AWS managed policy: AWSApplicationMigrationServiceRolePolicy

This policy is attached to the AWS MGN Service-Linked Role (SLR). Learn more.

This policy allows AWS Application Migration Service to manage AWS resources on your behalf.

Permissions details

This policy includes the following permissions.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "mgn:ListTagsForResource",
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": "kms:ListRetirableGrants",
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"mgh:AssociateCreatedArtifact",
				"mgh:CreateProgressUpdateStream",
				"mgh:DisassociateCreatedArtifact",
				"mgh:GetHomeRegion",
				"mgh:ImportMigrationTask",
				"mgh:NotifyMigrationTaskState",
				"mgh:PutResourceAttributes"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeAccountAttributes",
				"ec2:DescribeAvailabilityZones",
				"ec2:DescribeImages",
				"ec2:DescribeInstances",
				"ec2:DescribeInstanceTypes",
				"ec2:DescribeInstanceAttribute",
				"ec2:DescribeInstanceStatus",
				"ec2:DescribeLaunchTemplateVersions",
				"ec2:DescribeLaunchTemplates",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeSnapshots",
				"ec2:DescribeSubnets",
				"ec2:DescribeVolumes",
				"ec2:GetEbsDefaultKmsKeyId",
				"ec2:GetEbsEncryptionByDefault"
			],
			"Resource": "*"
		},
                {
                        "Effect": "Allow",
                        "Action": [
                                "organizations:DescribeAccount"
                        ],
                        "Resource": "arn:aws:organizations::*:account/*"
                },
		{
			"Effect": "Allow",
			"Action": [
				"organizations:DescribeOrganization",
				"organizations:ListAWSServiceAccessForOrganization",
				"organizations:ListDelegatedAdministrators",
				"organizations:ListAccounts"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:RegisterImage",
				"ec2:DeregisterImage"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:DeleteSnapshot"
			],
			"Resource": "arn:aws:ec2:*:*:snapshot/*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateLaunchTemplateVersion",
				"ec2:ModifyLaunchTemplate",
				"ec2:DeleteLaunchTemplate",
				"ec2:DeleteLaunchTemplateVersions"
			],
			"Resource": "arn:aws:ec2:*:*:launch-template/*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:DeleteVolume"
			],
			"Resource": "arn:aws:ec2:*:*:volume/*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:StartInstances",
				"ec2:StopInstances",
				"ec2:TerminateInstances",
				"ec2:ModifyInstanceAttribute",
				"ec2:GetConsoleOutput",
				"ec2:GetConsoleScreenshot"
			],
			"Resource": "arn:aws:ec2:*:*:instance/*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:RevokeSecurityGroupEgress",
				"ec2:AuthorizeSecurityGroupIngress",
				"ec2:AuthorizeSecurityGroupEgress"
			],
			"Resource": "arn:aws:ec2:*:*:security-group/*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateVolume"
			],
			"Resource": "arn:aws:ec2:*:*:volume/*",
			"Condition": {
				"Null": {
					"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSecurityGroup"
			],
			"Resource": "arn:aws:ec2:*:*:security-group/*",
			"Condition": {
				"Null": {
					"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSecurityGroup"
			],
			"Resource": "arn:aws:ec2:*:*:vpc/*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateLaunchTemplate"
			],
			"Resource": "arn:aws:ec2:*:*:launch-template/*",
			"Condition": {
				"Null": {
					"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSnapshot"
			],
			"Resource": "arn:aws:ec2:*:*:volume/*",
			"Condition": {
				"Null": {
					"ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSnapshot"
			],
			"Resource": "arn:aws:ec2:*:*:snapshot/*",
			"Condition": {
				"Null": {
					"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:DetachVolume",
				"ec2:AttachVolume"
			],
			"Resource": "arn:aws:ec2:*:*:instance/*",
			"Condition": {
				"Null": {
					"ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:AttachVolume"
			],
			"Resource": "arn:aws:ec2:*:*:volume/*",
			"Condition": {
				"Null": {
					"ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:DetachVolume"
			],
			"Resource": "arn:aws:ec2:*:*:volume/*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:RunInstances"
			],
			"Resource": "arn:aws:ec2:*:*:instance/*",
			"Condition": {
				"Null": {
					"aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:RunInstances"
			],
			"Resource": [
				"arn:aws:ec2:*:*:security-group/*",
				"arn:aws:ec2:*:*:volume/*",
				"arn:aws:ec2:*:*:subnet/*",
				"arn:aws:ec2:*:*:image/*",
				"arn:aws:ec2:*:*:network-interface/*",
				"arn:aws:ec2:*:*:launch-template/*"
			]
		},
		{
			"Effect": "Allow",
			"Action": "iam:PassRole",
			"Resource": [
				"arn:aws:iam::*:role/service-role/AWSApplicationMigrationReplicationServerRole",
				"arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole"
			],
			"Condition": {
				"StringEquals": {
					"iam:PassedToService": "ec2.amazonaws.com"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": "ec2:CreateTags",
			"Resource": [
				"arn:aws:ec2:*:*:launch-template/*",
				"arn:aws:ec2:*:*:security-group/*",
				"arn:aws:ec2:*:*:volume/*",
				"arn:aws:ec2:*:*:snapshot/*",
				"arn:aws:ec2:*:*:instance/*"
			],
			"Condition": {
				"StringEquals": {
					"ec2:CreateAction": [
						"CreateLaunchTemplate",
						"CreateSecurityGroup",
						"CreateVolume",
						"CreateSnapshot",
						"RunInstances"
					]
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:CreateTags",
				"ec2:ModifyVolume"
			],
			"Resource": [
				"arn:aws:ec2:*:*:volume/*"
			],
			"Condition": {
				"Null": {
					"ec2:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
				}
			}
		}
	]
}