Initializing AWS Application Migration Service with the API

In order to use AWS Application Migration Service (Application Migration Service), the service must first be initialized for any AWS Region in which you plan to use Application Migration Service.

You can initialize the service via the console or via the API.

During the initialization process:

You can initialize AWS Application Migration Service through the API. This option allows you to automate service initialization through a script when initializing multiple accounts.

You can also initialize Application Migration Service using the console. For more information, see Initializing Application Migration Service with the console.

To initialize the service via the API, take the following steps:

Creating the required IAM roles

To initialize Application Migration Service with the API, create the following IAM roles through the IAM CreateRoleAPI. Learn more about creating IAM roles in the AWS IAM documentation. Creation of each role must include the following parameters:

Example using the AWS Command Line Interface without a source identity:

aws iam create-role --path "/service-role/" --role-name AWSApplicationMigrationReplicationServerRole --assume-role-policy-document 
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

After the roles have been created, attach the following AWS managed policies to the roles through the IAM AttachRolePolicy API. Learn more about adding and removing IAM identity permissions in the AWS IAM documentation.

Example of attach policy, aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/service-role/AWSApplicationMigrationReplicationServerPolicy --role-name AWSApplicationMigrationReplicationServerRole

Example using the AWS CLI with a source identity:

aws iam create-role --path "/service-role/" --role-name AWSApplicationMigrationAgentRole --assume-role-policy-document
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "mgn.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:SetSourceIdentity"
      ],
      "Condition": {
        "StringLike": {
          "sts:SourceIdentity": "s-*",
          "aws:SourceAccount": "<SOURCE-ACCOUNT-ID>"
        }
      }
    }
  ]
}
   

Once the policies are attached to the roles, run the aws mgn initialize-service command. This will automatically create the service-linked role, create instance profiles, add Roles to Instance Profiles, and will finish service initialization.

Learn more about AWS Application Migration Service roles and managed policies.

Creating the templates

To finalize the initialization process, you will need to create the replication template and launch template by running the following commands: