Connect target AWS accounts

Configure your target AWS account connector for network migration, landing zone build, and server migration. This involves three steps: select your migration type, provide your MAP agreement details (if applicable), and set up the connector. These settings apply across all migration stages — network migration, landing zone, and server rehost.

Step 1: Migration type selection

Choose whether you are performing a single-account or multi-account migration:

Step 2: MAP agreement

If your migration is part of the AWS Migration Acceleration Program (MAP 2.0), provide your Migration Portfolio Experience (MPE) ID — a 10-character code using uppercase letters and digits (for example, ABCDE12345). When you provide your MPE ID, the MAP tag is applied to all resources created across network migration, landing zone, and server rehost stages. The tag format is:

You must apply MAP tags to receive MAP credit. For more information about MAP, see AWS Migration Acceleration Program.

Step 3: Connector configuration

You use the target account connector to connect your migration job to the AWS environment where your workloads will reside after migration. Before you begin, verify that your target AWS account has the necessary permissions, quotas, and configurations to support your migrated infrastructure.

When you approve the connector request, you grant AWS Transform permissions to:

Before you set up the connector, understand the account roles involved in your migration:

Using a delegated administrator account

For multi-account migrations, AWS recommends that you use a Delegated Administrator (DA) account rather than the organization management account directly. A DA account follows the principle of least privilege by limiting the scope of permissions required for migration operations. The DA account must be registered as delegated administrator for both Application Migration Service and CloudFormation StackSets in your AWS Organization.

The key difference between the two options is:

For more information, see Delegated administrator for Application Migration Service in the Application Migration Service User Guide.

IAM roles created during setup

During migration setup, a CloudFormation StackSet (MGNMultiAccountRoles) is deployed to create the required IAM roles across your target accounts. These roles grant the permissions that AWS Transform needs to replicate servers, launch instances, and install agents in each target account. The following roles are created:

Target account connector setup

If you plan to modify the AWS Application Migration Service template to enable post-launch actions, add the following permission to the target connector role. This JSON policy statement grants the iam:PassRole permission for the post-launch actions role. You can find the role name in the Collaboration tab after the connector is created. For information about adding permissions to a role, see Update permissions for a role in the IAM User Guide.

{
      "Sid": "MGNPostLaunchActions",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::target-account-ID:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole"
}

Supported target regions

When you create the connector, specify a target AWS Region. You can use any of the following AWS Regions: