AWSMigrationHubOrchestratorServiceRolePolicy
Description: Provides permissions necessary for Migration Hub Orchestrator to migrate and modernize your on-premises workloads
AWSMigrationHubOrchestratorServiceRolePolicy is an AWS managed policy.
Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
Policy details
-
Type: Service-linked role policy
-
Creation time: April 20, 2022, 02:24 UTC
-
Edited time: March 04, 2024, 18:25 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AWSMigrationHubOrchestratorServiceRolePolicy
Policy version
Policy version: v4 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "ApplicationDiscoveryService", "Effect" : "Allow", "Action" : [ "discovery:DescribeConfigurations", "discovery:ListConfigurations" ], "Resource" : "*" }, { "Sid" : "LaunchWizard", "Effect" : "Allow", "Action" : [ "launchwizard:ListProvisionedApps", "launchwizard:DescribeProvisionedApp", "launchwizard:ListDeployments", "launchwizard:GetDeployment" ], "Resource" : "*" }, { "Sid" : "EC2instances", "Effect" : "Allow", "Action" : [ "ec2:DescribeInstances" ], "Resource" : "*" }, { "Sid" : "ec2MGNLaunchTemplate", "Effect" : "Allow", "Action" : [ "ec2:CreateLaunchTemplateVersion", "ec2:ModifyLaunchTemplate" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/AWSApplicationMigrationServiceManaged" : "mgn.amazonaws.com" } } }, { "Sid" : "ec2LaunchTemplates", "Effect" : "Allow", "Action" : [ "ec2:DescribeLaunchTemplates" ], "Resource" : "*" }, { "Sid" : "getHomeRegion", "Action" : [ "mgh:GetHomeRegion" ], "Effect" : "Allow", "Resource" : "*" }, { "Sid" : "SSMcommand", "Effect" : "Allow", "Action" : [ "ssm:SendCommand", "ssm:GetCommandInvocation", "ssm:CancelCommand" ], "Resource" : [ "arn:aws:ssm:*::document/AWS-RunRemoteScript", "arn:aws:ec2:*:*:instance/*", "arn:aws:s3:::aws-migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*" ] }, { "Sid" : "SSM", "Effect" : "Allow", "Action" : [ "ssm:DescribeInstanceInformation", "ssm:GetCommandInvocation" ], "Resource" : [ "*" ] }, { "Sid" : "s3GetObject", "Effect" : "Allow", "Action" : [ "s3:GetObject" ], "Resource" : [ "arn:aws:s3:::migrationhub-orchestrator-*", "arn:aws:s3:::migrationhub-orchestrator-*/*" ] }, { "Sid" : "EventBridge", "Effect" : "Allow", "Action" : [ "events:PutTargets", "events:DescribeRule", "events:DeleteRule", "events:PutRule", "events:RemoveTargets" ], "Resource" : "arn:aws:events:*:*:rule/MigrationHubOrchestratorManagedRule*" }, { "Sid" : "MGN", "Effect" : "Allow", "Action" : [ "mgn:GetReplicationConfiguration", "mgn:GetLaunchConfiguration", "mgn:StartCutover", "mgn:FinalizeCutover", "mgn:StartTest", "mgn:UpdateReplicationConfiguration", "mgn:DescribeSourceServers", "mgn:MarkAsArchived", "mgn:ChangeServerLifeCycleState" ], "Resource" : "*" }, { "Sid" : "ec2DescribeImportImage", "Effect" : "Allow", "Action" : [ "ec2:DescribeImportImageTasks" ], "Resource" : "*" }, { "Sid" : "s3ListBucket", "Effect" : "Allow", "Action" : "s3:ListBucket", "Resource" : "arn:aws:s3:::*", "Condition" : { "StringLike" : { "s3:prefix" : "migrationhub-orchestrator-vmie-*" } } } ] }
Learn more
