# AWSTransformNetworkMigrationAgentPolicy
**Description**: Grants permissions for AWS Transform to deploy and configure network infrastructure including VPCs, Transit Gateways, and route tables for network migration
`AWSTransformNetworkMigrationAgentPolicy` is an [AWS managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Using this policy
You can attach `AWSTransformNetworkMigrationAgentPolicy` to your users, groups, and roles.
## Policy details
+ **Type**: AWS managed policy
+ **Creation time**: August 06, 2026, 15:27 UTC
+ **Edited time:** August 06, 2026, 15:27 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy`
## Policy version
**Policy version:** v1 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
## JSON policy document
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "CfnNetworkMigrationStackCreate",
"Effect" : "Allow",
"Action" : [
"cloudformation:CreateStack"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "CfnNetworkMigrationStackDescribeStacks",
"Effect" : "Allow",
"Action" : [
"cloudformation:DescribeStacks"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "CfnNetworkMigrationStackListStacks",
"Effect" : "Allow",
"Action" : [
"cloudformation:ListStacks"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "CfnNetworkMigrationStackOperationsWrite",
"Effect" : "Allow",
"Action" : [
"cloudformation:DeleteStack",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplateSummary",
"cloudformation:ListStackResources",
"cloudformation:UpdateStack",
"cloudformation:UpdateTerminationProtection"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "Ec2NetworkProvisionCreate",
"Effect" : "Allow",
"Action" : [
"ec2:AllocateAddress",
"ec2:CreateInternetGateway",
"ec2:CreateTransitGateway",
"ec2:CreateVpc"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "Ec2NetworkTopologyOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:GetSubnetCidrReservations"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "Ec2TagOnCreateNetworkMigration",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
"arn:aws:ec2:*:*:network-insights-access-scope/*",
"arn:aws:ec2:*:*:network-insights-analysis/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:security-group-rule/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
"arn:aws:ec2:*:*:transit-gateway-policy-table/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"ec2:CreateAction" : [
"AllocateAddress",
"CreateInternetGateway",
"CreateNatGateway",
"CreateNetworkInsightsAccessScope",
"CreateNetworkInsightsPath",
"CreateNetworkInterface",
"CreateRouteTable",
"CreateSecurityGroup",
"CreateSubnet",
"CreateTransitGateway",
"CreateTransitGatewayConnect",
"CreateTransitGatewayConnectPeer",
"CreateTransitGatewayPeeringAttachment",
"CreateTransitGatewayPolicyTable",
"CreateTransitGatewayPrefixListReference",
"CreateTransitGatewayRoute",
"CreateTransitGatewayRouteTable",
"CreateTransitGatewayRouteTableAnnouncement",
"CreateTransitGatewayVpcAttachment",
"CreateVpc",
"StartNetworkInsightsAnalysis"
]
}
}
},
{
"Sid" : "Ec2ViaCfnCrossOrgTgwAttachmentCreate",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource" : [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceOrgID" : "${aws:PrincipalOrgID}"
}
}
},
{
"Sid" : "Ec2ViaCfnNetworkOperationsWrite",
"Effect" : "Allow",
"Action" : [
"ec2:AcceptTransitGatewayVpcAttachment",
"ec2:AssociateNatGatewayAddress",
"ec2:AssociateRouteTable",
"ec2:AssociateSubnetCidrBlock",
"ec2:AssociateTransitGatewayRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteInternetGateway",
"ec2:DeleteLaunchTemplate",
"ec2:DeleteLaunchTemplateVersions",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkInsightsAnalysis",
"ec2:DeleteNetworkInsightsPath",
"ec2:DeleteNetworkInterface",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSubnet",
"ec2:DeleteTransitGateway",
"ec2:DeleteTransitGatewayRoute",
"ec2:DeleteTransitGatewayRouteTable",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DisableTransitGatewayRouteTablePropagation",
"ec2:DisassociateNatGatewayAddress",
"ec2:DisassociateRouteTable",
"ec2:DisassociateTransitGatewayRouteTable",
"ec2:EnableTransitGatewayRouteTablePropagation",
"ec2:ModifySubnetAttribute",
"ec2:ModifyTransitGateway",
"ec2:ModifyTransitGatewayVpcAttachment",
"ec2:ModifyVpcAttribute",
"ec2:RejectTransitGatewayVpcAttachment",
"ec2:ReleaseAddress",
"ec2:ReplaceRoute",
