AWSTransformNetworkMigrationAgentPolicy
Last Modified
Oct 29, 2026
October 29, 2026 at 11:04 AM UTC
Version
v3
Total Versions
3
Created
Oct 29, 2026
Actions
301
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can grant itself more permissions
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:AttachRolePolicy: condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/CreatedBy, iam:PolicyARN, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over other users or roles
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:AttachRolePolicy: condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/CreatedBy, iam:PolicyARN, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
- sts:AssumeRole: condition aws:ResourceOrgID, sts:ExternalId, on arn:aws:iam::*:role/AWSTransformNetworkMigrationAgentSharingRole_${aws:PrincipalAccount}
- sts:AssumeRole: condition aws:ResourceOrgID, sts:ExternalId, on arn:aws:iam::*:role/AWSTransformNetworkMigrationAgentSharingRole_${aws:PrincipalAccount}
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition aws:CalledVia, aws:ResourceAccount, iam:PassedToService, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
- cloudformation:CreateStack: condition aws:RequestTag/CreatedBy, aws:RequestedRegion, aws:ResourceAccount, on arn:aws:cloudformation:*:*:stack/Nmd*
- iam:PassRole: condition aws:CalledVia, aws:ResourceAccount, iam:PassedToService, on arn:aws:iam::*:role/Nmd*modifyTransitGateway*
- lambda:CreateFunction: condition aws:CalledVia, aws:RequestTag/CreatedBy, aws:RequestedRegion, aws:ResourceAccount, on arn:aws:lambda:*:*:function:network-migration*
- lambda:InvokeFunction: condition aws:CalledVia, aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/CreatedBy, on arn:aws:lambda:*:*:function:network-migration*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:UpdateStack: condition aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/CreatedBy, on arn:aws:cloudformation:*:*:stack/Nmd*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (47)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 29354 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CfnNetworkMigrationStackCreate",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack"
],
"Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CfnNetworkMigrationStackDescribeStacks",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStacks"
],
"Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CfnNetworkMigrationStackListStacks",
"Effect": "Allow",
"Action": [
"cloudformation:ListStacks"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "CfnNetworkMigrationStackOperationsWrite",
"Effect": "Allow",
"Action": [
"cloudformation:DeleteStack",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplateSummary",
"cloudformation:ListStackResources",
"cloudformation:UpdateStack",
"cloudformation:UpdateTerminationProtection"
],
"Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "Ec2NetworkProvisionCreate",
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress",
"ec2:CreateInternetGateway",
"ec2:CreateTransitGateway",
"ec2:CreateVpc"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2NetworkTopologyOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:GetSubnetCidrReservations"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2TagOnCreateNetworkMigration",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
"arn:aws:ec2:*:*:network-insights-access-scope/*",
"arn:aws:ec2:*:*:network-insights-analysis/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:security-group-rule/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
"arn:aws:ec2:*:*:transit-gateway-policy-table/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"ec2:CreateAction": [
"AllocateAddress",
"CreateInternetGateway",
"CreateNatGateway",
"CreateNetworkInsightsAccessScope",
"CreateNetworkInsightsPath",
"CreateNetworkInterface",
"CreateRouteTable",
"CreateSecurityGroup",
"CreateSubnet",
"CreateTransitGateway",
"CreateTransitGatewayConnect",
"CreateTransitGatewayConnectPeer",
"CreateTransitGatewayPeeringAttachment",
"CreateTransitGatewayPolicyTable",
"CreateTransitGatewayPrefixListReference",
"CreateTransitGatewayRoute",
"CreateTransitGatewayRouteTable",
"CreateTransitGatewayRouteTableAnnouncement",
"CreateTransitGatewayVpcAttachment",
"CreateVpc",
"StartNetworkInsightsAnalysis"
]
}
}
},
{
"Sid": "Ec2ViaCfnCrossOrgTgwAttachmentCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceOrgID": "${aws:PrincipalOrgID}"
}
}
},
{
"Sid": "Ec2ViaCfnNetworkOperationsWrite",
"Effect": "Allow",
"Action": [
"ec2:AcceptTransitGatewayVpcAttachment",
"ec2:AssociateNatGatewayAddress",
"ec2:AssociateRouteTable",
"ec2:AssociateSubnetCidrBlock",
"ec2:AssociateTransitGatewayRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteInternetGateway",
"ec2:DeleteLaunchTemplate",
"ec2:DeleteLaunchTemplateVersions",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkInsightsAnalysis",
