AWS managed policy: AWSApplicationMigrationReplicationServerPolicy

This policy is attached to the AWS Application Migration Service replication server’s instance role.

This policy allows the AWS Application Migration Service (AWS MGN) Replication Servers, which are EC2 instances launched by AWS Application Migration Service - to communicate with the AWS MGN service, and to create EBS snapshots in your AWS account. An IAM role with this policy is attached (as an EC2 Instance Profile) by AWS Application Migration Service to the AWS MGN replication servers which are automatically launched and terminated by AWS MGN, as needed. AWS MGN Replication Servers are used to facilitate data replication from your external servers to AWS, as part of the migration process managed using AWS MGN. We do not recommend that you attach this policy to your users or roles.

Permissions details

This policy includes the following permissions.

{
        "Version": "2012-10-17",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "mgn:SendClientMetricsForMgn",
                                "mgn:SendClientLogsForMgn",
                                "mgn:GetChannelCommandsForMgn",
                                "mgn:SendChannelCommandResultForMgn",
                                "mgn:GetAgentSnapshotCreditsForMgn",
                                "mgn:DescribeReplicationServerAssociationsForMgn",
                                "mgn:DescribeSnapshotRequestsForMgn",
                                "mgn:BatchDeleteSnapshotRequestForMgn",
                                "mgn:NotifyAgentAuthenticationForMgn",
                                "mgn:BatchCreateVolumeSnapshotGroupForMgn",
                                "mgn:UpdateAgentReplicationProcessStateForMgn",
                                "mgn:NotifyAgentReplicationProgressForMgn",
                                "mgn:NotifyAgentConnectedForMgn",
                                "mgn:NotifyAgentDisconnectedForMgn"
                        ],
                        "Resource": "*"
                },
                {
                        "Effect": "Allow",
                        "Action": [
                                "ec2:DescribeInstances",
                                "ec2:DescribeSnapshots"
                        ],
                        "Resource": "*"
                },
                {
                        "Effect": "Allow",
                        "Action": [
                                "ec2:CreateSnapshot"
                        ],
                        "Resource": "arn:aws:ec2:*:*:volume/*",
                        "Condition": {
                                "Null": {
                                        "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
                                }
                        }
                },
                {
                        "Effect": "Allow",
                        "Action": [
                                "ec2:CreateSnapshot"
                        ],
                        "Resource": "arn:aws:ec2:*:*:snapshot/*",
                        "Condition": {
                                "Null": {
                                        "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
                                }
                        }
                },
                {
                        "Effect": "Allow",
                        "Action": "ec2:CreateTags",
                        "Resource": "*",
                        "Condition": {
                                "StringEquals": {
                                        "ec2:CreateAction": "CreateSnapshot"
                                }
                        }
                }
        ]
}