NEW - You can now accelerate your migration and modernization with AWS Transform. Read [Getting Started](https://docs.aws.amazon.com/transform/latest/userguide/getting-started.html) in the *AWS Transform User Guide*. # Security in AWS Application Migration Service Security **Topics** + [ ## Overview ](#security-overview) + [ # Identity and access management for AWS Application Migration Service ](identity-access-management.md) + [ # Managing access using policies ](security_iam_access-manage.md) + [ # Using service-linked roles for AWS Application Migration Service ](using-service-linked-roles.md) + [ ## Policy structure ](#iam-policy-structure) + [ # Resilience in AWS Application Migration Service ](disaster-recovery-resiliency.md) + [ # Infrastructure security in AWS Application Migration Service ](infrastructure-security.md) + [ # Compliance validation for AWS Application Migration Service ](compliance-validation.md) + [ # Cross-service confused deputy prevention ](cross-service-confused-deputy-prevention.md) ## Overview Cloud security at AWS is the highest priority. As an AWS customer, you benefit from a data center and network architecture that is built to meet the requirements of the most security-sensitive organizations. Security is a shared responsibility between AWS and you. The [shared responsibility model ](https://aws.amazon.com/compliance/shared-responsibility-model/) describes this as security of the cloud and security in the cloud: + **Security of the cloud** – AWS is responsible for protecting the infrastructure that runs AWS services in the AWS Cloud. AWS also provides you with services that you can use securely. Third-party auditors regularly test and verify the effectiveness of our security as part of the [AWS Compliance Programs](https://aws.amazon.com/compliance/programs/) . To learn about the compliance programs that apply to AWS Application Migration Service (AWS MGN), see [AWS Services in Scope by Compliance Program](https://aws.amazon.com/compliance/services-in-scope/). . + **Security in the cloud** – Your responsibility is determined by the AWS service that you use. You are also responsible for other factors including the sensitivity of your data, your company’s requirements, and applicable laws and regulations This documentation helps you understand how to apply the shared responsibility model when using AWS Application Migration Service. It shows you how to configure AWS Application Migration Service to meet your security and compliance objectives. You also learn how to use other AWS services that help you to monitor and secure your AWS Application Migration Service resources. The customer is responsible for making sure that no misconfigurations are present during and after the migration process, including: 1. Access to replication servers should be allowed only from source servers CIDR range by applying proper security groups rules on replication servers. 1. After the migration, the customer should make sure that only allowed ports are exposed to the public internet. 1. Hardening of OS packages and other software deployed in the servers is completely under the customer’s responsibility and we recommend the following: 1. Packages should be up to date and free of known vulnerabilities. 1. Only necessary OS/application services should be up and running. 1. Enabling the Anti-DDOS protection (AWS Shield) in the customer's AWS Account to eliminate the risk of denial of service attacks on the replication servers as well as the migrated servers. # Identity and access management for AWS Application Migration Service Identity and access management AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use AWS resources. IAM enables you to create users and groups under your AWS account. You control the permissions that users have to perform tasks using AWS resources. You can use IAM for no additional charge. By default, users created via the IAM service don't have permissions for AWS Application Migration Service (AWS MGN) resources and operations. To allow these users to manage AWS Application Migration Service resources, you must create an IAM policy that explicitly grants them permissions, and attach the policy to the users or groups that require those permissions. When you attach a policy to a user or group of users, it allows or denies the users permission to perform the specified tasks on the specified resources. For more information, see [Policies and Permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *IAM User Guide* guide. ## Federated identity As a best practice, require human users to use federation with an identity provider to access AWS services using temporary credentials. A *federated identity* is a user from your enterprise directory, web identity provider, or Directory Service that accesses AWS services using credentials from an identity source. Federated identities assume roles that provide temporary credentials. For centralized access management, we recommend AWS IAM Identity Center. For more information, see [What is IAM Identity Center?](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) in the *AWS IAM Identity Center User Guide*. # Authenticating with identities in AWS Application Migration Service Authenticating with identities Authentication is how you sign in to AWS using your identity credentials. You must be authenticated as the AWS account root user, an IAM user, or by assuming an IAM role. You can sign in as a federated identity using credentials from an identity source like AWS IAM Identity Center (IAM Identity Center), single sign-on authentication, or Google/Facebook credentials. For more information about signing in, see [How to sign in to your AWS account](https://docs.aws.amazon.com/signin/latest/userguide/how-to-sign-in.html) in the *AWS Sign-In User Guide*. For programmatic access, AWS provides an SDK and CLI to cryptographically sign requests. For more information, see [AWS Signature Version 4 for API requests](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html) in the *IAM User Guide*. ## AWS account root user When you create an AWS account, you begin with one sign-in identity called the AWS account *root user* that has complete access to all AWS services and resources. We strongly recommend that you don't use the root user for everyday tasks. For tasks that require root user credentials, see [Tasks that require root user credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks) in the *IAM User Guide*. ## IAM users and groups An *[IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html)* is an identity with specific permissions for a single person or application. We recommend using temporary credentials instead of IAM users with long-term credentials. For more information, see [Require human users to use federation with an identity provider to access AWS using temporary credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-users-federation-idp) in the *IAM User Guide*. An [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) specifies a collection of IAM users and makes permissions easier to manage for large sets of users. For more information, see [Use cases for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/gs-identities-iam-users.html) in the *IAM User Guide*. ## IAM roles An *[IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)* is an identity with specific permissions that provides temporary credentials. You can assume a role by [switching from a user to an IAM role (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html) or by calling an AWS CLI or AWS API operation. For more information, see [Methods to assume a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage-assume.html) in the *IAM User Guide*. IAM roles are useful for federated user access, temporary IAM user permissions, cross-account access, cross-service access, and applications running on Amazon EC2. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*. # Grant permission to tag resources during creation Grant permission to tag resources during creation Some resource-creating Amazon MGN API actions enable you to specify tags when you create the resource. You can use resource tags to implement attribute-based control (ABAC). To enable users to tag resources on creation, they must have permissions to use the action that creates the resource, such as `mgn:RegisterAgentForMgn`. If tags are specified in the resource-creating action, Amazon performs additional authorization on the `mgn:TagResource` action to verify if users have permissions to create tags. Therefore, users must also have explicit permissions to use the `mgn:TagResource` action. In the IAM policy definition for the `mgn:TagResource` action, use the Condition element with the `mgn:CreateAction` condition key to give tagging permissions to the action that creates the resource. The following example demonstrates a policy that allows an agent installer to create a source server and apply any tags to the source server on creation. The installer is not permitted to tag any existing resources (it cannot call the `mgn:TagResource` action directly). ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mgn:SendAgentMetricsForMgn", "mgn:SendAgentLogsForMgn", "mgn:SendClientMetricsForMgn", "mgn:SendClientLogsForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mgn:RegisterAgentForMgn", "mgn:UpdateAgentSourcePropertiesForMgn", "mgn:UpdateAgentReplicationInfoForMgn", "mgn:UpdateAgentConversionInfoForMgn", "mgn:GetAgentInstallationAssetsForMgn", "mgn:GetAgentCommandForMgn", "mgn:GetAgentConfirmedResumeInfoForMgn", "mgn:GetAgentRuntimeConfigurationForMgn", "mgn:UpdateAgentBacklogForMgn", "mgn:GetAgentReplicationInfoForMgn" ], "Resource": "*" }, { "Effect": "Allow", "Action": "mgn:TagResource", "Resource": "arn:aws:mgn:*:*:source-server/*", "Condition": { "StringEquals": { "mgn:CreateAction": "RegisterAgentForMgn" } } } ] } ``` ------ The `mgn:TagResource` action is only evaluated if tags are applied during the resource-creating action. Therefore, an installer that has permissions to create a resource (assuming there are no tagging conditions) does not require permissions to use the ` mgn:TagResource ` action if no tags are specified in the request. However, if the installer attempts to create a resource with tags, the request fails if the installer does not have permissions to use the `mgn:TagResource` action. # AWS managed policies for AWS Application Migration Service AWS managed policies An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles. Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining [ customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#customer-managed-policies) that are specific to your use cases. You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) in the *IAM User Guide*. ## AWS MGN updates for AWS managed policies Updates View details about updates to AWS managed policies for AWS Application Migration Service since March 1, 2021. | Change | Description | Date | | --- | --- | --- | | [AWSApplicationMigrationNetworkMigrationMultiAccount](security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationMultiAccount.md#security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationMultiAccount.title) – New policy | Created new managed policy to provide permissions to automate VMware to AWS network infrastructure migration through CloudFormation. | November 10, 2025 | | [AWSApplicationMigrationNetworkMigrationCustomResource](security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationCustomResource.md#security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationCustomResource.title) – New policy | AWS MGN added a new policy that provides permissions for Network Migration custom resource. This identity-based policy allows modification of Transit Gateway resources that were specifically created by Application Migration Service. | December 2, 2025 | | Updated the [AWSApplicationMigrationSSMAccess ](security-iam-awsmanpol-AWSApplicationMigrationSSMAccess.md#security-iam-awsmanpol-AWSApplicationMigrationSSMAccess.title) and [AWSApplicationMigrationFullAccess ](security-iam-awsmanpol-AWSApplicationMigrationFullAccess.md#security-iam-awsmanpol-AWSApplicationMigrationFullAccess.title) policies to support changes in SSM. | Added permission to tag network instances during RunInstances. | July 3, 2025 | | [AWSApplicationMigrationServiceRolePolicy](security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.md) – Updated policy | Added permission to tag network instances during RunInstances. | March 13, 2025 | | [AWSApplicationMigrationEC2Access](security-iam-awsmanpol-AWSApplicationMigrationEC2Access.md) – Updated policy | Added permission to tag network instances during RunInstances. | February 11, 2025 | | [AWSApplicationMigrationServiceRolePolicy](security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.md) – Updated policy [AWSApplicationMigrationEC2Access](security-iam-awsmanpol-AWSApplicationMigrationEC2Access.md) – Updated policy | Created new revisions of AWSApplicationMigrationServiceRolePolicy and AWSApplicationMigrationEC2Access managed policies to support a change in authentication with EBS APIs. | January 08, 2025 | | [AWSApplicationMigrationFullAccess ](security-iam-awsmanpol-AWSApplicationMigrationFullAccess.md#security-iam-awsmanpol-AWSApplicationMigrationFullAccess.title)– Updated policy | Updated the AWSApplicationMigrationFullAccess policy to support SecureString parameter type in SSM Parameters Store for post-migration framework actions. | March 10, 2024 | | [AWSApplicationMigrationServiceEc2InstancePolicy ](security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.md#security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.title)– Updated policy | Created a new revision of the managed policy to support MGN in GovCloud and added SID to statements in the managed policy | December 28, 2023 | | [AWSApplicationMigrationServiceEc2InstancePolicy ](security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.md#security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.title)– New policy | This policy allows installing and using the AWS Replication Agent, which is used by AWS Application Migration Service (AWS MGN) to migrate source servers that run on EC2 (cross-Region or cross-AZ). An IAM role with this policy should be attached (as an EC2 Instance Profile) to the EC2 Instances. | August 21, 2023 | | [AWSApplicationMigrationServiceRolePolicy ](security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.md#security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.title)– Updated policy | Updated the AWSApplicationMigrationServiceRolePolicy with Organizations permissions to support the global view feature. | June 18, 2023 | | [AWSApplicationMigrationFullAccess ](security-iam-awsmanpol-AWSApplicationMigrationFullAccess.md#security-iam-awsmanpol-AWSApplicationMigrationFullAccess.title)– Updated policy | Updated the AWSApplicationMigrationFullAccess policy to support specific automation SSM documents. | April 1, 2023 | | [AWSApplicationMigrationFullAccess ](security-iam-awsmanpol-AWSApplicationMigrationFullAccess.md#security-iam-awsmanpol-AWSApplicationMigrationFullAccess.title)– Updated policy [AWSApplicationMigrationSSMAccess ](security-iam-awsmanpol-AWSApplicationMigrationSSMAccess.md#security-iam-awsmanpol-AWSApplicationMigrationSSMAccess.title)– Updated policy [AWSApplicationMigrationReadOnlyAccess ](security-iam-awsmanpol-AWSApplicationMigrationReadOnlyAccess.md#security-iam-awsmanpol-AWSApplicationMigrationReadOnlyAccess.title)– Created policy | Updated the AWSApplicationMigrationFullAccess policy to support both command and automation SSM documents for post-migration framework actions. Updated the AWSApplicationMigrationSSMAccess policy to support both command and automation SSM documents for the custom actions feature. Updated the AWSApplicationMigrationReadOnlyAccess policy to support the new import and export feature. | March 21, 2023 | | [AWSApplicationMigrationEC2Access ](security-iam-awsmanpol-AWSApplicationMigrationEC2Access.md#security-iam-awsmanpol-AWSApplicationMigrationEC2Access.title)– Updated policy | Updated the AWSApplicationMigrationEC2Access policy to support: DescribeSnapshots, DescribeImages, DescribeVolumes. | January 29, 2023 | | [AWSApplicationMigrationEC2Access ](security-iam-awsmanpol-AWSApplicationMigrationEC2Access.md#security-iam-awsmanpol-AWSApplicationMigrationEC2Access.title)– Updated policy [AWSApplicationMigrationReadOnlyAccess ](security-iam-awsmanpol-AWSApplicationMigrationReadOnlyAccess.md#security-iam-awsmanpol-AWSApplicationMigrationReadOnlyAccess.title)– Updated policy [AWSApplicationMigrationSSMAccess ](security-iam-awsmanpol-AWSApplicationMigrationSSMAccess.md#security-iam-awsmanpol-AWSApplicationMigrationSSMAccess.title)– Created policy | Updated the AWSApplicationMigrationEC2Access policy to support: CreateLaunchTemplate, DeleteLaunchTemplate. Updated the AWSApplicationMigrationReadOnlyAccess policy to support: DescribeLaunchConfigurationTemplates, ListSourceServerActions, ListTemplateActions, ListApplications, ListWaves. Created new AWSApplicationMigrationSSMAccess policy to support new custom actions feature. | November 28, 2022 | | [AWSApplicationMigrationAgentPolicy ](security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy.md#security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy.title)– Updated policy [AWSApplicationMigrationAgentInstallationPolicy ](security-iam-awsmanpol-AWSApplicationMigrationAgentInstallationPolicy.md#security-iam-awsmanpol-AWSApplicationMigrationAgentInstallationPolicy.title)– Updated policy | Updated the AWSApplicationMigrationAgentPolicy policy and the AWSApplicationMigrationAgentInstallationPolicy policy to support sending additional metrics during the agent installation process. | September 20, 2022 | | [AWSApplicationMigrationAgentInstallationPolicy ](security-iam-awsmanpol-AWSApplicationMigrationAgentInstallationPolicy.md#security-iam-awsmanpol-AWSApplicationMigrationAgentInstallationPolicy.title)– New policy | AWS MGN added a new policy. This policy allows installing the AWS Replication Agent, which is used with Application Migration Service to migrate source servers to AWS. Attach this policy to your users or roles whose credentials you provide during the installation step of the AWS Replication Agent. The installed AWS Replication Agent will communicate with Application Migration Service using the recommended strong authentication method. | June 15, 2022 | | [AWSApplicationMigrationFullAccess ](security-iam-awsmanpol-AWSApplicationMigrationFullAccess.md#security-iam-awsmanpol-AWSApplicationMigrationFullAccess.title)– Updated policy | Updated the AWSApplicationMigrationFullAccess policy to to support the Post Migration Framework. | May 16, 2022 | | [AWSApplicationMigrationAgentPolicy\$1v2 ](security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy_v2.md#security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy_v2.title)– New policy | AWS Application Migration Service added a new policy. This policy allows using the AWS Replication Agent, which is used with AWS Application Migration Service to migrate source servers to AWS. We do not recommend that you attach this policy to your users or roles. | May 10, 2022 | | [AWSApplicationMigrationReadOnlyAccess ](security-iam-awsmanpol-AWSApplicationMigrationReadOnlyAccess.md#security-iam-awsmanpol-AWSApplicationMigrationReadOnlyAccess.title)– Updated policy | Updated the AWSApplicationMigrationReadOnlyAccess policy to include service quotas. | April 3, 2022 | | [AWSApplicationMigrationEC2Access ](security-iam-awsmanpol-AWSApplicationMigrationEC2Access.md) – Updated policy | Updated the AWSApplicationMigrationEC2Access policy to add additional permissions and restrict certain existing permissions. This policy is only intended to be used for the AWS MGN console. The restriction prevents certain requests from being called directly by the calling identity, whilst enabling an AWS Application Migration Service (AWS MGN) to make the request to EC2 on behalf of the calling identity. | March 2, 2022 | | [AWSApplicationMigrationServiceRolePolicy ](security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.md#security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.title)– Updated policy | AWS Application Migration Service added a new policy to allow AWS Application Migration Service to manage AWS resources on your behalf. | December 15, 2021 | | [AWSApplicationMigrationVCenterClientPolicy ](security-iam-awsmanpol-AWSApplicationMigrationVCenterClientPolicy.md#security-iam-awsmanpol-AWSApplicationMigrationVCenterClientPolicy.title)– New policy | AWS Application Migration Service added a new policy that allows the installation and usage of the AWS vCenter Appliance. | November 7, 2021 | | [AWSApplicationMigrationAgentPolicy ](security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy.md#security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy.title)– New policy | AWS Application Migration Service added a new policy to allow the installation of the AWS Replication Agent on source servers. | April 18, 2021 | | [AWSApplicationMigrationConversionServerPolicy ](security-iam-awsmanpol-AWSApplicationMigrationConversionServerPolicy.md#security-iam-awsmanpol-AWSApplicationMigrationConversionServerPolicy.title)– New policy | AWS Application Migration Service added a new policy that allows AWS Application Migration Service to communicate with the service. | April 18, 2021 | | [AWSApplicationMigrationMGHAccess ](security-iam-awsmanpol-AWSApplicationMigrationMGHAccess.md#security-iam-awsmanpol-AWSApplicationMigrationMGHAccess.title)– New policy | AWS Application Migration Service added a new policy to allow AWS Application Migration Service access to your account's AWS Migration Hub | April 18, 2021 | | [AWSApplicationMigrationReplicationServerPolicy ](security-iam-awsmanpol-AWSApplicationMigrationReplicationServerPolicy.md#security-iam-awsmanpol-AWSApplicationMigrationReplicationServerPolicy.title)– New policy | AWS Application Migration Service added a new policy to allow the AWS Application Migration Service replication servers to communicate with the service, create and manage resources on your behalf. | April 7, 2021 | | AWS MGN started tracking changes | AWS Application Migration Service started tracking changes for AWS managed policies. | April 7, 2021 | **Topics** + [ ## AWS MGN updates for AWS managed policies ](#security-iam-awsmanpol-updates) + [ # AWS managed policy: AWSApplicationMigrationServiceRolePolicy ](security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.md) + [ # AWS managed policy: AWSApplicationMigrationConversionServerPolicy ](security-iam-awsmanpol-AWSApplicationMigrationConversionServerPolicy.md) + [ # AWS managed policy: AWSApplicationMigrationReplicationServerPolicy ](security-iam-awsmanpol-AWSApplicationMigrationReplicationServerPolicy.md) + [ # AWS managed policy: AWSApplicationMigrationAgentPolicy ](security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy.md) + [ # AWS managed policy: AWSApplicationMigrationMGHAccess ](security-iam-awsmanpol-AWSApplicationMigrationMGHAccess.md) + [ # AWS managed policy: AWSApplicationMigrationFullAccess ](security-iam-awsmanpol-AWSApplicationMigrationFullAccess.md) + [ # AWS managed policy: AWSApplicationMigrationEC2Access ](security-iam-awsmanpol-AWSApplicationMigrationEC2Access.md) + [ # AWS managed policy: AWSApplicationMigrationSSMAccess ](security-iam-awsmanpol-AWSApplicationMigrationSSMAccess.md) + [ # AWS managed policy: AWSApplicationMigrationReadOnlyAccess ](security-iam-awsmanpol-AWSApplicationMigrationReadOnlyAccess.md) + [ # AWS managed policy: AWSApplicationMigrationVCenterClientPolicy ](security-iam-awsmanpol-AWSApplicationMigrationVCenterClientPolicy.md) + [ # AWS managed policy: AWSApplicationMigrationAgentInstallationPolicy ](security-iam-awsmanpol-AWSApplicationMigrationAgentInstallationPolicy.md) + [ # AWS managed policy: AWSApplicationMigrationAgentPolicy\$1v2 ](security-iam-awsmanpol-AWSApplicationMigrationAgentPolicy_v2.md) + [ # AWS managed policy: AWSApplicationMigrationServiceEc2InstancePolicy ](security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.md) + [ # AWS managed policy: AWSApplicationMigrationNetworkMigrationMultiAccount ](security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationMultiAccount.md) + [ # AWS managed policy: AWSApplicationMigrationNetworkMigrationCustomResource ](security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationCustomResource.md) # AWS managed policy: AWSApplicationMigrationServiceRolePolicy AWSApplicationMigrationServiceRolePolicy This policy is attached to the AWS MGN [AWSServiceRoleForApplicationMigrationService](using-service-linked-roles.md) service-linked role (SLR). This policy allows AWS Application Migration Service to manage AWS resources on your behalf. **Permissions details** To view the policy permission details see [AWSApplicationMigrationServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationServiceRolePolicy.