的操作、资源和条件键 AWS Database Migration Service

AWS Database Migration Service（服务前缀:dms）提供以下特定于服务的操作、资源、操作和条件密钥，供在 IAM 权限策略中使用。

参考：

了解如何配置该服务。
查看适用于该服务的 API 操作列表。
了解如何使用 IAM 权限策略保护该服务及其资源。
查看此服务的编程服务授权参考。

主题

API 操作定义为 AWS Database Migration Service
操作定义为 AWS Database Migration Service
Permission-only 的动作 AWS Database Migration Service
定义的资源类型 AWS Database Migration Service
的条件键 AWS Database Migration Service

API 操作定义为 AWS Database Migration Service

下表将 API 操作映射到它们授权的 IAM 操作。仅列出具有给定 API 和操作的静态值的条件键；有关每个操作支持的完整条件键集，请参阅操作表。

操作	IAM 操作	条件键	可能的值	访问级别
AddTagsToResource	dms: AddTagsToResource			标记、写作
ApplyPendingMaintenanceAction	dms: ApplyPendingMaintenanceAction			写入
BatchStartRecommendations	dms: BatchStartRecommendations			写入
CancelMetadataModelConversion	dms: CancelMetadataModelConversion			写入
CancelMetadataModelCreation	dms: CancelMetadataModelCreation			写入
CancelReplicationTaskAssessmentRun	dms: CancelReplicationTaskAssessmentRun			写入
CreateDataMigration	dms: AddTagsToResource			标记、写作
	dms: CreateDataMigration			写入
	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
CreateDataProvider	dms: AddTagsToResource			标记、写作
	dms: CreateDataProvider			写入
	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
CreateEndpoint	dms: AddTagsToResource			标记、写作
	dms: CreateEndpoint			写入
	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
CreateEventSubscription	dms: AddTagsToResource			标记、写作
CreateEventSubscription	dms: CreateEventSubscription			写入
CreateFleetAdvisorCollector	dms: CreateFleetAdvisorCollector			写入
CreateFleetAdvisorCollector	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
CreateInstanceProfile	dms: AddTagsToResource			标记、写作
CreateInstanceProfile	dms: CreateInstanceProfile			写入
CreateMigrationProject	dms: AddTagsToResource			标记、写作
	dms: CreateMigrationProject			写入
	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
CreateReplicationConfig	dms: AddTagsToResource			标记、写作
CreateReplicationConfig	dms: CreateReplicationConfig			写入
CreateReplicationInstance	dms: AddTagsToResource			标记、写作
	dms: CreateReplicationInstance			写入
	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
CreateReplicationSubnetGroup	dms: AddTagsToResource			标记、写作
CreateReplicationSubnetGroup	dms: CreateReplicationSubnetGroup			写入
CreateReplicationTask	dms: AddTagsToResource			标记、写作
CreateReplicationTask	dms: CreateReplicationTask			写入
DeleteCertificate	dms: DeleteCertificate			写入
DeleteConnection	dms: DeleteConnection			写入
DeleteDataMigration	dms: DeleteDataMigration			写入
DeleteDataProvider	dms: DeleteDataProvider			写入
DeleteEndpoint	dms: DeleteEndpoint			写入
DeleteEventSubscription	dms: DeleteEventSubscription			写入
DeleteFleetAdvisorCollector	dms: DeleteFleetAdvisorCollector			写入
DeleteFleetAdvisorDatabases	dms: DeleteFleetAdvisorDatabases			写入
DeleteInstanceProfile	dms: DeleteInstanceProfile			写入
DeleteMigrationProject	dms: DeleteMigrationProject			写入
DeleteReplicationConfig	dms: DeleteReplicationConfig			写入
DeleteReplicationInstance	dms: DeleteReplicationInstance			写入
DeleteReplicationSubnetGroup	dms: DeleteReplicationSubnetGroup			写入
