect": "Allow",
"Action": [
"ec2:ReplaceNetworkAclAssociation"
],
"Resource": [
"arn:aws:ec2:*:*:network-acl/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "CreatePermissionsByCFNNACLSN",
"Effect": "Allow",
"Action": [
"ec2:ReplaceNetworkAclAssociation"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "EC2CFNReadonly",
"Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCustomerGateways",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeHosts",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePrefixLists",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations"
],
"Resource": [
"*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "MGNCFNDescribe",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStacks",
"cloudformation:ListStacks"
],
"Resource": "arn:aws:cloudformation:*:*:stack/Nmd*"
},
{
"Sid": "CFNCreate",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack"
],
"Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CFNTagOnCreate",
"Effect": "Allow",
"Action": [
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition": {
"StringEquals": {
"cloudformation:CreateAction": [
"CreateStack",
"UpdateStack"
]
}
}
},
{
"Sid": "CFNOperations",
"Effect": "Allow",
"Action": [
"cloudformation:DeleteStack",
"cloudformation:UpdateStack",
"cloudformation:UpdateTerminationProtection",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplateSummary",
"cloudformation:ListStackResources",
"cloudformation:DescribeStackEvents"
],
"Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CFNProvision",
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress"
],
"Resource": [
"arn:aws:ec2:*:*:elastic-ip/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AnalyzerEC2PutResourcePolicy",
"Effect": "Allow",
"Action": [
"ec2:PutResourcePolicy"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AnalyzerEC2ResourceOperations",
"Effect": "Allow",
"Action": [
"ec2:DeleteSecurityGroup",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AnalyzerEC2ResourceSgTag",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AnalyzerEC2RequestSgTag",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AnalyzerEC2SecurityGroupTags",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
}
},
{
"Sid": "EC2TagCFNSG",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByCFN",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "CreatePermissionsByResourceTag",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkAcl",
"ec2:CreateNetworkAclEntry",
"ec2:CreateSubnet",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateNatGateway",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInsightsPath"
],
"Resource": [
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:elastic-ip/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AllowCreateTGWVpcAttachmentSameOrg",
"Effect": "Allow",
"Action": [
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource": [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceOrgID": "${aws:PrincipalOrgID}"
}
}
},
{
"Sid": "CFNProvisionNetworking",
"Effect": "Allow",
"Action": [
"ec2:CreateInternetGateway",
"ec2:CreateVpc",
"ec2:CreateTransitGateway"
],
"Resource": [
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:transit-gateway/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByRequestTagNetworking",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkAcl",
"ec2:CreateSubnet",
"ec2:CreateRouteTable"
],
"Resource": [
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByRequestTagRouting",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkAclEntry",
"ec2:CreateRoute"
],
"Resource": [
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:route-table/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByRequestTagNAT",
"Effect": "Allow",
"Action": [
"ec2:CreateNatGateway"
],
"Resource": [
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:elastic-ip/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByRequestTagTransitGateway",
"Effect": "Allow",
"Action": [
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayRoute"
],
"Resource": [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByRequestTagTGWAttachment",
"Effect": "Allow",
"Action": [
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource": [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByRequestTagNetworkInterface",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "DeleteENI",
"Effect": "Allow",
"Action": [
"ec2:DeleteNetworkInterface"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreatePermissionsByRequestTagInsights",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInsightsPath"
],
"Resource": [
"arn:aws:ec2:*:*:network-insights-path/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "EC2TagCFN",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-policy-table/*",
"arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
"arn:aws:ec2:*:*:network-insights-access-scope/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:network-insights-analysis/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"ec2:CreateAction": [
"CreateTransitGatewayVpcAttachment",
"CreateTransitGatewayRouteTableAnnouncement",
"CreateTransitGatewayRouteTable",
"CreateTransitGatewayRoute",
"CreateTransitGatewayPrefixListReference",
"CreateTransitGatewayPolicyTable",
"CreateTransitGatewayPeeringAttachment",
"CreateTransitGatewayConnectPeer",
"CreateTransitGatewayConnect",
"CreateTransitGateway",
"CreateInternetGateway",
"CreateNatGateway",
"CreateSubnet",
"CreateNetworkAcl",
"CreateRouteTable",
"CreateNetworkInterface",
"CreateNetworkInsightsPath",
"CreateNetworkInsightsAccessScope",
"CreateLaunchTemplate",
"AllocateAddress",
"StartNetworkInsightsAnalysis",
"CreateVpc"
]
}
}
},
{
"Sid": "deployerWorkload",
"Effect": "Allow",
"Action": [
"ssm:GetParameters"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/network-migration/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "putParameter",
"Effect": "Allow",
"Action": [
"ssm:PutParameter",
"ssm:AddTagsToResource"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/network-migration/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "deleteParameter",
"Effect": "Allow",
"Action": [
"ssm:DeleteParameter",
