Exporting your data inventory

Questa pagina non è tradotta nella tua lingua. Richiedi traduzione

The Export feature allows you to easily export your inventory of servers, applications, and waves to a CSV file that is saved in your local disk or an S3 bucket.

Defining required permissions for export

In order to use the export feature, you will need to create a role with the following policies (or any extension of them):

Managed policies:

• AWSApplicationMigrationReadOnlyAccess

Additional policies:

{
  "Sid":  "AllowS3Access",
   "Effect":  "Allow",
   "Action": [
     "s3:GetObject"
  ],
   "Resource":  "arn:aws:s3:::your-bucket/*"
},
{
   "Sid": "AllowMgnStartExport",
   "Effect": "Allow",
   "Action": [
     "mgn:StartExport"
  ],
   "Resource": "*"
}

When starting an export on an Amazon S3 bucket source that is owned by another account, ensure that the role or user has access to the Amazon S3 objects. When using the API, the Amazon S3 bucket owner parameter defaults to the current user’s account ID.

The following is an example of an Amazon S3 bucket policy in the target account:

{
  "Version":  "2012-10-17",
   "Statement": [
    {
       "Sid":  "ExampleStatement",
       "Effect":  "Allow",
       "Principal": {
         "AWS":  "arn:aws:iam::123456789012:user/Dave"
      },
       "Action": [
         "s3:PutObject"
      ],
       "Resource":  "arn:aws:s3:::awsexamplebucket1/*"
    }
  ]
}

Note

If the Amazon S3 objects are encrypted with SSE-KMS, ensure that the role or user initiating the export has access to decrypt using the AWS KMS key. This feature does not support SSE-C encrypted Amazon S3 objects.

Required Amazon S3 bucket permissions

Before you create an export job, you must create the destination S3 bucket to export to. AWS Application Migration Service doesn't create the S3 bucket for you. The S3 bucket that you specify can't be publicly accessible, and can't be configured as a Requester Pays bucket. After you create the S3 bucket, confirm that the bucket has the required permissions policy to allow AWS Application Migration Service to write the export files to it.

Export parameters

The exported file can include multiple parameters, including:

Parameter	Description
mgn:account-id	The ID of the account being exported.
mgn:app:description	The description of the application being exported.
mgn:app:id	The ID of the application being exported.
mgn:app:name	The name of the application being exported.
mgn:app:tag:appkey1	The value of the application tag key (in this example, the tag key is appkey1).
mgn:launch:iam-instance-profile:name	The name of the instance profile associated with the launch instance.
mgn:launch:instance-type	The EC2 instance type of the launch instance (for example, m4.large).
mgn:launch:nic:0:network-interface-id	The ID of the network interface that appears first in the launch template ("0" refers to the first network interface, "1" would refer to the second network interface, and so on).
mgn:launch:nic:0:private-ip:0	The private IP that appears first in the network interface that appears first in the launch template.
mgn:launch:nic:0:security-group-id:0	The security group that appears first in the network interface that appears first in the launch template.
mgn:launch:nic:0:subnet-id	The subnet ID that appears first in the network interface that appears first in the launch template.
mgn:launch:placement:host-id	The host ID of the placement of the launch instance.
mgn:launch:placement:tenancy	This tenancy of the launch instance. Expected values: default, dedicated, or host.
mgn:launch:tag:instance:key1	The value of launch instance tag "key1" (in this example, the tag key is key1).
mgn:launch:volume:/dev/sda:type	The type of the launch instance's volume whose name is /dev/sda (in this example, the volume's name is /dev/sda).
mgn:region	The AWS Region to which you are importing, which must be the Region of your MGN console. If left blank, defaults to the console Region.
mgn:server:fqdn-for-action-framework	The FQDN that the MGN connector uses to connect to the server.
mgn:server:id	The server ID.
mgn:server:lifecycle-state	The server's lifecycle state.
mgn:server:platform	The server's platform (Linux or Windows).
mgn:server:replication-type	The type of the replication (agent-based or agentless).
mgn:server:replication-state	The state of the replication.
mgn:server:tag:serverkey1	The value of the server tag key (in this example, the tag key is serverkey1).
mgn:server:user-provided-id	The server's user-provided ID. The MGN connector uses this parameter when installing the AWS replication agent on the server.
mgn:wave:description	The description of the exported wave.
mgn:wave:id	The ID of the exported wave.
mgn:wave:name	The name of the exported wave.
mgn:wave:tag:appkey1	The value of the wave tag key (in this example, the tag key is appkey1).
mgn:launch:transfer-server-tags	The option to transfer any user-configured custom tags from your source servers onto your test or cutover instance.

Note

If the bucket you're exporting to is encrypted with customer managed keys (KMS), that KMS key's policies must give AWS MGN permission to use it. This permission is given through the user or role that initiates the export job.

If you choose to encrypt your export using a key protected by AWS Key Management Service (AWS KMS), the key must be in the same Region as the destination S3 bucket.