AWSTransformServerMigrationAgentPolicy
Last Modified
Oct 11, 2026
October 11, 2026 at 09:02 AM UTC
Version
v3
Total Versions
3
Created
Oct 11, 2026
Actions
162
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can take over other users or roles
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- sts:AssumeRole: condition aws:ResourceOrgID, sts:ExternalId, on arn:aws:iam::*:role/AWSTransformRehostSharingRole_${aws:PrincipalAccount}
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition aws:CalledVia, aws:ResourceAccount, iam:PassedToService, on arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole, arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole, arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole
- ec2:RunInstances: condition aws:CalledVia, aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/ATWorkspace, aws:ResourceTag/CreatedBy, on arn:aws:ec2:*:*:instance/*, arn:aws:ec2:*:*:launch-template/*, arn:aws:ec2:*:*:security-group/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 4 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- ec2:ModifyInstanceAttribute: condition aws:CalledVia, aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/ATWorkspace, aws:ResourceTag/CreatedBy, on arn:aws:ec2:*:*:instance/*, arn:aws:ec2:*:*:launch-template/*, arn:aws:ec2:*:*:security-group/*
- ec2:StopInstances: condition aws:CalledVia, aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/ATWorkspace, aws:ResourceTag/CreatedBy, on arn:aws:ec2:*:*:instance/*, arn:aws:ec2:*:*:launch-template/*, arn:aws:ec2:*:*:security-group/*
- ec2:StartInstances: condition aws:CalledVia, aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/ATWorkspace, aws:ResourceTag/CreatedBy, on arn:aws:ec2:*:*:instance/*, arn:aws:ec2:*:*:launch-template/*, arn:aws:ec2:*:*:security-group/*
- ec2:CreateLaunchTemplateVersion: condition aws:RequestedRegion, aws:ResourceTag/AWSApplicationMigrationServiceManaged
- ec2:ModifyLaunchTemplate: condition aws:RequestedRegion, aws:ResourceTag/AWSApplicationMigrationServiceManaged
- ec2:CreateLaunchTemplateVersion: condition aws:RequestedRegion, aws:ResourceTag/AWSApplicationMigrationServiceManaged
- ec2:ModifyLaunchTemplate: condition aws:RequestedRegion, aws:ResourceTag/AWSApplicationMigrationServiceManaged
- ssm:SendCommand: condition aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/ATWorkspace, aws:ResourceTag/CreatedFor, on arn:aws:ssm:*:*:managed-instance/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (47)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 20888 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Suggestion / ALLOW_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE
Using the effect Allow with the condition key aws:ResourceTag/ATWorkspace and actions for services with the following prefixes does not affect the policy: mgn. The actions for the listed service are not allowed by this statement. We recommend that you move these actions to a different statement without this condition key. AWS docs
- Suggestion / ALLOW_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE
Using the effect Allow with the condition key aws:ResourceTag/CreatedBy and actions for services with the following prefixes does not affect the policy: mgn. The actions for the listed service are not allowed by this statement. We recommend that you move these actions to a different statement without this condition key. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Ec2LaunchTemplateOperationsWrite",
"Effect": "Allow",
"Action": [
"ec2:CreateLaunchTemplateVersion",
"ec2:ModifyLaunchTemplate"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2OperationsReadOnly",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeInstanceTypes",
"ec2:DescribeSecurityGroups",
"ec2:DescribeLaunchTemplateVersions"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2TagOnCreateServerMigration",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"ec2:CreateAction": [
"CreateLaunchTemplate",
"CreateSecurityGroup"
]
}
}
},
{
"Sid": "Ec2ViaMgnInstanceLifecycleOperationsWrite",
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:CreateSnapshot",
"ec2:DeleteLaunchTemplateVersions",
"ec2:DeleteVolume",
"ec2:DetachVolume",
"ec2:ModifyInstanceAttribute",
"ec2:RevokeSecurityGroupEgress",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "Ec2ViaMgnInstanceProvisionCreateWithRequestTag",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup",
"ec2:CreateSnapshot",
"ec2:CreateVolume",
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*::snapshot/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "Ec2ViaMgnLaunchOnSharedVpc",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup",
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceOrgID": "${aws:PrincipalOrgID}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedFor": "AWSTransform"
}
}
},
{
"Sid": "Ec2ViaMgnLaunchOnWorkspaceVpc",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup",
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedFor": "AWSTransform"
}
}
},
{
"Sid": "Ec2ViaMgnOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstances",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:GetSubnetCidrReservations",
"ec2:DescribeVolumes",
"ec2:GetEbsEncryptionByDefault",
"ec2:GetEbsDefaultKmsKeyId"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2ViaMgnRunInstancesOnAmsSubnet",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
