AWS managed policy: AWSElasticDisasterRecoveryLaunchActionsPolicy - AWS Elastic Disaster Recovery

AWS managed policy: AWSElasticDisasterRecoveryLaunchActionsPolicy

You can attach the AWSElasticDisasterRecoveryLaunchActionsPolicy policy to your IAM identities.

This policy allows you to use Amazon SSM and additional services required permissions to run post-launch actions in AWS Elastic Disaster Recovery (AWS DRS). Attach this policy to your IAM roles or users.

Permissions details

This policy includes the following permissions.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "LaunchActionsPolicy1", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:DescribeParameters" ], "Resource": [ "*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy2", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*:*:document/*", "arn:aws:ssm:*:*:automation-definition/*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LaunchActionsPolicy3", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm:StartAutomationExecution" ], "Resource": [ "arn:aws:ssm:*::document/AWS-*", "arn:aws:ssm:*::document/AWSCodeDeployAgent-*", "arn:aws:ssm:*::document/AWSConfigRemediation-*", "arn:aws:ssm:*::document/AWSConformancePacks-*", "arn:aws:ssm:*::document/AWSDisasterRecovery-*", "arn:aws:ssm:*::document/AWSDistroOTel-*", "arn:aws:ssm:*::document/AWSDocs-*", "arn:aws:ssm:*::document/AWSEC2-*", "arn:aws:ssm:*::document/AWSEC2Launch-*", "arn:aws:ssm:*::document/AWSFIS-*", "arn:aws:ssm:*::document/AWSFleetManager-*", "arn:aws:ssm:*::document/AWSIncidents-*", "arn:aws:ssm:*::document/AWSKinesisTap-*", "arn:aws:ssm:*::document/AWSMigration-*", "arn:aws:ssm:*::document/AWSNVMe-*", "arn:aws:ssm:*::document/AWSNitroEnclavesWindows-*", "arn:aws:ssm:*::document/AWSObservabilityExporter-*", "arn:aws:ssm:*::document/AWSPVDriver-*", "arn:aws:ssm:*::document/AWSQuickSetupType-*", "arn:aws:ssm:*::document/AWSQuickStarts-*", "arn:aws:ssm:*::document/AWSRefactorSpaces-*", "arn:aws:ssm:*::document/AWSResilienceHub-*", "arn:aws:ssm:*::document/AWSSAP-*", "arn:aws:ssm:*::document/AWSSAPTools-*", "arn:aws:ssm:*::document/AWSSQLServer-*", "arn:aws:ssm:*::document/AWSSSO-*", "arn:aws:ssm:*::document/AWSSupport-*", "arn:aws:ssm:*::document/AWSSystemsManagerSAP-*", "arn:aws:ssm:*::document/AmazonCloudWatch-*", "arn:aws:ssm:*::document/AmazonCloudWatchAgent-*", "arn:aws:ssm:*::document/AmazonECS-*", "arn:aws:ssm:*::document/AmazonEFSUtils-*", "arn:aws:ssm:*::document/AmazonEKS-*", "arn:aws:ssm:*::document/AmazonInspector-*", "arn:aws:ssm:*::document/AmazonInspector2-*", "arn:aws:ssm:*::document/AmazonInternal-*", "arn:aws:ssm:*::document/AwsEnaNetworkDriver-*", "arn:aws:ssm:*::document/AwsVssComponents-*", "arn:aws:ssm:*::automation-definition/AWS-*:*", "arn:aws:ssm:*::automation-definition/AWSCodeDeployAgent-*:*", "arn:aws:ssm:*::automation-definition/AWSConfigRemediation-*:*", "arn:aws:ssm:*::automation-definition/AWSConformancePacks-*:*", "arn:aws:ssm:*::automation-definition/AWSDisasterRecovery-*:*", "arn:aws:ssm:*::automation-definition/AWSDistroOTel-*:*", "arn:aws:ssm:*::automation-definition/AWSDocs-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2-*:*", "arn:aws:ssm:*::automation-definition/AWSEC2Launch-*:*", "arn:aws:ssm:*::automation-definition/AWSFIS-*:*", "arn:aws:ssm:*::automation-definition/AWSFleetManager-*:*", "arn:aws:ssm:*::automation-definition/AWSIncidents-*:*", "arn:aws:ssm:*::automation-definition/AWSKinesisTap-*:*", "arn:aws:ssm:*::automation-definition/AWSMigration-*:*", "arn:aws:ssm:*::automation-definition/AWSNVMe-*:*", "arn:aws:ssm:*::automation-definition/AWSNitroEnclavesWindows-*:*", "arn:aws:ssm:*::automation-definition/AWSObservabilityExporter-*:*", "arn:aws:ssm:*::automation-definition/AWSPVDriver-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickSetupType-*:*", "arn:aws:ssm:*::automation-definition/AWSQuickStarts-*:*", "arn:aws:ssm:*::automation-definition/AWSRefactorSpaces-*:*", "arn:aws:ssm:*::automation-definition/AWSResilienceHub-*:*", "arn:aws:ssm:*::automation-definition/AWSSAP-*:*", "arn:aws:ssm:*::automation-definition/AWSSAPTools-*:*", "arn:aws:ssm:*::automation-definition/AWSSQLServer-*:*", "arn:aws:ssm:*::automation-definition/AWSSSO-*:*", "arn:aws:ssm:*::automation-definition/AWSSupport-*:*", "arn:aws:ssm:*::automation-definition/AWSSystemsManagerSAP-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatch-*:*", "arn:aws:ssm:*::automation-definition/AmazonCloudWatchAgent-*:*", "arn:aws:ssm:*::automation-definition/AmazonECS-*:*", "arn:aws:ssm:*::automation-definition/AmazonEFSUtils-*:*", "arn:aws:ssm:*::automation-definition/AmazonEKS-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector-*:*", "arn:aws:ssm:*::automation-definition/AmazonInspector2-*:*", "arn:aws:ssm:*::automation-definition/AmazonInternal-*:*", "arn:aws:ssm:*::automation-definition/AwsEnaNetworkDriver-*:*", "arn:aws:ssm:*::automation-definition/AwsVssComponents-*:*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy4", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] }, "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "LaunchActionsPolicy5", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*" ], "Condition": { "Null": { "aws:ResourceTag/AWSDRS": "false" }, "StringEquals": { "aws:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance" }, "ForAnyValue:StringEquals": { "aws:CalledVia": [ "drs.amazonaws.com" ] } } }, { "Sid": "LaunchActionsPolicy6", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListCommandInvocations" ], "Resource": "*" }, { "Sid": "LaunchActionsPolicy7", "Effect": "Allow", "Action": [ "ssm:ListDocumentVersions", "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": "arn:aws:ssm:*:*:document/*" }, { "Sid": "LaunchActionsPolicy8", "Effect": "Allow", "Action": [ "ssm:GetAutomationExecution" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "Null": { "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false" } } }, { "Sid": "LaunchActionsPolicy9", "Effect": "Allow", "Action": [ "ssm:GetParameters" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm.amazonaws.com" } } }, { "Sid": "LaunchActionsPolicy10", "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:PutParameter" ], "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LaunchActionsPolicy11", "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" }, "ForAnyValue:StringEquals": { "aws:CalledVia": "drs.amazonaws.com" } } } ] }