DeleteReplicationTask	dms: DeleteReplicationTask			写入
DeleteReplicationTaskAssessmentRun	dms: DeleteReplicationTaskAssessmentRun			写入
DescribeAccountAttributes	dms: DescribeAccountAttributes			读取
DescribeApplicableIndividualAssessments	dms: DescribeApplicableIndividualAssessments			读取
DescribeCertificates	dms: DescribeCertificates			读取
DescribeConnections	dms: DescribeConnections			读取
DescribeConversionConfiguration	dms: DescribeConversionConfiguration			读取
DescribeDataMigrations	dms: DescribeDataMigrations			读取
DescribeDataProviders	dms: ListDataProviders			读取
DescribeEndpointSettings	dms: DescribeEndpointSettings			读取
DescribeEndpointTypes	dms: DescribeEndpointTypes			读取
DescribeEndpoints	dms: DescribeEndpoints			读取
DescribeEngineVersions	dms: DescribeEngineVersions			读取
DescribeEventCategories	dms: DescribeEventCategories			读取
DescribeEventSubscriptions	dms: DescribeEventSubscriptions			读取
DescribeEvents	dms: DescribeEvents			读取
DescribeExtensionPackAssociations	dms: ListExtensionPacks			读取
DescribeFleetAdvisorCollectors	dms: DescribeFleetAdvisorCollectors			读取
DescribeFleetAdvisorDatabases	dms: DescribeFleetAdvisorDatabases			读取
DescribeFleetAdvisorLsaAnalysis	dms: DescribeFleetAdvisorLsaAnalysis			读取
DescribeFleetAdvisorSchemaObjectSummary	dms: DescribeFleetAdvisorSchemaObjectSummary			读取
DescribeFleetAdvisorSchemas	dms: DescribeFleetAdvisorSchemas			读取
DescribeInstanceProfiles	dms: ListInstanceProfiles			读取
DescribeMetadataModel	dms: DescribeMetadataModel			读取
DescribeMetadataModelAssessments	dms: ListMetadataModelAssessments			读取
DescribeMetadataModelChildren	dms: DescribeMetadataModelChildren			读取
DescribeMetadataModelConversions	dms: ListMetadataModelConversions			读取
DescribeMetadataModelCreations	dms: DescribeMetadataModelCreations			读取
DescribeMetadataModelExportsAsScript	dms: ListMetadataModelExports			读取
DescribeMetadataModelExportsToTarget	dms: ListMetadataModelExports			读取
DescribeMetadataModelImports	dms: DescribeMetadataModelImports			读取
DescribeMigrationProjects	dms: ListMigrationProjects			读取
DescribeOrderableReplicationInstances	dms: DescribeOrderableReplicationInstances			读取
DescribePendingMaintenanceActions	dms: DescribePendingMaintenanceActions			读取
DescribeRecommendationLimitations	dms: DescribeRecommendationLimitations			读取
DescribeRecommendations	dms: DescribeRecommendations			读取
DescribeRefreshSchemasStatus	dms: DescribeRefreshSchemasStatus			读取
DescribeReplicationConfigs	dms: DescribeReplicationConfigs			读取
DescribeReplicationInstanceTaskLogs	dms: DescribeReplicationInstanceTaskLogs			读取
DescribeReplicationInstances	dms: DescribeReplicationInstances			读取
DescribeReplicationSubnetGroups	dms: DescribeReplicationSubnetGroups			读取
DescribeReplicationTableStatistics	dms: DescribeReplicationTableStatistics			读取
DescribeReplicationTaskAssessmentResults	dms: DescribeReplicationTaskAssessmentResults			读取
DescribeReplicationTaskAssessmentRuns	dms: DescribeReplicationTaskAssessmentRuns			读取
DescribeReplicationTaskIndividualAssessments	dms: DescribeReplicationTaskIndividualAssessments			读取