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationConversionServerPolicy AWSApplicationMigrationConversionServerPolicy This policy is attached to the AWS Application Migration Service conversion server’s instance role. This policy allows the AWS Application Migration Service (AWS MGN) conversion server, which are EC2 instances launched by AWS Application Migration Service, to communicate with the AWS MGN service. An IAM role with this policy is attached (as an EC2 Instance Profile) by AWS MGN to the AWS MGN Conversion Servers, which are automatically launched and terminated by AWS MGN, when needed. We do not recommend that you attach this policy to your users or roles. AWS MGN conversion servers are used by AWS Application Migration Service when users choose to launch test or cutover instances using the AWS MGN console, CLI, or API. **Permissions details** To view the policy permission details see [AWSApplicationMigrationConversionServerPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationConversionServerPolicy.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationReplicationServerPolicy AWSApplicationMigrationReplicationServerPolicy This policy is attached to the AWS Application Migration Service replication server’s instance role. This policy allows the AWS Application Migration Service (AWS MGN) Replication Servers, which are EC2 instances launched by AWS Application Migration Service - to communicate with the AWS MGN service, and to create EBS snapshots in your AWS account. An IAM role with this policy is attached (as an EC2 Instance Profile) by AWS Application Migration Service to the AWS MGN replication servers which are automatically launched and terminated by AWS MGN, as needed. AWS MGN Replication Servers are used to facilitate data replication from your external servers to AWS, as part of the migration process managed using AWS MGN. We do not recommend that you attach this policy to your users or roles. **Permissions details** To view the policy permission details see [AWSApplicationMigrationReplicationServerPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationReplicationServerPolicy.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationAgentPolicy AWSApplicationMigrationAgentPolicy You can attach the `AWSApplicationMigrationAgentPolicy` policy to your IAM identities. This policy allows installing and using the AWS Replication Agent, which is used with AWS Application Migration Service (AWS MGN) to migrate external servers to AWS. Attach this policy to your users whose credentials you provide when installing the AWS replication agent. **Permissions details** To view the policy permission details see [AWSApplicationMigrationAgentPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationAgentPolicy.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationMGHAccess AWSApplicationMigrationMGHAccess This policy allows AWS Application Migration Service (AWS MGN) to send metadata about the progress of servers being migrated using AWS MGN to AWS Migration Hub (MGH). AWS MGN automatically creates an IAM role with this policy attached and assumes this role. We do not recommend that you attach this policy to your users or roles. Migration-progress data is only sent after the AWS "home region” is set in AWS MGH. If the Home AWS Region is different than the AWS Region into which a server is being migrated, this data will be sent cross-region. To stop AWS MGN from sending this metadata to AWS MGH, detach it from your users or roles. **Permissions details** To view the policy permission details see [AWSApplicationMigrationMGHAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationMGHAccess.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationFullAccess AWSApplicationMigrationFullAccess You can attach the `AWSApplicationMigrationFullAccess` policy to your IAM identities. This policy provides permissions to all public APIs of AWS Application Migration Service (AWS MGN), as well as permissions to read KMS key, License Manager, Resource Groups, Elastic Load Balancing, IAM, and EC2 information. This policy should only be granted to an administrator or a power-user. **Important** You must attach the [AWSApplicationMigrationFullAccess](https://docs.aws.amazon.com/en_us/mgn/latest/ug/security-iam-awsmanpol-AWSApplicationMigrationFullAccess.html) and the [AWSApplicationMigrationEC2Access](https://docs.aws.amazon.com/en_us/mgn/latest/ug/security-iam-awsmanpol-AWSApplicationMigrationEC2Access.html) policies to your users and roles to enable them to launch test and cutover instances and to complete a full migration cycle with AWS MGN. **Permissions details** To view the policy permission details see [AWSApplicationMigrationFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationFullAccess.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationEC2Access AWSApplicationMigrationEC2Access You can attach the `AWSApplicationMigrationEC2Access` policy to your IAM identities. This policy allows Amazon EC2 operations required to use AWS Application Migration Service (AWS MGN) to launch the migrated servers as EC2 instances. Attach this policy to your users or roles. This policy is only intended to be used for the MGN console. **Permissions details** To view the policy permission details see [AWSApplicationMigrationEC2Access](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationEC2Access.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationSSMAccess AWSApplicationMigrationSSMAccess You can attach the `AWSApplicationMigrationSSMAccess` policy to your IAM identities. This policy allows Amazon SSM operations required to use AWS Application Migration Service (AWS MGN) to run SSM documents post migration of source servers. Attach this policy to your users or roles. This policy is only intended to be used for the AWS MGN console. **Permissions details** To view the policy permission details see [AWSApplicationMigrationSSMAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationSSMAccess.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationReadOnlyAccess AWSApplicationMigrationReadOnlyAccess You can attach the `AWSApplicationMigrationReadOnlyAccess` policy to your IAM identities. The Read-Only policy allows a user to This policy provides permissions to all read-only public APIs of AWS Application Migration Service (AWS MGN), as well as some read-only APIs of other AWS services that are required in order to make full read-only use of the AWS MGN console. It does not allow them to perform any actions, such as initialize the service, replicate servers, or launch servers in AWS. This policy can be granted to a user in a support role. Attach this policy to your users or roles. **Permissions details** To view the policy permission details see [AWSApplicationMigrationReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationReadOnlyAccess.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationVCenterClientPolicy AWSApplicationMigrationVCenterClientPolicy You can attach the `AWSApplicationMigrationVCenterClientPolicy` policy to your IAM identities. This policy allows installing and using the AWS VCenter Client, which is used with AWS Application Migration Service (AWS MGN) to migrate external servers to AWS. Attach this policy to your users or roles whose credentials you provide when installing the AWS VCenter Client. **Permissions details** To view the policy permission details see [AWSApplicationMigrationVCenterClientPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationVCenterClientPolicy.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationAgentInstallationPolicy AWSApplicationMigrationAgentInstallationPolicy This policy allows installing the AWS Replication Agent, which is used with AWS Application Migration Service to migrate source servers to AWS. Attach this policy to your users or roles whose credentials you provide during the installation step of the AWS Replication Agent. The installed AWS Replication Agent will communicate with Application Migration Service using the recommended strong authentication method. **Permissions details** To view the policy permission details see [AWSApplicationMigrationAgentInstallationPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationAgentInstallationPolicy) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationAgentPolicy\$1v2 AWSApplicationMigrationAgentPolicy\$1v2 This policy allows using the AWS Replication Agent, which is used with AWS Application Migration Service to migrate source servers to AWS. We do not recommend that you attach this policy to your users or roles. **Permissions details** To view the policy permission details see [AWSApplicationMigrationAgentPolicy\$1v2](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationAgentPolicy_v2.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationServiceEc2InstancePolicy AWSApplicationMigrationServiceEc2InstancePolicy This policy allows installing and using the AWS Replication Agent, which is used by AWS Application Migration Service (AWS MGN) to migrate source servers that run on EC2 (cross-Region or cross-AZ). An IAM role with this policy should be attached (as an EC2 Instance Profile) to the EC2 Instances. **Permissions details** To view the policy permission details see [AWSApplicationMigrationServiceEc2InstancePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationServiceEc2InstancePolicy.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationNetworkMigrationMultiAccount AWSApplicationMigrationNetworkMigrationMultiAccount You can attach the `AWSApplicationMigrationNetworkMigrationMultiAccount` policy to your IAM identities. This identity-based policy enables AWS Application Migration Service (MGN) to create, modify, and manage network infrastructure components through CloudFormation. The policy grants permissions necessary for: 1. **Network Resource Management:** Creating and managing VPCs, subnets, route tables, and network ACLs; configuring Transit Gateways and their attachments; managing security groups and their rules; setting up NAT Gateways and Internet Gateways; handling network interfaces and elastic IPs 1. **CloudFormation Operations:** Creating and managing stacks with prefix [Nmd\$1]; describing stack resources and events; updating and deleting stacks 1. **Resource Sharing:** Managing RAM (Resource Access Manager) resource shares; sharing Transit Gateways across accounts within the same organization 1. **Custom Resources:** Creating and managing Lambda functions with prefix [network-migration\$1]; managing IAM roles with prefix [Nmd\$1modifyTransitGateway\$1]; creating and managing CloudWatch log groups The policy enforces security through resource tagging requirements (CreatedBy: AWSApplicationMigrationService), conditional checks ensuring operations are called via CloudFormation, organization-level controls for cross-account resource sharing, and specific resource-level permissions for critical network components. This policy grants both programmatic and console access required for AWS Application Migration Service to orchestrate network infrastructure deployment and management through CloudFormation. **Permissions details** To view the policy permission details see [AWSApplicationMigrationNetworkMigrationMultiAccount](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationNetworkMigrationMultiAccount.html) in the AWS Managed Policy Reference Guide. # AWS managed policy: AWSApplicationMigrationNetworkMigrationCustomResource AWSApplicationMigrationNetworkMigrationCustomResource Allows modification of Transit Gateway resources created by Application Migration Service. You can attach the `AWSApplicationMigrationNetworkMigrationCustomResource` policy to your IAM identities. This identity-based policy allows modification of Transit Gateway resources that were specifically created by Application Migration Service. The policy grants permission to modify Transit Gateways and their route tables, but only if they are tagged with `[CreatedBy: AWSApplicationMigrationService]`. This restriction ensures that only resources created by the migration service can be modified, providing targeted control over Transit Gateway infrastructure during migration processes. The policy grants the permissions necessary to complete these actions programmatically from the AWS API or AWS CLI. The policy is particularly useful for: + Managing Transit Gateway configurations during application migration + Ensuring only migration service-created resources can be modified + Maintaining control over network infrastructure changes during migration processes **Permissions details** To view the policy permission details see [AWSApplicationMigrationNetworkMigrationCustomResource](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationNetworkMigrationCustomResource.html) in the AWS Managed Policy Reference Guide. # Managing access using policies Managing access using policies You control access in AWS by creating policies and attaching them to AWS identities or resources. A policy defines permissions when associated with an identity or resource. AWS evaluates these policies when a principal makes a request. Most policies are stored in AWS as JSON documents. For more information about JSON policy documents, see [Overview of JSON policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json) in the *IAM User Guide*. Using policies, administrators specify who has access to what by defining which **principal** can perform **actions** on what **resources**, and under what **conditions**. By default, users and roles have no permissions. An IAM administrator creates IAM policies and adds them to roles, which users can then assume. IAM policies define permissions regardless of the method used to perform the operation. ## Identity-based policies Identity-based policies are JSON permissions policy documents that you can attach to an identity, such as a user, role, or group. These policies control what actions that identity can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the IAM User Guide. Identity-based policies can be further categorized as inline policies or managed policies. Inline policies are embedded directly into a single user, group, or role. Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account. Managed policies include AWS managed policies and customer managed policies. To learn how to choose between a managed policy or an inline policy, see[Managed policies and inline policies ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#choosing-managed-or-inline) in the IAM User Guide. # Using identity-based policies By default, users and roles don't have permission to create or modify AWS Application Migration Service resources. They also can't perform tasks using the AWS Management Console, AWS CLI, or AWS API. An IAM administrator must create IAM policies that grant users and roles permission to perform specific API operations on the specified resources they need. The administrator must then attach those policies to the users or groups that require those permissions. To understand how to attach policies to a user or group, learn about [adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html). To learn how to create an IAM identity-based policy using example JSON policy documents, see [Creating policies on the JSON tab in the IAM User Guide.](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html#access_policies_create-json-editor) **Topics** + [ # Customer-managed