"ssm:DeleteResourcePolicy",
"ssm:ListTagsForResource"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/network-migration/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "ramResourceSharing",
"Effect": "Allow",
"Action": [
"ssm:PutResourcePolicy",
"ssm:GetResourcePolicies"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/network-migration/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "ramTagResource",
"Effect": "Allow",
"Action": [
"ram:TagResource"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreateResourceShareTransitGateway",
"Effect": "Allow",
"Action": [
"ram:CreateResourceShare"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"Bool": {
"ram:RequestedAllowsExternalPrincipals": "false"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AssociateResourceShare",
"Effect": "Allow",
"Action": [
"ram:AssociateResourceShare"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService",
"ram:RequestedResourceType": [
"ec2:TransitGateway",
"ssm:Parameter"
]
}
}
},
{
"Sid": "CreateResourceShareWithResourceTag",
"Effect": "Allow",
"Action": [
"ram:DeleteResourceShare",
"ram:DisassociateResourceShare",
"ram:UpdateResourceShare"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AllowGetResourceShares",
"Effect": "Allow",
"Action": [
"ram:GetResourceShares"
],
"Resource": "arn:aws:ram:*:*:resource-share/*"
},
{
"Sid": "CreateCustomResourceLogGroup",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:*:*:log-group:/aws/lambda/network-migration-modify-tgw*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "CreateCustomResourceLambda",
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"lambda:TagResource"
],
"Resource": [
"arn:aws:lambda:*:*:function:network-migration*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "GetCustomResource",
"Effect": "Allow",
"Action": [
"lambda:GetFunction",
"lambda:ListTags"
],
"Resource": [
"arn:aws:lambda:*:*:function:network-migration*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "OperationsCustomResourceLambda",
"Effect": "Allow",
"Action": [
"lambda:AddPermission",
"lambda:DeleteFunction",
"lambda:GetFunctionConfiguration",
"lambda:InvokeFunction"
],
"Resource": [
"arn:aws:lambda:*:*:function:network-migration*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreateRoleCustomResource",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:TagRole"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "PassGetRoleCustomResource",
"Effect": "Allow",
"Action": [
"iam:GetRole"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "PassRoleCustomResource",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"iam:PassedToService": "lambda.amazonaws.com"
}
}
},
{
"Sid": "OperationsRoleCustomResource",
"Effect": "Allow",
"Action": [
"iam:DeleteRole",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:GetRolePolicy",
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "AttachCustomResourceRole",
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ArnEquals": {
"iam:PolicyARN": [
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
"arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationCustomResource"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "MGNCFNBasedResourcesProvision",
"Effect": "Allow",
"Action": [
"ec2:AcceptTransitGatewayVpcAttachment",
"ec2:AssociateNatGatewayAddress",
"ec2:AssociateRouteTable",
"ec2:AssociateSubnetCidrBlock",
"ec2:AssociateTransitGatewayRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteInternetGateway",
"ec2:DeleteLaunchTemplate",
"ec2:DeleteLaunchTemplateVersions",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkAclEntry",
"ec2:DeleteNetworkInsightsAnalysis",
"ec2:DeleteNetworkInsightsPath",
"ec2:DeleteNetworkInterface",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSnapshot",
"ec2:DeleteSubnet",
"ec2:DeleteTransitGateway",
"ec2:DeleteTransitGatewayRoute",
"ec2:DeleteTransitGatewayRouteTable",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:DeleteVolume",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DetachVolume",
"ec2:DisableTransitGatewayRouteTablePropagation",
"ec2:DisassociateNatGatewayAddress",
"ec2:DisassociateRouteTable",
"ec2:DisassociateTransitGatewayRouteTable",
"ec2:EnableTransitGatewayRouteTablePropagation",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyLaunchTemplate",
"ec2:ModifySubnetAttribute",
"ec2:ModifyTransitGateway",
"ec2:ModifyTransitGatewayVpcAttachment",
"ec2:ModifyVolume",
"ec2:ModifyVpcAttribute",
"ec2:RejectTransitGatewayVpcAttachment",
"ec2:ReleaseAddress",
"ec2:ReplaceNetworkAclAssociation",
"ec2:ReplaceNetworkAclEntry",
"ec2:ReplaceRoute",
"ec2:ReplaceTransitGatewayRoute",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:SearchTransitGatewayRoutes",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource": [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-policy-table/*",
"arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
"arn:aws:ec2:*:*:network-insights-access-scope/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:network-insights-analysis/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "CreateTransitGatewaySLR",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway"
],
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "transitgateway.amazonaws.com"
}
}
},
{
"Sid": "AnalyzerENIResourceTag",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
}
]
},
"VersionId": "v7",
"IsDefaultVersion": true,
"CreateDate": "2026-09-15T13:17:07+00:00"
}
}Version History (8 recorded)
Raw historyv7updated
1 action added
Permissions management: iam:CreateServiceLinkedRole: iam:CreateServiceLinkedRole
v6updated
2 actions added
v5updated
scope changed, no action added or removed
v4updated
1 action added
AWSApplicationMigrationNetworkMigrationMultiAccount - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
05f548dAWSApplicationMigrationNetworkMigrationMultiAccount - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
ceade07AWSApplicationMigrationNetworkMigrationMultiAccount - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
7e81d8dAWSApplicationMigrationNetworkMigrationMultiAccount - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Nov 10, 2025
b67729f