DescribeReplicationTasks	dms: DescribeReplicationTasks			读取
DescribeReplications	dms: DescribeReplications			读取
DescribeSchemas	dms: DescribeSchemas			读取
DescribeTableStatistics	dms: DescribeTableStatistics			读取
ExportMetadataModelAssessment	dms: ExportMetadataModelAssessment			写入
GetTargetSelectionRules	dms: GetTargetSelectionRules			读取
ImportCertificate	dms: AddTagsToResource			标记、写作
ImportCertificate	dms: ImportCertificate			写入
ListTagsForResource	dms: ListTagsForResource			读取
ModifyConversionConfiguration	dms: UpdateConversionConfiguration			写入
ModifyDataMigration	dms: ModifyDataMigration			写入
ModifyDataMigration	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
ModifyDataProvider	dms: UpdateDataProvider			写入
ModifyDataProvider	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
ModifyEndpoint	dms: ModifyEndpoint			写入
ModifyEndpoint	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
ModifyEventSubscription	dms: ModifyEventSubscription			写入
ModifyInstanceProfile	dms: UpdateInstanceProfile			写入
ModifyMigrationProject	dms: UpdateMigrationProject			写入
ModifyMigrationProject	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
ModifyReplicationConfig	dms: ModifyReplicationConfig			写入
ModifyReplicationInstance	dms: ModifyReplicationInstance			写入
ModifyReplicationInstance	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
ModifyReplicationSubnetGroup	dms: ModifyReplicationSubnetGroup			写入
ModifyReplicationTask	dms: ModifyReplicationTask			写入
MoveReplicationTask	dms: MoveReplicationTask			写入
RebootReplicationInstance	dms: RebootReplicationInstance			写入
RefreshSchemas	dms: RefreshSchemas			写入
ReloadReplicationTables	dms: ReloadReplicationTables			写入
ReloadTables	dms: ReloadTables			写入
RemoveTagsFromResource	dms: RemoveTagsFromResource			标记、写作
RunFleetAdvisorLsaAnalysis	dms: RunFleetAdvisorLsaAnalysis			写入
StartDataMigration	dms: StartDataMigration			写入
StartExtensionPackAssociation	dms: AssociateExtensionPack			写入
StartMetadataModelAssessment	dms: StartMetadataModelAssessment			写入
StartMetadataModelConversion	dms: StartMetadataModelConversion			写入
StartMetadataModelCreation	dms: StartMetadataModelCreation			写入
StartMetadataModelExportAsScript	dms: StartMetadataModelExportAsScripts			写入
StartMetadataModelExportToTarget	dms: StartMetadataModelExportToTarget			写入
StartMetadataModelImport	dms: StartMetadataModelImport			写入
StartRecommendations	dms: StartRecommendations			写入
StartReplication	dms: StartReplication			写入
StartReplicationTask	dms: StartReplicationTask			写入
StartReplicationTaskAssessment	dms: StartReplicationTaskAssessment			写入
StartReplicationTaskAssessmentRun	dms: AddTagsToResource			标记、写作
	dms: StartReplicationTaskAssessmentRun			写入
	我是：PassRole	我是：PassedToService	dms.amazonaws.com	写入
StopDataMigration	dms: StopDataMigration			写入
StopReplication	dms: StopReplication			写入
StopReplicationTask	dms: StopReplicationTask			写入
TestConnection	dms: TestConnection			读取
UpdateSubscriptionsToEventBridge	dms: UpdateSubscriptionsToEventBridge			写入