"ec2:ReplaceTransitGatewayRoute",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:SearchTransitGatewayRoutes",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "Ec2ViaCfnNetworkProvisionCreateWithRequestTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNatGateway",
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "Ec2ViaCfnNetworkProvisionCreateWithResourceTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNatGateway",
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"ec2:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "Ec2ViaCfnOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCustomerGateways",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePrefixLists",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetManagedPrefixListEntries",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "Ec2ViaCfnSecurityGroupCreate",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "Ec2ViaCfnSecurityGroupTagCreate",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group-rule/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "IamTgwServiceLinkedRoleCreate",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : "arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"StringLike" : {
"iam:AWSServiceName" : "transitgateway.amazonaws.com"
}
}
},
{
"Sid" : "IamViaCfnTgwLambdaRoleCleanupOperations",
"Effect" : "Allow",
"Action" : [
"iam:DeleteRole",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "IamViaCfnTgwLambdaRoleCreate",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "IamViaCfnTgwLambdaRoleOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"iam:GetRole"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "IamViaCfnTgwLambdaRolePassRole",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"iam:PassedToService" : "lambda.amazonaws.com"
}
}
},
{
"Sid" : "IamViaCfnTgwLambdaRolePolicyAttach",
"Effect" : "Allow",
"Action" : [
"iam:AttachRolePolicy"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ArnEquals" : {
"iam:PolicyARN" : [
"arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationCustomResource",
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
]
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "IamViaCfnTgwLambdaRoleTag",
"Effect" : "Allow",
"Action" : [
"iam:TagRole"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "KmsS3EncryptionOperationsNetworkMigration",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:DescribeKey",
"kms:GenerateDataKey"
],
"Resource" : "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
"Condition" : {
"StringLike" : {
"kms:ViaService" : "s3.*.amazonaws.com"
}
}
},
{
"Sid" : "LambdaViaCfnNetworkMigrationFunctionCreate",
"Effect" : "Allow",
"Action" : [
"lambda:CreateFunction"
],
"Resource" : "arn:aws:lambda:*:*:function:network-migration*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "LambdaViaCfnNetworkMigrationFunctionOperations",
"Effect" : "Allow",
"Action" : [
"lambda:DeleteFunction",
"lambda:GetFunctionCodeSigningConfig",
"lambda:GetFunctionConfiguration",
"lambda:GetFunctionRecursionConfig",
"lambda:GetRuntimeManagementConfig",
"lambda:InvokeFunction"
],
"Resource" : "arn:aws:lambda:*:*:function:network-migration*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "LambdaViaCfnNetworkMigrationFunctionOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"lambda:GetFunction"
],
"Resource" : "arn:aws:lambda:*:*:function:network-migration*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "LambdaViaCfnNetworkMigrationFunctionTag",
"Effect" : "Allow",
"Action" : [
"lambda:TagResource"
],
"Resource" : "arn:aws:lambda:*:*:function:network-migration*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "LogsViaCfnNetworkMigrationOperationsWrite",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource" : "arn:aws:logs:*:*:log-group:/aws/lambda/network-migration*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "MgnNetworkMigrationDefinitionCreate",
"Effect" : "Allow",
"Action" : [
"mgn:CreateNetworkMigrationDefinition"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/ATWorkspace" : "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy" : "AWSTransform",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "MgnNetworkMigrationDefinitionDelete",
"Effect" : "Allow",
"Action" : [
"mgn:DeleteNetworkMigrationDefinition"
],