policies in AWS MGN ](customer_managed_policies_mgn.md) + [ # Restrict permission to act on a source server associated with given AWS vCenter client ](restrict-to-vcenter-client.md) + [ # Network Migration API permissions ](network-migration-api-permissions.md) # Customer-managed policies in AWS MGN You can create your own custom IAM policies to allow permissions for AWS Application Migration Service actions and resources. You can attach these custom policies to the users, roles, or groups that require those permissions. You can also create your own custom IAM policies for integration between AWS Application Migration Service and other AWS services. The next few topics provide example of the IAM policies which grants permission for various AWS Application Migration Service actions. Use them to limit AWS Application Migration Service access for your users and roles. # Restrict permission to act on a source server associated with given AWS vCenter client To restrict access to source servers associated with a given AWS vCenter client, use the condition element ` mgn:VcenterClientId ` condition key. The following example demonstrates a policy that allows an AWS vCenter client to call the ` mgn:UpdateAgentSourcePropertiesForMgn ` action only on a source server associated with the calling AWS vCenter client. # Network Migration API permissions The Network Migration APIs allow you to automate the migration of network infrastructure from VMware to AWS. To use these APIs, attach both the [AWSApplicationMigrationNetworkMigrationMultiAccount](security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationMultiAccount.md#security-iam-awsmanpol-AWSApplicationMigrationNetworkMigrationMultiAccount.title) managed policy and the following custom policy to your IAM identity. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "Tags", "Effect": "Allow", "Action": [ "mgn:TagResource" ], "Resource": [ "arn:aws:mgn:*:*:network-migration-definition/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "AWSTransform", "mgn:CreateAction": [ "CreateNetworkMigrationDefinition" ] } } }, { "Sid": "CreateMethod", "Effect": "Allow", "Action": [ "mgn:CreateNetworkMigrationDefinition" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "AWSTransform" } } }, { "Sid": "ResourceMethods", "Effect": "Allow", "Action": [ "mgn:UpdateNetworkMigrationDefinition", "mgn:StartNetworkMigrationMapping", "mgn:StartNetworkMigrationCodeGeneration", "mgn:StartNetworkMigrationDeployment", "mgn:StartNetworkMigrationAnalysis" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "AWSTransform" } } }, { "Sid": "ReadonlyMethods", "Effect": "Allow", "Action": [ "mgn:GetNetworkMigrationDefinition" ], "Resource": [ "arn:aws:mgn:*:*:network-migration-definition/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "AWSTransform" } } }, { "Sid": "DeleteExistingNetworkMigrationDefinition", "Effect": "Allow", "Action": [ "mgn:DeleteNetworkMigrationDefinition" ], "Resource": [ "arn:aws:mgn:*:*:network-migration-definition/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "AWSTransform" } } }, { "Sid": "ReadOnly", "Effect": "Allow", "Action": [ "mgn:ListNetworkMigrationDefinitions", "mgn:ListNetworkMigrationExecutions", "mgn:ListNetworkMigrationMapperSegments", "mgn:ListNetworkMigrationMappings", "mgn:ListNetworkMigrationMapperSegmentConstructs", "mgn:ListNetworkMigrationCodeGenerationSegments", "mgn:ListNetworkMigrationCodeGenerations", "mgn:ListNetworkMigrationDeployedStacks", "mgn:ListNetworkMigrationDeployments", "mgn:ListNetworkMigrationAnalysisResults", "mgn:ListNetworkMigrationAnalyses", "mgn:GetNetworkMigrationMapperSegmentConstruct" ], "Resource": [ "*" ] }, { "Sid": "MGNNetworkMigrationUpdate", "Effect": "Allow", "Action": [ "mgn:UpdateNetworkMigrationMapperSegment", "mgn:StartNetworkMigrationMappingUpdate", "mgn:ListNetworkMigrationMappingUpdates" ], "Resource": [ "arn:aws:mgn:*:*:network-migration-definition/*" ], "Condition": { "StringEquals": { "aws:ResourceTag/CreatedBy": "AWSTransform" } } }, { "Sid": "MGNImportFileEnrichment", "Effect": "Allow", "Action": [ "mgn:StartImportFileEnrichment", "mgn:ListImportFileEnrichments" ], "Resource": [ "*" ] }, { "Sid": "S3Bucket", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketTagging", "s3:GetBucketPublicAccessBlock", "s3:GetBucketLocation", "s3:CreateBucket", "s3:PutBucketTagging", "s3:PutEncryptionConfiguration" ], "Resource": "arn:aws:s3:::*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Sid": "S3BucketObject", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:GetObjectAttributes", "s3:PutObject", "s3:AbortMultipartUpload", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::*/*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Sid": "MGNNetworkAnalysis", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInsightsPath", "ec2:StartNetworkInsightsAnalysis", "ec2:DeleteNetworkInsightsPath", "ec2:DeleteNetworkInsightsAnalysis", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:network-insights-path/*", "arn:aws:ec2:*:*:network-insights-analysis/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "mgn.amazonaws.com" ] } } }, { "Sid": "EC2DescribeNoCondition", "Effect": "Allow", "Action": [ "ec2:DescribeVpcAttribute" ], "Resource": "*" }, { "Sid": "MGNServiceQuota", "Effect": "Allow", "Action": "servicequotas:GetServiceQuota", "Resource": "arn:aws:servicequotas:*:*:vpc/L-2AFB9258", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "mgn.amazonaws.com" } } }, { "Sid": "EC2GetSubnetCidrReservations", "Effect": "Allow", "Action": "ec2:GetSubnetCidrReservations", "Resource": "*" }, { "Sid": "TirosForNetworkInsights", "Effect": "Allow", "Action": [ "tiros:CreateQuery", "tiros:GetQueryAnswer", "tiros:GetQueryExplanation" ], "Resource": "*" } ] } ``` ------ ## Resource-based policies Resource-based policies are JSON policy documents that you attach to a resource. Examples include IAM *role trust policies* and Amazon S3 *bucket policies*. In services that support resource-based policies, service administrators can use them to control access to a specific resource. You must [specify a principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in a resource-based policy. Resource-based policies are inline policies that are located in that service. You can't use AWS managed policies from IAM in a resource-based policy. ## Access control lists (ACLs) Access control lists (ACLs) control which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. To learn more about ACLs, see [Access control list (ACL) overview](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html) in the *Amazon Simple Storage Service Developer Guide*. ## Other policy types AWS supports additional policy types that can set the maximum permissions granted by more common policy types: + **Permissions boundaries** – Set the maximum permissions that an identity-based policy can grant to an IAM entity. For more information, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide*. + **Service control policies (SCPs)** – Specify the maximum permissions for an organization or organizational unit in AWS Organizations. For more information, see [Service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) in the *AWS Organizations User Guide*. + **Resource control policies (RCPs)** – Set the maximum available permissions for resources in your accounts. For more information, see [Resource control policies (RCPs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html) in the *AWS Organizations User Guide*. + **Session policies** – Advanced policies passed as a parameter when creating a temporary session for a role or federated user. For more information, see [Session policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) in the *IAM User Guide*. ## Multiple policy types When multiple types of policies apply to a request, the resulting permissions are more complicated to understand. To learn how AWS determines whether to allow a request when multiple policy types are involved, see [Policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html) in the *IAM User Guide*. # Using service-linked roles for AWS Application