操作定义为 AWS Database Migration Service

您可以在 IAM 策略语句的 Action 元素中指定以下操作。可以使用策略授予在 AWS中执行操作的权限。您在策略中使用一项操作时，通常使用相同的名称允许或拒绝对 API 操作或 CLI 命令的访问。但在某些情况下，单一动作可控制对多项操作的访问。还有某些操作需要多种不同的动作。

操作	说明	资源类型（* 为必需）	条件键	访问级别
AddTagsToResource	授予向 DMS 资源（包括复制实例、终端节点、安全组和迁移任务）添加元数据标签的权限	证书	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: cert-tag/$ {} TagKey dms: req-tag/$ {} TagKey	标记、写作
		DataMigration	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: data-migration-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		DataProvider	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: data-provider-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		Endpoint	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: endpoint-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		EventSubscription	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: es-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		InstanceProfile	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: instance-profile-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		MigrationProject	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: migration-project-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		ReplicationConfig	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: replication-config-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		ReplicationInstance	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: rep-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		ReplicationSubnetGroup	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: req-tag/$ {} TagKey dms: subgrp-tag/$ {} TagKey
		ReplicationTask	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: req-tag/$ {} TagKey dms: task-tag/$ {} TagKey
		ReplicationTaskAssessmentRun	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: assessement-run-tag/$ {} TagKey dms: req-tag/$ {} TagKey
		ReplicationTaskIndividualAssessment	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: 个人评估标签/$ {} TagKey dms: req-tag/$ {} TagKey
ApplyPendingMaintenanceAction	授予将待处理的维护操作应用于资源（例如，应用于复制实例）的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	写入
AssociateExtensionPack	授予权限以关联扩展包	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
BatchStartRecommendations	授予权限以开始分析最多 20 个源数据库，从而为每个源数据库推荐目标引擎			写入
CancelMetadataModelConversion	授予取消启动的单个元数据模型转换操作的权限 StartMetadataModelConversion	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
CancelMetadataModelCreation	授予取消启动的单个元数据模型创建操作的权限 StartMetadataModelCreation	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
CancelReplicationTaskAssessmentRun	授予取消单个迁移前评估运行的权限	ReplicationTaskAssessmentRun*	aws: ResourceTag /$ {} TagKey dms: assessement-run-tag/$ {} TagKey	写入
CreateDataMigration	授予使用提供的设置创建数据库迁移的权限	MigrationProject*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: migration-project-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateDataProvider	授予使用提供的设置创建数据提供者的权限		aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: req-tag/$ {} TagKey	写入
CreateEndpoint	授予使用提供的设置创建终端节点的权限	证书	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: cert-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateEndpoint	授予使用提供的设置创建终端节点的权限	端点*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: endpoint-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateEventSubscription	授予创建 AWS DMS 事件通知订阅的权限	EventSubscription*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: es-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateFleetAdvisorCollector	授予使用指定参数创建 Fleet Advisor 收集器的权限			写入
CreateInstanceProfile	授予权限以使用提供的设置创建实例配置文件		aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: req-tag/$ {} TagKey	写入
CreateMigrationProject	授予使用提供的设置创建迁移项目的权限	DataProvider*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: data-provider-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateMigrationProject	授予使用提供的设置创建迁移项目的权限	InstanceProfile*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: instance-profile-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateReplicationConfig	授予使用提供的设置创建复制配置的权限	端点*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: endpoint-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateReplicationInstance	授予使用指定参数创建复制实例的权限	ReplicationInstance*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: rep-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateReplicationInstance	授予使用指定参数创建复制实例的权限	ReplicationSubnetGroup	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: req-tag/$ {} TagKey dms: subgrp-tag/$ {} TagKey	写入