"ec2:DeleteNetworkInsightsPath",
"ec2:DeleteNetworkInterface",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSubnet",
"ec2:DeleteTransitGateway",
"ec2:DeleteTransitGatewayRoute",
"ec2:DeleteTransitGatewayRouteTable",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DisableTransitGatewayRouteTablePropagation",
"ec2:DisassociateNatGatewayAddress",
"ec2:DisassociateRouteTable",
"ec2:DisassociateTransitGatewayRouteTable",
"ec2:EnableTransitGatewayRouteTablePropagation",
"ec2:ModifySubnetAttribute",
"ec2:ModifyTransitGateway",
"ec2:ModifyTransitGatewayVpcAttachment",
"ec2:ModifyVpcAttribute",
"ec2:RejectTransitGatewayVpcAttachment",
"ec2:ReleaseAddress",
"ec2:ReplaceRoute",
"ec2:ReplaceTransitGatewayRoute",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:SearchTransitGatewayRoutes",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "Ec2ViaCfnNetworkProvisionCreateWithRequestTag",
"Effect": "Allow",
"Action": [
"ec2:CreateNatGateway",
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2ViaCfnNetworkProvisionCreateWithResourceTag",
"Effect": "Allow",
"Action": [
"ec2:CreateNatGateway",
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"ec2:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "Ec2ViaCfnOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCustomerGateways",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePrefixLists",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetManagedPrefixListEntries",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2ViaCfnSecurityGroupCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2ViaCfnSecurityGroupTagCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group-rule/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IamTgwServiceLinkedRoleCreate",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"StringLike": {
"iam:AWSServiceName": "transitgateway.amazonaws.com"
}
}
},
{
"Sid": "IamViaCfnTgwLambdaRoleCleanupOperations",
"Effect": "Allow",
"Action": [
"iam:DeleteRole",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "IamViaCfnTgwLambdaRoleCreate",
"Effect": "Allow",
"Action": [
"iam:CreateRole"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IamViaCfnTgwLambdaRoleOperationsReadOnly",
"Effect": "Allow",
"Action": [
"iam:GetRole"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IamViaCfnTgwLambdaRolePassRole",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"iam:PassedToService": "lambda.amazonaws.com"
}
}
},
{
"Sid": "IamViaCfnTgwLambdaRolePolicyAttach",
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ArnEquals": {
"iam:PolicyARN": [
"arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationCustomResource",
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "IamViaCfnTgwLambdaRoleTag",
"Effect": "Allow",
"Action": [
"iam:TagRole"
],
"Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "KmsS3EncryptionOperationsNetworkMigration",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
"Condition": {
"StringLike": {
"kms:ViaService": "s3.*.amazonaws.com"
}
}
},
{
"Sid": "LambdaViaCfnNetworkMigrationFunctionCreate",
"Effect": "Allow",
"Action": [
"lambda:CreateFunction"
],
"Resource": "arn:aws:lambda:*:*:function:network-migration*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "LambdaViaCfnNetworkMigrationFunctionOperations",
"Effect": "Allow",
"Action": [
"lambda:DeleteFunction",
"lambda:GetFunctionCodeSigningConfig",
"lambda:GetFunctionConfiguration",
"lambda:GetFunctionRecursionConfig",
"lambda:GetRuntimeManagementConfig",
"lambda:InvokeFunction"
],
"Resource": "arn:aws:lambda:*:*:function:network-migration*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "LambdaViaCfnNetworkMigrationFunctionReadOnly",
"Effect": "Allow",
"Action": [
"lambda:GetFunction",
"lambda:ListTags"
],
"Resource": "arn:aws:lambda:*:*:function:network-migration*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "LambdaViaCfnNetworkMigrationFunctionTag",
"Effect": "Allow",
"Action": [
"lambda:TagResource"
],
"Resource": "arn:aws:lambda:*:*:function:network-migration*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "LogsViaCfnNetworkMigrationOperationsWrite",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/network-migration*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "MgnNetworkMigrationDefinitionCreate",
"Effect": "Allow",
"Action": [
"mgn:CreateNetworkMigrationDefinition"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "MgnNetworkMigrationDefinitionDelete",
"Effect": "Allow",
"Action": [
"mgn:DeleteNetworkMigrationDefinition"
],
"Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": [
"AWSTransform",
"QTransform"
]
}
}
},
{
"Sid": "MgnNetworkMigrationDefinitionOperations",
"Effect": "Allow",
"Action": [
"mgn:GetNetworkMigrationDefinition",
"mgn:ListNetworkMigrationMappingUpdates",
"mgn:StartNetworkMigrationMappingUpdate",
"mgn:UpdateNetworkMigrationDefinition",
"mgn:UpdateNetworkMigrationMapperSegment",