Migration Service Using service-linked roles AWS Application Migration Service uses AWS Identity and Access Management (IAM)[ service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role). A service-linked role is a unique type of IAM role that is linked directly to AWS Application Migration Service. Service-linked roles are predefined by AWS Application Migration Service and include all the permissions that the service requires to call other AWS services on your behalf. A service-linked role makes setting up AWS Application Migration Service easier because you don’t have to manually add the necessary permissions. AWS Application Migration Service defines the permissions of its service-linked roles, and unless defined otherwise, only AWS Application Migration Service can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. You can delete a service-linked role only after first deleting their related resources. This protects your AWS Application Migration Service resources because you can't inadvertently remove permission to access the resources. For information about other services that support service-linked roles, see [AWS Services That Work with IAM ](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) and look for the services that have **Yes **in the **Service-Linked Role** column. Choose a **Yes** with a link to view the service-linked role documentation for that service. ## AWSServiceRoleForApplicationMigrationService service-linked role AWS Application Migration Service uses the service-linked role named **AWSServiceRoleForApplicationMigrationService**. This is a managed IAM policy with scoped permissions that AWS Application Migration Service needs to run in your account. The AWSServiceRoleForApplicationMigrationService service-linked role trusts the `mgn.amazonaws.com` service principal to assume the role. The role permissions are defined in the [AWSApplicationMigrationServiceRolePolicy](https://docs.aws.amazon.com/mgn/latest/ug/security-iam-awsmanpol-AWSApplicationMigrationServiceRolePolicy.html) AWS managed policy. To view the policy permission details see [AWSApplicationMigrationServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSApplicationMigrationServiceRolePolicy.html) in the AWS Managed Policy Reference Guide. You must configure permissions to allow an IAM entity (such as a user, group, or role) to create, edit, or delete a service-linked role. For more information, see [Service-Linked Role Permissions ](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*. ## Creating a service-linked role for AWS Application Migration Service You don't need to manually create a service-linked role. When you configure the Replication Configuration Template for AWS Application Migration Service, a service-linked role is automatically created. MGN automatically creates the IAM service-linked role, which you can see in the IAM console. You don't need to manually create or configure this role. If you delete this service-linked role, and then need to create it again, you can use the same process to recreate the role in your account. When you create the first new replication configuration template in MGN, it creates the service-linked role for you again. In the AWS CLI or the AWS API, create a service-linked role with the AWS Application Migration Service name. For more information, see [Creating a Service-Linked Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the*IAM User Guide*. If you delete this service-linked role, you can use this same process to create the role again. ## Editing a service-linked role for AWS Application Migration Service AWS Application Migration Service does not allow you to edit the AWSServiceRoleForApplicationMigrationService service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a Service-Linked Role ](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the *IAM User Guide*. ## Deleting a service-linked role for AWS Application Migration Service If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don’t have an unused entity that is not actively monitored or maintained. However, you must clean up the resources for your service-linked role before you can manually delete it. **Note** If AWS Application Migration Service is using the role when you try to delete the resources, the deletion might fail. If that happens, wait for a few minutes and try the operation again. **To clean up AWS Application Migration Service resources used by AWSServiceRoleforApplicationMigrationService** 1. Identify and delete any waves and applications in all AWS Regions 1. identify any waves: ``` aws mgn list-waves ``` 1. Delete any waves: ``` aws mgn delete-wave --wave-id {WaveID} ``` 1. Identify any application: ``` aws mgn list-applications ``` 1. Delete any application: ``` aws mgn delete-application --application-id {ApplicationID} ``` 1. Identify and delete any source servers in all AWS Regions 1. Identify any active source servers: ``` aws mgn describe-source-servers --filters isArchived=False --query "items[*].sourceServerID" ``` 1. Disconnect any active source servers: ``` aws mgn disconnect-from-service --source-server-id {SourceServerID} ``` 1. Archive any disconnected source servers: ``` aws mgn mark-as-archived --source-server-id {SourceServerID} ``` 1. Delete any archived source server: ``` aws mgn delete-source-server --source-server-id {SourceServerID} ``` 1. Identify and delete any AWS MGN jobs in all AWS Regions 1. Identify any AWS MGN jobs ``` aws mgn describe-jobs ``` 1. Delete any AWS MGN jobs: ``` aws mgn delete-job --job-id {MGNJobId} ``` 1. Identify and delete any AWS MGN replication templates 1. Identify any AWS MGN replication template: ``` aws mgn describe-replication-configuration-templates ``` 1. Remove any AWS MGN replication templates: ``` aws mgn delete-replication-configuration-template --replication-configuration-template-id {rct-TemplateID} ``` Resources can be cleaned up without stopping any service provided by AWS Application Migration Service. Cleaning up AWS Application Migration Service resources will cause AWS Application Migration Service to stop working. For more information, see [Cleaning up a Service-Linked Role ](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the *IAM User Guide*. **To manually delete the service-linked role using IAM ** Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForApplicationMigrationService service-linked role. For more information, see [Deleting a Service-Linked Role ](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the *IAM User Guide*. ## Supported Regions for AWS MGN service-linked roles AWS Application Migration Service supports using service-linked roles in all of the [AWS Regions where the service is available](what-is-application-migration-service.md#supported-regions). ## Policy structure An IAM policy is a JSON document that consists of one or more statements. Each statement is structured as follows. ``` { "Statement": [ { "Effect": "effect", "Action": "action", "Resource": "arn", "Condition": { "condition": { "key":"value" } } } ] } ``` There are various elements that make up a statement: + **Effect:** The effect can be `Allow` or `Deny`. By default, IAM users don't have permission to use resources and API actions, so all requests are denied. An explicit allow overrides the default. An explicit deny overrides any allows. + **Action**: The action is the specific AWS Application Migration Service API action for which you are granting or denying permission. + **Resource**: The resource that's affected by the action. For AWS Application Migration Service, you must specify "\$1" as the resource. + **Condition**: Conditions are optional. They can be used to control when your policy is in effect. # Resilience in AWS Application Migration Service Resilience The AWS global infrastructure is built around AWS Regions and Availability Zones. Regions provide multiple physically separated and isolated Availability Zones, which are connected through low-latency, high-throughput, and highly redundant networking. With Availability Zones, you can design and operate applications and databases