CreateReplicationSubnetGroup	授予在 VPC 中的子网 ID 列表给定的情况下创建复制子网组的权限	ReplicationSubnetGroup*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: req-tag/$ {} TagKey dms: subgrp-tag/$ {} TagKey	写入
CreateReplicationTask	授予使用指定参数创建复制任务的权限	端点*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: endpoint-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
CreateReplicationTask	授予使用指定参数创建复制任务的权限	ReplicationInstance*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: rep-tag/$ {} TagKey dms: req-tag/$ {} TagKey	写入
DeleteCertificate	授予删除指定证书的权限	证书*	aws: ResourceTag /$ {} TagKey dms: cert-tag/$ {} TagKey	写入
DeleteConnection	授予删除复制实例和终端节点之间的指定连接的权限	端点*	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey	写入
DeleteConnection	授予删除复制实例和终端节点之间的指定连接的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	写入
DeleteDataMigration	授予删除指定的数据库迁移的权限	DataMigration*	aws: ResourceTag /$ {} TagKey dms: data-migration-tag/$ {} TagKey	写入
DeleteDataProvider	授予权限以删除指定的数据提供程序	DataProvider*	aws: ResourceTag /$ {} TagKey dms: data-provider-tag/$ {} TagKey	写入
DeleteEndpoint	授予删除指定终端节点的权限	端点*	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey	写入
DeleteEventSubscription	授予删除 AWS DMS 活动订阅的权限	EventSubscription*	aws: ResourceTag /$ {} TagKey dms: es-tag/$ {} TagKey	写入
DeleteFleetAdvisorCollector	授予删除指定 Fleet Advisor 收集器的权限			写入
DeleteFleetAdvisorDatabases	授予删除指定 Fleet Advisor 数据库的权限			写入
DeleteInstanceProfile	授予权限以删除指定的实例配置文件	InstanceProfile*	aws: ResourceTag /$ {} TagKey dms: instance-profile-tag/$ {} TagKey	写入
DeleteMigrationProject	授予权限以删除指定的迁移项目	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
DeleteReplicationConfig	授予删除指定的复制配置的权限	ReplicationConfig*	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey	写入
DeleteReplicationInstance	授予删除指定复制实例的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	写入
DeleteReplicationSubnetGroup	授予权限以删除子网组	ReplicationSubnetGroup*	aws: ResourceTag /$ {} TagKey dms: subgrp-tag/$ {} TagKey	写入
DeleteReplicationTask	授予删除指定复制任务的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
DeleteReplicationTaskAssessmentRun	授予删除单个迁移前评估运行记录的权限	ReplicationTaskAssessmentRun*	aws: ResourceTag /$ {} TagKey dms: assessement-run-tag/$ {} TagKey	写入
DescribeAccountAttributes	授予列出客户账户所有 AWS DMS 属性的权限			读取
DescribeApplicableIndividualAssessments	授予列出可为新迁移前评估运行指定的单个评估的权限	ReplicationInstance	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	读取
DescribeApplicableIndividualAssessments	授予列出可为新迁移前评估运行指定的单个评估的权限	ReplicationTask	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	读取
DescribeCertificates	授予提供证书描述的权限			Read
DescribeConnections	授予描述在复制实例与终端节点之间已建立的连接状态的权限			读取
DescribeConversionConfiguration	授予返回有关 DMS 架构转换项目配置信息的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
DescribeDataMigrations	授予返回指定区域中您账户的数据库迁移信息的权限			读取
DescribeEndpointSettings	授予在为特定数据库引擎创建终端节点时返回可能的终端节点设置的权限			读取
DescribeEndpointTypes	授予返回有关可用终端节点类型的信息的权限			Read
DescribeEndpoints	授予返回有关当前区域账户终端节点信息的权限			读取
DescribeEngineVersions	授予权限以返回 DMS 复制实例可用版本的相关信息			读取
DescribeEventCategories	授予列出所有事件源类型的类别（或如果指定，则列出指定源类型的类别）的权限			Read
DescribeEventSubscriptions	授予列出客户账户的所有订阅描述的权限			Read
DescribeEvents	授予列出给定源标识符和源类型事件的权限			读取
DescribeFleetAdvisorCollectors	授予根据筛选条件设置返回账户中 Fleet Advisor 收集器分页列表的权限			读取
DescribeFleetAdvisorDatabases	授予根据筛选条件设置返回账户中 Fleet Advisor 数据库分页列表的权限			读取
DescribeFleetAdvisorLsaAnalysis	授予返回由 Fleet Advisor 收集器生成的大规模评估 (LSA) 分析描述的分页列表的权限			读取
DescribeFleetAdvisorSchemaObjectSummary	授予返回 Fleet Advisor 收集器根据筛选条件设置发现的架构描述的分页列表的权限			读取
DescribeFleetAdvisorSchemas	授予返回 Fleet Advisor 收集器根据筛选条件设置发现的架构分页列表的权限			读取
DescribeMetadataModel	授予获取有关指定元数据模型的详细信息的权限，包括其定义和目标数据库中相应的转换对象（如果适用）	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
DescribeMetadataModelChildren	授予获取数据库层次结构中指定元数据模型的子元数据模型列表的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
DescribeMetadataModelCreations	授予返回迁移项目元数据模型创建请求的分页列表的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
DescribeMetadataModelImports	授予返回有关启动迁移项目元数据模型导入操作信息的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
DescribeOrderableReplicationInstances	授予返回有关可在指定区域内创建的复制实例类型信息的权限			读取
DescribePendingMaintenanceActions	授予返回待处理维护操作相关信息的权限			读取
DescribeRecommendationLimitations	授予返回目标 AWS 引擎推荐限制的分页列表的权限			读取
DescribeRecommendations	授予权限以返回源数据库的目标引擎推荐说明的分页列表			读取
DescribeRefreshSchemasStatus	授予返回 RefreshSchemas 操作状态的权限	端点*	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey	读取
DescribeReplicationConfigs	授予描述复制配置的权限			读取