"Resource" : "arn:aws:mgn:*:*:network-migration-definition/*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : [
"AWSTransform",
"QTransform"
]
}
}
},
{
"Sid" : "MgnNetworkMigrationDefinitionOperations",
"Effect" : "Allow",
"Action" : [
"mgn:GetNetworkMigrationDefinition",
"mgn:ListNetworkMigrationMappingUpdates",
"mgn:StartNetworkMigrationMappingUpdate",
"mgn:UpdateNetworkMigrationDefinition",
"mgn:UpdateNetworkMigrationMapperSegment",
"mgn:UpdateNetworkMigrationMapperSegmentConstruct"
],
"Resource" : "arn:aws:mgn:*:*:network-migration-definition/*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/ATWorkspace" : "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy" : "AWSTransform"
}
}
},
{
"Sid" : "MgnNetworkMigrationDefinitionTagOperationsWrite",
"Effect" : "Allow",
"Action" : [
"mgn:TagResource"
],
"Resource" : "arn:aws:mgn:*:*:network-migration-definition/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/ATWorkspace" : "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy" : "AWSTransform",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSTransform",
"mgn:CreateAction" : "CreateNetworkMigrationDefinition"
}
}
},
{
"Sid" : "NetworkMigrationOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"mgn:ListNetworkMigrationAnalyses",
"mgn:ListNetworkMigrationAnalysisResults",
"mgn:ListNetworkMigrationCodeGenerationSegments",
"mgn:ListNetworkMigrationCodeGenerations",
"mgn:ListNetworkMigrationDefinitions",
"mgn:ListNetworkMigrationDeployedStacks",
"mgn:ListNetworkMigrationDeployedStacksDeletions",
"mgn:ListNetworkMigrationDeployments",
"mgn:ListNetworkMigrationExecutions",
"mgn:ListNetworkMigrationMapperSegmentConstructs",
"mgn:ListNetworkMigrationMapperSegments",
"mgn:ListNetworkMigrationMappings"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "NetworkMigrationOperationsWrite",
"Effect" : "Allow",
"Action" : [
"mgn:StartNetworkMigrationAnalysis",
"mgn:StartNetworkMigrationCodeGeneration",
"mgn:StartNetworkMigrationDeployedStacksDeletion",
"mgn:StartNetworkMigrationDeployment",
"mgn:StartNetworkMigrationMapping"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/ATWorkspace" : "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy" : "AWSTransform"
}
}
},
{
"Sid" : "OrganizationsOperationsReadOnlyNetworkMigration",
"Effect" : "Allow",
"Action" : [
"organizations:ListAccounts"
],
"Resource" : "*"
},
{
"Sid" : "RamShareCrossAccountOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"ram:GetResourceShares"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "RamViaCfnShareAssociateOperationsWrite",
"Effect" : "Allow",
"Action" : [
"ram:AssociateResourceShare"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService",
"ram:RequestedResourceType" : [
"ec2:TransitGateway",
"ssm:Parameter"
]
}
}
},
{
"Sid" : "RamViaCfnShareCreate",
"Effect" : "Allow",
"Action" : [
"ram:CreateResourceShare"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"Bool" : {
"ram:RequestedAllowsExternalPrincipals" : "false"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "RamViaCfnShareOperations",
"Effect" : "Allow",
"Action" : [
"ram:DeleteResourceShare",
"ram:DisassociateResourceShare",
"ram:UpdateResourceShare"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "RamViaCfnShareTagOperationsWrite",
"Effect" : "Allow",
"Action" : [
"ram:TagResource"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "ReachabilityAnalyzerAnalysisStart",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource" : "arn:aws:ec2:*:*:network-insights-analysis/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ReachabilityAnalyzerCleanupOperationsWrite",
"Effect" : "Allow",
"Action" : [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteNetworkInsightsAnalysis",
"ec2:DeleteNetworkInsightsPath",
"ec2:DeleteNetworkInterface",
"ec2:DeleteSecurityGroup"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "ReachabilityAnalyzerCreateWithRequestTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "ReachabilityAnalyzerCreateWithResourceTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInsightsPath",
"ec2:CreateNetworkInterface",
"ec2:CreateSecurityGroup",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "ReachabilityAnalyzerCrossOrgPathCreate",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInsightsPath"
],
"Resource" : "arn:aws:ec2:*:*:network-interface/*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceOrgID" : "${aws:PrincipalOrgID}"