}
}
},
{
"Sid": "Ec2ViaMgnRunInstancesOnImage",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": "arn:aws:ec2:*::image/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "Ec2ViaMgnRunInstancesOnSg",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "Ec2ViaMgnSecurityGroupCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"Null": {
"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "Ec2ViaMgnTagOnCreateSecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"Null": {
"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"ec2:CreateAction": "CreateSecurityGroup"
}
}
},
{
"Sid": "Ec2ViaMgnTagOnCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*::snapshot/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"ec2:CreateAction": [
"CreateSecurityGroup",
"CreateSnapshot",
"CreateVolume",
"RunInstances"
]
}
}
},
{
"Sid": "Ec2ViaMgnVolumeFromSnapshotCreate",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform",
"ec2:Owner": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "FsxOperationsReadOnly",
"Effect": "Allow",
"Action": [
"fsx:DescribeFileSystems",
"fsx:DescribeStorageVirtualMachines"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "FsxViaMgnDescribeOperations",
"Effect": "Allow",
"Action": [
"fsx:DescribeVolumes",
"fsx:DescribeSnapshots"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "FsxViaMgnCreateVolume",
"Effect": "Allow",
"Action": "fsx:CreateVolume",
"Resource": [
"arn:aws:fsx:*:*:volume/*/*",
"arn:aws:fsx:*:*:storage-virtual-machine/*/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"Null": {
"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "FsxViaMgnDeleteVolumeAndTag",
"Effect": "Allow",
"Action": [
"fsx:DeleteVolume",
"fsx:TagResource"
],
"Resource": "arn:aws:fsx:*:*:volume/*/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"Null": {
"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "FsxViaMgnCreateSnapshot",
"Effect": "Allow",
"Action": "fsx:CreateSnapshot",
"Resource": [
"arn:aws:fsx:*:*:snapshot/*/*",
"arn:aws:fsx:*:*:volume/*/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"Null": {
"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IamViaMgnEc2PassRole",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole",
"arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole",
"arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"iam:PassedToService": "ec2.amazonaws.com"
}
}
},
{
"Sid": "KmsS3EncryptionOperationsServerMigration",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:DescribeKey",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
"Condition": {
"StringLike": {
"kms:ViaService": "s3.*.amazonaws.com"
}
}
},
{
"Sid": "MgnAccountSettingsOperations",
"Effect": "Allow",
"Action": [
"mgn:GetAccountSettings",
"mgn:RegisterAgentForMgn",
"mgn:UpdateAccountSettings"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "MgnAppWaveCreate",
"Effect": "Allow",
"Action": [
"mgn:CreateApplication",
"mgn:CreateWave"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "MgnAppWaveServerTagOperationsWrite",
"Effect": "Allow",
"Action": [
"mgn:TagResource"
],
"Resource": [
"arn:aws:mgn:*:*:application/*",
"arn:aws:mgn:*:*:source-server/*",
"arn:aws:mgn:*:*:wave/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "MgnImportExportOperationWrite",
"Effect": "Allow",
"Action": [
"mgn:StartExport",
"mgn:StartImport",
"mgn:StartImportFileEnrichment"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "MgnImportExportTagOperationsWrite",
"Effect": "Allow",
"Action": [
"mgn:TagResource"
],
"Resource": [
"arn:aws:mgn:*:*:export/*",
"arn:aws:mgn:*:*:import/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"mgn:CreateAction": [
"StartExport",
"StartImport"
]
}
}
},
{
"Sid": "MgnJobAndErrorOperationsReadOnly",
"Effect": "Allow",
"Action": [
"mgn:DescribeJobLogItems",
"mgn:ListExportErrors",
"mgn:ListImportErrors"
],
"Resource": [
"arn:aws:mgn:*:*:export/*",
"arn:aws:mgn:*:*:import/*",
"arn:aws:mgn:*:*:job/*"
],
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "MgnJobTagOperationsWrite",
"Effect": "Allow",
"Action": [
"mgn:TagResource"
],
"Resource": "arn:aws:mgn:*:*:job/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform",
"mgn:CreateAction": [
"StartCutover",
"StartTest",
"TerminateTargetInstances"
]
}
}
},
{
"Sid": "MgnSourceServerLifecycleOperations",
"Effect": "Allow",
"Action": [
"mgn:ChangeServerLifecycleState",
"mgn:FinalizeCutover",
"mgn:GetReplicationConfiguration",
"mgn:ListSourceServerActions",
"mgn:ListTagsForResource",
"mgn:MarkAsArchived",
"mgn:PauseReplication",
"mgn:PutSourceServerAction",
"mgn:RemoveSourceServerAction",
"mgn:ResumeReplication",
"mgn:StartCutover",
"mgn:StartReplication",
"mgn:StartTest",
"mgn:StopReplication",
"mgn:UpdateReplicationConfiguration",
"mgn:UpdateSourceServer"
],
"Resource": "arn:aws:mgn:*:*:source-server/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "OrganizationsOperationsReadOnlyServerMigration",
"Effect": "Allow",
"Action": [
"organizations:ListAccounts"
],
"Resource": "*"
},
{
"Sid": "PostLaunchAutomationMonitoring",
"Effect": "Allow",
"Action": [
"ssm:GetAutomationExecution"
],
"Resource": "arn:aws:ssm:*:*:automation-execution/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3AgentSignatureOperationsReadOnly",
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::aws-application-migration-service-*/latest/source-automation-client/linux/ssaf-client/ssaf_client.sig"
},
{