DescribeReplicationInstanceTaskLogs	授予返回有关指定任务的任务日志信息的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey aws：TagKeys dms: rep-tag/$ {} TagKey	读取
DescribeReplicationInstances	授予返回有关当前区域中账户的复制实例信息的权限			Read
DescribeReplicationSubnetGroups	授予返回有关复制子网组信息的权限			读取
DescribeReplicationTableStatistics	授予描述复制表统计信息的权限	ReplicationConfig*	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey	读取
DescribeReplicationTaskAssessmentResults	授予从 Amazon S3 返回最新任务评估结果的权限	ReplicationTask	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	读取
DescribeReplicationTaskAssessmentRuns	授予根据过滤器设置返回迁移前评估运行的分页列表的权限	ReplicationInstance	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	读取
		ReplicationTask	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey
		ReplicationTaskAssessmentRun	aws: ResourceTag /$ {} TagKey dms: assessement-run-tag/$ {} TagKey
DescribeReplicationTaskIndividualAssessments	授予根据筛选条件设置返回单个评估的分页列表的权限	ReplicationTask	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	读取
DescribeReplicationTaskIndividualAssessments	授予根据筛选条件设置返回单个评估的分页列表的权限	ReplicationTaskAssessmentRun	aws: ResourceTag /$ {} TagKey dms: assessement-run-tag/$ {} TagKey	读取
DescribeReplicationTasks	授予返回有关您账户在当前区域的复制任务信息的权限			读取
DescribeReplications	授予描述复制的权限			读取
DescribeSchemas	授予返回有关指定终端节点的架构信息的权限	端点*	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey	读取
DescribeTableStatistics	授予返回有关数据库迁移任务的表统计数据（包括表名称、插入的行、更新的行和删除的行）的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	读取
ExportMetadataModelAssessment	授予权限以导出指定的元数据模型评估	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
GetTargetSelectionRules	授予将源选择规则转换为目标对应规则以进行架构转换操作的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
ImportCertificate	授予上传指定证书的权限	证书*	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: cert-tag/$ {} TagKey	写入
ListDataProviders	授予列出数据提供者的 AWS DMS 属性的权限			读取
ListExtensionPacks	授予列出扩展包的 AWS DMS 属性的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
ListInstanceProfiles	授予列出实例配置文件的 AWS DMS 属性的权限	InstanceProfile	aws: ResourceTag /$ {} TagKey dms: instance-profile-tag/$ {} TagKey	读取
ListMetadataModelAssessments	授予列出元数据模型评估的 AWS DMS 属性的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
ListMetadataModelConversions	授予列出元数据模型转换的 AWS DMS 属性的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
ListMetadataModelExports	授予列出元数据模型导出的 AWS DMS 属性的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
ListMigrationProjects	授予列出迁移 AWS 项目的 DMS 属性的权限	DataProvider	aws: ResourceTag /$ {} TagKey dms: data-provider-tag/$ {} TagKey	读取
		InstanceProfile	aws: ResourceTag /$ {} TagKey dms: instance-profile-tag/$ {} TagKey
		MigrationProject	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey
ListTagsForResource	授予列出 AWS DMS 资源所有标签的权限	证书	aws: ResourceTag /$ {} TagKey dms: cert-tag/$ {} TagKey	读取
		DataMigration	aws: ResourceTag /$ {} TagKey dms: data-migration-tag/$ {} TagKey
		DataProvider	aws: ResourceTag /$ {} TagKey dms: data-provider-tag/$ {} TagKey
		Endpoint	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey
		EventSubscription	aws: ResourceTag /$ {} TagKey dms: es-tag/$ {} TagKey
		InstanceProfile	aws: ResourceTag /$ {} TagKey dms: instance-profile-tag/$ {} TagKey
		MigrationProject	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey
		ReplicationConfig	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey
		ReplicationInstance	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey
		ReplicationSubnetGroup	aws: ResourceTag /$ {} TagKey dms: subgrp-tag/$ {} TagKey
		ReplicationTask	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey
		ReplicationTaskAssessmentRun	aws: ResourceTag /$ {} TagKey dms: assessement-run-tag/$ {} TagKey
		ReplicationTaskIndividualAssessment	aws: ResourceTag /$ {} TagKey dms: 个人评估标签/$ {} TagKey
ModifyDataMigration	授予修改指定的数据库迁移的权限	DataMigration*	aws: ResourceTag /$ {} TagKey dms: data-migration-tag/$ {} TagKey	写入
ModifyEndpoint	授予权限以修改指定端点	证书	aws: ResourceTag /$ {} TagKey dms: cert-tag/$ {} TagKey	写入
ModifyEndpoint	授予权限以修改指定端点	端点*	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey	写入
ModifyEventSubscription	授予修改现有 AWS DMS 事件通知订阅的权限	EventSubscription*	aws: ResourceTag /$ {} TagKey dms: es-tag/$ {} TagKey	写入
ModifyReplicationConfig	授予修改指定的复制配置的权限	ReplicationConfig*	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey	写入
ModifyReplicationInstance	授予修改复制实例以应用新设置的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	写入
ModifyReplicationSubnetGroup	授予修改指定复制子网组设置的权限	ReplicationSubnetGroup*	aws: ResourceTag /$ {} TagKey dms: subgrp-tag/$ {} TagKey	写入