that automatically fail over between zones without interruption. Availability Zones are more highly available, fault tolerant, and scalable than traditional single or multiple data center infrastructures. For more information about AWS Regions and Availability Zones, see [AWS Global Infrastructure](https://aws.amazon.com/about-aws/global-infrastructure/). # Infrastructure security in AWS Application Migration Service Infrastructure security As a managed service, AWS Application Migration Service is protected by the AWS global network security procedures that are described in the [Amazon Web Services: Overview of Security Processes ](https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf) whitepaper. You use AWS published API calls to access AWS Application Migration Service through the network. Clients must support Transport Layer Security (TLS) 1.2 or later. Clients must also support cipher suites with perfect forward secrecy (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support these modes. All parties involved in the communication authenticate each other using TLS, IAM policies and tokens. The communication between the Agents and the replication server are based on TLS 1.2 only with the highest standard of cipher suite (PFS, ECDHE. Requests between the agent and AWS Application Migration Service as well as between the replication server and Application Migration Service are signed using an access key ID and a secret access key that is associated with an IAM principal). All requests must be signed using the [AWS Security Token Service](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html) (AWS STS), which allows you to generate temporary security credentials to sign requests. Alternatively, use credentials that associated with an IAM principal. AWS Application Migration Service customers must ensure that they manually delete their access keys after installing the AWS Replication Agent and successful migration. AWS does not delete these keys automatically. AWS Application Migration Service does delete the keys from source servers after they are disconnected from the service. If you want your keys to automatically stop working at a certain date after you have finished using them so that you do not have to worry about manually deleting them, you can do so though the [IAM permissions boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) and the [aws:CurrentTime global context key](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-currenttime). AWS Application Migration Service customers should use [Amazon EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html). AWS Application Migration Service customers should secure their replication servers by reducing their exposure to the public internet. This can be done through: 1. Using security groups to only allow permitted IP addresses to connect to the replication servers. [Learn more about Security Groups. ](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) 1. Using a VPN to connect to the replication servers, such as the AWS site-to-site VPN. [Learn more about the AWS Site-to-site VPN. ](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html) AWS Application Migration Service creates and uses the "aws-replication" user within the Linux Source server. The AWS Application Migration Service replication server and AWS Replication Agent run under this user. Although this is not a root user, this user needs to be part of the disk group that grants this user full read and write permissions to block devices. **Note** AWS Application Migration Service only uses these permissions to read from block devices. # Compliance validation for AWS Application Migration Service Compliance validation Third-party auditors assess the security and compliance of AWS Application Migration Service as part of multiple AWS compliance programs. For a list of AWS services in scope of specific compliance programs, see [AWS Services in Scope by Compliance Program ](https://aws.amazon.com/compliance/services-in-scope/) . For general information, see [AWS Compliance Programs ](https://aws.amazon.com/compliance/programs/) . You can download third-party audit reports using AWS Artifact. For more information, see [Downloading Reports in AWS Artifact](https://docs.aws.amazon.com/artifact/latest/ug/downloading-documents.html) . Your compliance responsibility when using AWS Application Migration Service is determined by the sensitivity of your data, your company's compliance objectives, and applicable laws and regulations. AWS provides the following resources to help with compliance: + [Security and Compliance Quick Start Guides ](https://aws.amazon.com/quickstart/?awsf.quickstart-homepage-filter=categories%23security-identity-compliance) – These deployment guides discuss architectural considerations and provide steps for deploying security- and compliance-focused baseline environments on AWS. + [Architecting for HIPAA Security and Compliance Whitepaper ](https://docs.aws.amazon.com/whitepapers/latest/architecting-hipaa-security-and-compliance-on-aws/architecting-hipaa-security-and-compliance-on-aws.html) – This whitepaper describes how companies can use AWS to create HIPAA-compliant applications. + [AWS Compliance Resources ](https://aws.amazon.com/compliance/resources/) – This collection of workbooks and guides might apply to your industry and location. + [Evaluating Resources with Rules ](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html) in the *AWS Config Developer Guide* – AWS Config; assesses how well your resource configurations comply with internal practices, industry guidelines, and regulations. + [AWS Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) – This AWS service provides a comprehensive view of your security state within AWS that helps you check your compliance with security industry standards and best practices. # Cross-service confused deputy prevention The confused deputy problem is a security issue where an entity that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action. In AWS, cross-service impersonation can result in the confused deputy problem. Cross-service impersonation can occur when one service (the *calling service*) calls another service (the *called service*). The calling service can be manipulated to use its permissions to act on another customer's resources in a way it should not otherwise have permission to access. To prevent this, AWS provides tools that help you protect your data for all services with service principals that have been given access to resources in your account. We recommend using the [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn) and [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount) global condition context keys in resource policies to limit the permissions that AWS Application Migration Service gives another service to the resource. If you use both global condition context keys, the `aws:SourceAccount` value and the account in the `aws:SourceArn` value must use the same account ID when used in the same policy statement. The value of `aws:SourceArn` must be "arn:aws:mgn:\$1:123456789012:source-server/\$1" The most effective way to protect against the confused deputy problem is to use the `aws:SourceArn` global condition context key with the full ARN of the resource. If you don't know the full ARN of the resource or if you are specifying multiple resources, use the `aws:SourceArn` global context condition key with wildcards (`*`) for the unknown portions of the ARN. For example, `arn:aws:servicename::123456789012:* ` . The following example shows how you can use the `aws:SourceArn` and `aws:SourceAccount` global condition context keys in AWS Application Migration Service to prevent the confused deputy problem. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": { "Sid": "ConfusedDeputyPreventionExamplePolicy", "Effect": "Allow", "Principal": { "Service": "mgn.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringLike": { "aws:SourceAccount": "123456789012" }, "ArnLike": { "aws:SourceArn": "arn:aws:mgn:*:123456789012:source-server/*" } } } } ``` ------