}
}
},
{
"Sid" : "ReachabilityAnalyzerOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"directconnect:DescribeConnections",
"directconnect:DescribeDirectConnectGatewayAssociations",
"directconnect:DescribeDirectConnectGatewayAttachments",
"directconnect:DescribeDirectConnectGateways",
"directconnect:DescribeVirtualGateways",
"directconnect:DescribeVirtualInterfaces",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCustomerGateways",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePrefixLists",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetManagedPrefixListEntries",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:SearchTransitGatewayRoutes",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"globalaccelerator:ListAccelerators",
"globalaccelerator:ListCustomRoutingAccelerators",
"globalaccelerator:ListCustomRoutingEndpointGroups",
"globalaccelerator:ListCustomRoutingListeners",
"globalaccelerator:ListCustomRoutingPortMappings",
"globalaccelerator:ListEndpointGroups",
"globalaccelerator:ListListeners",
"network-firewall:DescribeFirewall",
"network-firewall:DescribeFirewallPolicy",
"network-firewall:DescribeResourcePolicy",
"network-firewall:DescribeRuleGroup",
"network-firewall:ListFirewallPolicies",
"network-firewall:ListFirewalls",
"network-firewall:ListRuleGroups",
"tiros:CreateQuery",
"tiros:ExtendQuery",
"tiros:GetQueryAnswer",
"tiros:GetQueryExplanation",
"tiros:GetQueryExtensionAccounts"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "ReachabilityAnalyzerProbeCreateOnSecurityGroup",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInterface"
],
"Resource" : "arn:aws:ec2:*:*:security-group/*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ReachabilityAnalyzerSecurityGroupCreateOnVpc",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : "arn:aws:ec2:*:*:vpc/*",
"Condition" : {
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "ReachabilityAnalyzerSecurityGroupCreateWithRequestTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group-rule/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "S3TargetBucketOperationsNetworkMigration",
"Effect" : "Allow",
"Action" : [
"s3:CreateBucket",
"s3:GetBucketLocation",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:ListBucket",
"s3:PutBucketTagging",
"s3:PutEncryptionConfiguration"
],
"Resource" : "arn:aws:s3:::transform-vmware-target-*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "S3TargetObjectOperationsNetworkMigration",
"Effect" : "Allow",
"Action" : [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:GetObjectAttributes",
"s3:GetObjectVersion",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:PutObject"
],
"Resource" : "arn:aws:s3:::transform-vmware-target-*/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "SsmParametersViaCfnOperationsReadOnly",
"Effect" : "Allow",
"Action" : [
"ssm:GetParameters"
],
"Resource" : "arn:aws:ssm:*:*:parameter/network-migration/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid" : "SsmParametersViaCfnOperationsWriteWithRequestTag",
"Effect" : "Allow",
"Action" : [
"ssm:AddTagsToResource",
"ssm:PutParameter"
],
"Resource" : "arn:aws:ssm:*:*:parameter/network-migration/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "SsmParametersViaCfnOperationsWriteWithResourceTag",
"Effect" : "Allow",
"Action" : [
"ssm:DeleteParameter",
"ssm:DeleteResourcePolicy",
"ssm:GetResourcePolicies",
"ssm:ListTagsForResource",
"ssm:PutResourcePolicy"
],
"Resource" : "arn:aws:ssm:*:*:parameter/network-migration/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:RequestedRegion" : "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "StsCrossAccountAssumeRoleNetworkMigration",
"Effect" : "Allow",
"Action" : [
"sts:AssumeRole"
],
"Resource" : "arn:aws:iam::*:role/AWSTransformNetworkMigrationAgentSharingRole_${aws:PrincipalAccount}",
"Condition" : {
"StringEquals" : {
"aws:ResourceOrgID" : "${aws:PrincipalOrgID}",
"sts:ExternalId" : "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
}
}
}
]
}
```
## Learn more
+ [Create a permission set using AWS managed policies in IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [Understand versioning for IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Get started with AWS managed policies and move toward least-privilege permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)