ModifyReplicationTask	授予修改指定复制任务的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
MoveReplicationTask	授予将指定复制任务移动到其他复制实例的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	写入
MoveReplicationTask	授予将指定复制任务移动到其他复制实例的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
RebootReplicationInstance	授予重启复制实例的权限。重启将导致暂时中断，直到复制实例再次变为可用	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	写入
RefreshSchemas	授予为指定终端节点填充架构的权限	端点*	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey	写入
RefreshSchemas	授予为指定终端节点填充架构的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	写入
ReloadReplicationTables	授予使用复制源重新加载目标数据库表的权限	ReplicationConfig*	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey	写入
ReloadTables	授予使用源数据重新加载目标数据库表的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
RemoveTagsFromResource	授予从 DMS 资源中删除元数据标签的权限	证书	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: cert-tag/$ {} TagKey	标记、写作
		DataMigration	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: data-migration-tag/$ {} TagKey
		DataProvider	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: data-provider-tag/$ {} TagKey
		Endpoint	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: endpoint-tag/$ {} TagKey
		EventSubscription	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: es-tag/$ {} TagKey
		InstanceProfile	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: instance-profile-tag/$ {} TagKey
		MigrationProject	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: migration-project-tag/$ {} TagKey
		ReplicationConfig	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: replication-config-tag/$ {} TagKey
		ReplicationInstance	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: rep-tag/$ {} TagKey
		ReplicationSubnetGroup	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: subgrp-tag/$ {} TagKey
		ReplicationTask	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: task-tag/$ {} TagKey
		ReplicationTaskAssessmentRun	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: assessement-run-tag/$ {} TagKey
		ReplicationTaskIndividualAssessment	aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: 个人评估标签/$ {} TagKey
RunFleetAdvisorLsaAnalysis	授予对账户中的每个 Fleet Advisor 收集器进行大规模评估 (LSA) 分析的权限			写入
StartDataMigration	授予启动数据库迁移的权限	DataMigration*	aws: ResourceTag /$ {} TagKey dms: data-migration-tag/$ {} TagKey	写入
StartMetadataModelAssessment	授予权限以启动元数据模型的新评估	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
StartMetadataModelConversion	授予权限以启动元数据模型的新转换	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
StartMetadataModelCreation	授予使用架构转换操作的指定属性创建给定类型的源元数据模型的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
StartMetadataModelExportAsScripts	授予权限以将元数据模型的新导出作为脚本启动	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
StartMetadataModelExportToTarget	授予权限以将元数据模型的新导出启动到目标	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
StartMetadataModelImport	授予权限以启动元数据模型的新导入	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
StartRecommendations	授予权限以启动对源数据库的分析，从而提供目标引擎的建议			写入
StartReplication	授予启动复制的权限	ReplicationConfig*	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey	写入
StartReplicationTask	授予启动复制任务的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
StartReplicationTaskAssessment	授予为源数据库中的不支持的数据类型启动复制任务评估的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
StartReplicationTaskAssessmentRun	授予为迁移任务的一个或多个单独评估启动新的迁移前评估运行的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
StopDataMigration	授予停止数据库迁移的权限	DataMigration*	aws: ResourceTag /$ {} TagKey dms: data-migration-tag/$ {} TagKey	写入
StopReplication	授予停止复制的权限	ReplicationConfig*	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey	写入
StopReplicationTask	授予停止复制任务的权限	ReplicationTask*	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey	写入
TestConnection	授予测试复制实例和终端节点之间连接的权限	端点*	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey	读取
TestConnection	授予测试复制实例和终端节点之间连接的权限	ReplicationInstance*	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey	读取
UpdateConversionConfiguration	授予权限以更新转换配置	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
UpdateDataProvider	授予权限以更新指定的数据提供程序	DataProvider*	aws: ResourceTag /$ {} TagKey dms: data-provider-tag/$ {} TagKey	写入
UpdateInstanceProfile	授予权限以更新指定的实例配置文件	InstanceProfile*	aws: ResourceTag /$ {} TagKey dms: instance-profile-tag/$ {} TagKey	写入
UpdateMigrationProject	授予权限以更新指定的迁移项目	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	写入
UpdateSubscriptionsToEventBridge	授予将 DMS 订阅迁移到 Eventbridge 的权限			写入