"mgn:UpdateNetworkMigrationMapperSegmentConstruct"
],
"Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "MgnNetworkMigrationDefinitionTagOperationsWrite",
"Effect": "Allow",
"Action": [
"mgn:TagResource"
],
"Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSTransform",
"mgn:CreateAction": "CreateNetworkMigrationDefinition"
}
}
},
{
"Sid": "NetworkMigrationOperationsReadOnly",
"Effect": "Allow",
"Action": [
"mgn:ListNetworkMigrationAnalyses",
"mgn:ListNetworkMigrationAnalysisResults",
"mgn:ListNetworkMigrationCodeGenerationSegments",
"mgn:ListNetworkMigrationCodeGenerations",
"mgn:ListNetworkMigrationDefinitions",
"mgn:ListNetworkMigrationDeployedStacks",
"mgn:ListNetworkMigrationDeployedStacksDeletions",
"mgn:ListNetworkMigrationDeployments",
"mgn:ListNetworkMigrationExecutions",
"mgn:ListNetworkMigrationMapperSegmentConstructs",
"mgn:ListNetworkMigrationMapperSegments",
"mgn:ListNetworkMigrationExecutionArtifacts",
"mgn:ListNetworkMigrationMappings"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "NetworkMigrationOperationsWrite",
"Effect": "Allow",
"Action": [
"mgn:StartNetworkMigrationAnalysis",
"mgn:StartNetworkMigrationCodeGeneration",
"mgn:StartNetworkMigrationDeployedStacksDeletion",
"mgn:StartNetworkMigrationDeployment",
"mgn:StartNetworkMigrationMapping"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "OrganizationsOperationsReadOnlyNetworkMigration",
"Effect": "Allow",
"Action": [
"organizations:ListAccounts"
],
"Resource": "*"
},
{
"Sid": "RamShareCrossAccountOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ram:GetResourceShares"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "RamViaCfnShareAssociateOperationsWrite",
"Effect": "Allow",
"Action": [
"ram:AssociateResourceShare"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService",
"ram:RequestedResourceType": [
"ec2:TransitGateway",
"ssm:Parameter"
]
}
}
},
{
"Sid": "RamViaCfnShareCreate",
"Effect": "Allow",
"Action": [
"ram:CreateResourceShare"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"Bool": {
"ram:RequestedAllowsExternalPrincipals": "false"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "RamViaCfnShareOperations",
"Effect": "Allow",
"Action": [
"ram:DeleteResourceShare",
"ram:DisassociateResourceShare",
"ram:UpdateResourceShare"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "RamViaCfnShareTagOperationsWrite",
"Effect": "Allow",
"Action": [
"ram:TagResource"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "ReachabilityAnalyzerAnalysisStart",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource": "arn:aws:ec2:*:*:network-insights-analysis/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ReachabilityAnalyzerCleanupOperationsWrite",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteNetworkInsightsAnalysis",
"ec2:DeleteNetworkInsightsPath",
"ec2:DeleteNetworkInterface",
"ec2:DeleteSecurityGroup"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "ReachabilityAnalyzerCreateWithRequestTag",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "ReachabilityAnalyzerCreateWithResourceTag",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface",
"ec2:CreateSecurityGroup",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "ReachabilityAnalyzerCrossOrgPathCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInsightsPath"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceOrgID": "${aws:PrincipalOrgID}"
}
}
},
{
"Sid": "ReachabilityAnalyzerOperationsReadOnly",
"Effect": "Allow",
"Action": [
"directconnect:DescribeConnections",
"directconnect:DescribeDirectConnectGatewayAssociations",
"directconnect:DescribeDirectConnectGatewayAttachments",
"directconnect:DescribeDirectConnectGateways",
"directconnect:DescribeVirtualGateways",
"directconnect:DescribeVirtualInterfaces",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCustomerGateways",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePrefixLists",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetManagedPrefixListEntries",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:SearchTransitGatewayRoutes",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"globalaccelerator:ListAccelerators",
"globalaccelerator:ListCustomRoutingAccelerators",
"globalaccelerator:ListCustomRoutingEndpointGroups",
"globalaccelerator:ListCustomRoutingListeners",
"globalaccelerator:ListCustomRoutingPortMappings",
"globalaccelerator:ListEndpointGroups",
"globalaccelerator:ListListeners",
"network-firewall:DescribeFirewall",
"network-firewall:DescribeFirewallPolicy",
"network-firewall:DescribeResourcePolicy",
"network-firewall:DescribeRuleGroup",
"network-firewall:ListFirewallPolicies",
"network-firewall:ListFirewalls",
"network-firewall:ListRuleGroups",
"tiros:CreateQuery",
"tiros:ExtendQuery",
"tiros:GetQueryAnswer",
"tiros:GetQueryExplanation",