"Sid": "S3TargetBucketOperationsServerMigration",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:GetBucketLocation",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:ListBucket",
"s3:PutBucketTagging",
"s3:PutEncryptionConfiguration"
],
"Resource": "arn:aws:s3:::transform-vmware-target-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3TargetObjectOperationsServerMigration",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:GetObjectAttributes",
"s3:GetObjectVersion",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::transform-vmware-target-*/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SecretsManagerOperationsReadOnly",
"Effect": "Allow",
"Action": [
"secretsmanager:ListSecrets"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "ServerMigrationOperationsReadOnly",
"Effect": "Allow",
"Action": [
"mgn:DescribeJobs",
"mgn:DescribeLaunchConfigurationTemplates",
"mgn:DescribeReplicationConfigurationTemplates",
"mgn:DescribeReplicationServerAssociationsForMgn",
"mgn:DescribeSourceServers",
"mgn:DescribeVcenterClients",
"mgn:GetLaunchConfiguration",
"mgn:ListApplications",
"mgn:ListConnectors",
"mgn:ListExports",
"mgn:ListImportFileEnrichments",
"mgn:ListImports",
"mgn:ListTemplateActions",
"mgn:ListWaves"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "ServerMigrationOperationsWrite",
"Effect": "Allow",
"Action": [
"mgn:AssociateApplications",
"mgn:AssociateSourceServers",
"mgn:DeleteApplication",
"mgn:DeleteWave",
"mgn:DisassociateApplications",
"mgn:DisassociateSourceServers",
"mgn:TerminateTargetInstances",
"mgn:UpdateApplication",
"mgn:UpdateLaunchConfiguration",
"mgn:UpdateWave"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "ServerMigrationTemplateOperationsWrite",
"Effect": "Allow",
"Action": [
"mgn:PutTemplateAction",
"mgn:RemoveTemplateAction",
"mgn:UpdateLaunchConfigurationTemplate",
"mgn:UpdateReplicationConfigurationTemplate"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ServiceQuotasViaMgnOperationsReadOnly",
"Effect": "Allow",
"Action": [
"servicequotas:GetServiceQuota"
],
"Resource": "arn:aws:servicequotas:*:*:vpc/L-2AFB9258",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SsmAgentCommandOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ssm:DescribeInstanceInformation",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:ListCommands"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "SsmAgentCommandOperationsWrite",
"Effect": "Allow",
"Action": [
"ssm:SendCommand"
],
"Resource": "arn:aws:ssm:*:*:managed-instance/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedFor": "AWSTransform"
}
}
},
{
"Sid": "SsmDocumentListOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ssm:ListDocuments"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "SsmDocumentOnAwsManagedOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ssm:DescribeDocument",
"ssm:GetDocument",
"ssm:ListDocumentVersions"
],
"Resource": "arn:aws:ssm:*::document/AWS*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "SsmDocumentOperationsReadOnly",
"Effect": "Allow",
"Action": [
"ssm:DescribeDocument",
"ssm:GetDocument",
"ssm:ListDocumentVersions"
],
"Resource": "arn:aws:ssm:*:*:document/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SsmMigrationDocumentOperations",
"Effect": "Allow",
"Action": [
"ssm:GetDocument",
"ssm:SendCommand"
],
"Resource": "arn:aws:ssm:*::document/AWSMigration-RunSourceServerAction",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "SsmParameterServerMigrationOperationsWrite",
"Effect": "Allow",
"Action": [
"ssm:DeleteParameters",
"ssm:GetParameter",
"ssm:GetParameters",
"ssm:PutParameter"
],
"Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SsmViaMgnPostLaunchCommandAndAutomation",
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartAutomationExecution"
],
"Resource": [
"arn:aws:ssm:*:*:automation-definition/*:*",
"arn:aws:ssm:*:*:automation-execution/*",
"arn:aws:ssm:*:*:document/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SsmViaMgnPostLaunchCommandAndAutomationOnAwsManaged",
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartAutomationExecution"
],
"Resource": [
"arn:aws:ssm:*::automation-definition/AWS*:*",
"arn:aws:ssm:*::document/AWS*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "SsmViaMgnPostLaunchSendCommandToInstances",
"Effect": "Allow",
"Action": [
"ssm:SendCommand"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"Null": {
"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
},
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "StsCrossAccountAssumeRole",
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": "arn:aws:iam::*:role/AWSTransformRehostSharingRole_${aws:PrincipalAccount}",
"Condition": {
"StringEquals": {
"aws:ResourceOrgID": "${aws:PrincipalOrgID}",
"sts:ExternalId": "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
}
}
},
{
"Sid": "StsCrossAccountAssumeRoleViaMgn",
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": "arn:aws:iam::*:role/AWSTransformRehostSharingRole_${aws:PrincipalAccount}",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"mgn.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceOrgID": "${aws:PrincipalOrgID}",
"sts:ExternalId": "${aws:PrincipalAccount}:AWSTransform"
}
}
}
]
},
"VersionId": "v3",
"IsDefaultVersion": true,
"CreateDate": "2026-10-11T08:47:08+00:00"
}
}Version History (3 recorded)
Raw historyscope changed, no action added or removed
10 actions added
125 actions added