Permission-only 的动作 AWS Database Migration Service

以下操作由 AWS Database Migration Service 定义，但不能通过任何 API 操作直接调用。它们只能在 IAM 策略声明中用于授予或拒绝权限。

操作	说明	资源类型（* 为必需）	条件键	访问级别
CreateOutboundIntegration	授予 DMS 创建资源以实现与自管理数据库的零 ETL 集成的权限		aws: RequestTag /$ {} TagKey aws: ResourceTag /$ {} TagKey aws：TagKeys dms: req-tag/$ {} TagKey	写入
GetMetadataModel	授予列出元数据模型所有 AWS DMS 属性的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
ListMetadataModelAssessmentActionItems	授予列出元数据模型评估措施项的 AWS DMS 属性的权限	MigrationProject*	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey	读取
ModifyFleetAdvisorCollector	授予修改指定 Fleet Advisor 收集器的名称和描述的权限			写入
ModifyFleetAdvisorCollectorStatuses	授予修改指定 Fleet Advisor 收集器状态的权限			写入
ModifyOutboundIntegration	授予 DMS 修改资源的权限，以实现与自管理数据库的零 ETL 集成			写入
UploadFileMetadataList	授予将文件上传到 Amazon S3 桶的权限			写入

定义的资源类型 AWS Database Migration Service

以下资源类型是由该服务定义的，可以在 IAM 权限策略语句的 Resource 元素中使用这些资源类型。

资源类型	ARN	条件键
证书	arn: $ {Partition}: dms: $ {Region}: $ {Account}: cert: *	aws: ResourceTag /$ {} TagKey dms: cert-tag/$ {} TagKey
DataMigration	arn: $ {Partition}: dms: $ {Region}: $ {账户}: 数据迁移:*	aws: ResourceTag /$ {} TagKey dms: data-migration-tag/$ {} TagKey
DataProvider	arn: $ {Partition}: dms: $ {Region}: $ {Account}: data-provider: *	aws: ResourceTag /$ {} TagKey dms: data-provider-tag/$ {} TagKey
端点	arn: $ {Partition}: dms: $ {Region}: $ {Account}: endpoint: *	aws: ResourceTag /$ {} TagKey dms: endpoint-tag/$ {} TagKey
EventSubscription	arn: $ {Partition}: dms: $ {Region}: $ {Account}: es: *	aws: ResourceTag /$ {} TagKey dms: es-tag/$ {} TagKey
InstanceProfile	arn: $ {Partition}: dms: $ {Region}: $ {Account}: instance-profile: *	aws: ResourceTag /$ {} TagKey dms: instance-profile-tag/$ {} TagKey
MigrationProject	arn: $ {Partition}: dms: $ {Region}: $ {Account}: migration-project: *	aws: ResourceTag /$ {} TagKey dms: migration-project-tag/$ {} TagKey
ReplicationConfig	arn: $ {Partition}: dms: $ {Region}: $ {Account}: replication-config: *	aws: ResourceTag /$ {} TagKey dms: replication-config-tag/$ {} TagKey
ReplicationInstance	arn: $ {Partition}: dms: $ {Region}: $ {Account}: rep: *	aws: ResourceTag /$ {} TagKey dms: rep-tag/$ {} TagKey
ReplicationSubnetGroup	arn: $ {Partition}: dms: $ {Region}: $ {Account}: subgrp: *	aws: ResourceTag /$ {} TagKey dms: subgrp-tag/$ {} TagKey
ReplicationTask	arn: $ {Partition}: dms: $ {Region}: $ {Account}: task: *	aws: ResourceTag /$ {} TagKey dms: task-tag/$ {} TagKey
ReplicationTaskAssessmentRun	arn: $ {Partition}: dms: $ {Region}: $ {Account}: assessiment-run: *	aws: ResourceTag /$ {} TagKey dms: assessement-run-tag/$ {} TagKey
ReplicationTaskIndividualAssessment	arn: $ {Partition}: dms: $ {Region}: $ {账户}: 个人评估:*	aws: ResourceTag /$ {} TagKey dms: 个人评估标签/$ {} TagKey

的条件键 AWS Database Migration Service

AWS Database Migration Service 定义了以下可用于 IAM 策略Condition元素的条件键。

条件键	描述	类型
aws: RequestTag /$ {} TagKey	根据在请求中是否具有标签键值对来筛选访问权限	字符串
aws: ResourceTag /$ {} TagKey	按是否存在附加到资源的标签键值对筛选访问权限	字符串
aws：TagKeys	根据在请求中是否具有标签键来筛选访问	ArrayOfString
dms: assessement-run-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 AssessmentRun	字符串
dms: cert-tag/$ {} TagKey	根据在 Certificate 请求中是否具有标签键值对来筛选访问权限	字符串
dms: data-migration-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 DataMigration	字符串
dms: data-provider-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 DataProvider	字符串
dms: endpoint-tag/$ {} TagKey	根据在 Endpoint 请求中是否具有标签键值对来筛选访问权限	字符串
dms: es-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 EventSubscription	字符串
dms: 个人评估标签/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 IndividualAssessment	字符串
dms: instance-profile-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 InstanceProfile	字符串
dms: migration-project-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 MigrationProject	字符串
dms: rep-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 ReplicationInstance	字符串
dms: replication-config-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 ReplicationConfig	字符串
dms: req-tag/$ {} TagKey	根据在给定请求中是否具有标签键值对来筛选访问权限	字符串
dms: subgrp-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 ReplicationSubnetGroup	字符串
dms: task-tag/$ {} TagKey	根据请求中是否存在标签键值对来筛选访问权限 ReplicationTask	字符串

Javascript 在您的浏览器中被禁用或不可用。

要使用 Amazon Web Services 文档，必须启用 Javascript。请参阅浏览器的帮助页面以了解相关说明。

文档惯例

AWS Data Pipeline（数据管道）

AWS DataSync （数据同步）