"tiros:GetQueryExtensionAccounts"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "ReachabilityAnalyzerProbeCreateOnSecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ReachabilityAnalyzerSecurityGroupCreateOnVpc",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": "arn:aws:ec2:*:*:vpc/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "ReachabilityAnalyzerSecurityGroupCreateWithRequestTag",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group-rule/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3TargetBucketOperationsNetworkMigration",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:GetBucketLocation",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:ListBucket",
"s3:PutBucketTagging",
"s3:PutEncryptionConfiguration"
],
"Resource": "arn:aws:s3:::transform-vmware-target-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3TargetObjectOperationsNetworkMigration",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:GetObjectAttributes",
"s3:GetObjectVersion",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::transform-vmware-target-*/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SsmParametersViaCfnOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ssm:GetParameters"
],
"Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "SsmParametersViaCfnOperationsWriteWithRequestTag",
"Effect": "Allow",
"Action": [
"ssm:AddTagsToResource",
"ssm:PutParameter"
],
"Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "SsmParametersViaCfnOperationsWriteWithResourceTag",
"Effect": "Allow",
"Action": [
"ssm:DeleteParameter",
"ssm:DeleteResourcePolicy",
"ssm:ListTagsForResource"
],
"Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "SsmParametersViaCfnRamSharingOperations",
"Effect": "Allow",
"Action": [
"ssm:GetResourcePolicies",
"ssm:PutResourcePolicy"
],
"Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "StsCrossAccountAssumeRoleNetworkMigration",
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": "arn:aws:iam::*:role/AWSTransformNetworkMigrationAgentSharingRole_${aws:PrincipalAccount}",
"Condition": {
"StringEquals": {
"aws:ResourceOrgID": "${aws:PrincipalOrgID}",
"sts:ExternalId": "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
}
}
},
{
"Sid": "WellArchitectedAgentProfileListReadOnly",
"Effect": "Allow",
"Action": [
"wellarchitected:ListAgentProfiles"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "WellArchitectedAgentProfileOperationsWithResourceTag",
"Effect": "Allow",
"Action": [
"wellarchitected:CreateAgentContext",
"wellarchitected:CreateAgentGoal",
"wellarchitected:GetAgentProfile",
"wellarchitected:GetAgentRecommendationGeneration",
"wellarchitected:ListAgentContexts",
"wellarchitected:ListAgentGoals",
"wellarchitected:ListAgentRecommendations",
"wellarchitected:StartAgentRecommendationGeneration",
"wellarchitected:UpdateAgentContext",
"wellarchitected:UpdateAgentGoal",
"wellarchitected:UpdateAgentProfile"
],
"Resource": "arn:aws:wellarchitected:*:*:agent-profile/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/AWSTransformNetworkMigration": "enabled"
}
}
},
{
"Sid": "WellArchitectedAgentRecommendationReadOnly",
"Effect": "Allow",
"Action": [
"wellarchitected:GetAgentRecommendation"
],
"Resource": "arn:aws:wellarchitected:*:*:agent-recommendation/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v3",
"IsDefaultVersion": true,
"CreateDate": "2026-10-29T10:17:08+00:00"
}
}Version History (3 recorded)
Raw historyv3updated
13 actions added
v2updated
2 actions added
1 never-before-seen action: mgn:ListNetworkMigrationExecutionArtifacts
v1new policy
221 actions added
25 never-before-seen actions: mgn:CreateNetworkMigrationDefinition, mgn:DeleteNetworkMigrationDefinition, mgn:GetNetworkMigrationDefinition, mgn:ListNetworkMigrationAnalyses, mgn:ListNetworkMigrationAnalysisResults, mgn:ListNetworkMigrationCodeGenerationSegments, mgn:ListNetworkMigrationCodeGenerations, mgn:ListNetworkMigrationDefinitions, mgn:ListNetworkMigrationDeployedStacks, mgn:ListNetworkMigrationDeployedStacksDeletions, mgn:ListNetworkMigrationDeployments, mgn:ListNetworkMigrationExecutions, mgn:ListNetworkMigrationMapperSegmentConstructs, mgn:ListNetworkMigrationMapperSegments, mgn:ListNetworkMigrationMappingUpdates, mgn:ListNetworkMigrationMappings, mgn:StartNetworkMigrationAnalysis, mgn:StartNetworkMigrationCodeGeneration, mgn:StartNetworkMigrationDeployedStacksDeletion, mgn:StartNetworkMigrationDeployment, mgn:StartNetworkMigrationMapping, mgn:StartNetworkMigrationMappingUpdate, mgn:UpdateNetworkMigrationDefinition, mgn:UpdateNetworkMigrationMapperSegment, mgn:UpdateNetworkMigrationMapperSegmentConstruct
14 permissions management, incl. iam:AttachRolePolicy: iam:AttachRolePolicy, iam:CreateRole, iam:CreateServiceLinkedRole, iam:DeleteRole, iam:DeleteRolePolicy, iam:DetachRolePolicy, iam:PassRole, ram:AssociateResourceShare, ram:CreateResourceShare, ram:DeleteResourceShare, ram:DisassociateResourceShare, ram:UpdateResourceShare, ssm:DeleteResourcePolicy, ssm:PutResourcePolicy