Identity and access management for AWS Application Migration Service - Application Migration Service
Federated identityPolicy structure

Identity and access management for AWS Application Migration Service

AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use AWS resources. IAM enables you to create users and groups under your AWS account. You control the permissions that users have to perform tasks using AWS resources. You can use IAM for no additional charge.

By default, users created via the IAM service don't have permissions for AWS Application Migration Service (AWS MGN) resources and operations. To allow these users to manage AWS Application Migration Service resources, you must create an IAM policy that explicitly grants them permissions, and attach the policy to the users or groups that require those permissions.

When you attach a policy to a user or group of users, it allows or denies the users permission to perform the specified tasks on the specified resources. For more information, see Policies and Permissions in the IAM User Guide guide.

Federated identity

As a best practice, require human users, including users that require administrator access, to use federation with an identity provider to access AWS services by using temporary credentials.

A federated identity is a user from your enterprise user directory, a web identity provider, the AWS Directory Service, the Identity Center directory, or any user that accesses AWS services by using credentials provided through an identity source. When federated identities access AWS accounts, they assume roles, and the roles provide temporary credentials.

For centralized access management, we recommend that you use AWS IAM Identity Center. You can create users and groups in IAM Identity Center, or you can connect and synchronize to a set of users and groups in your own identity source for use across all your AWS accounts and applications. For information about IAM Identity Center, see What is IAM Identity Center? in the AWS IAM Identity Center User Guide.

Policy structure

An IAM policy is a JSON document that consists of one or more statements. Each statement is structured as follows. 

{
        "Statement": [
                {
                        "Effect": "effect",
                        "Action": "action",
                        "Resource": "arn",
                        "Condition": {
                                "condition": {
                                        "key":"value"
                                }
                        }
                }
        ]
}

There are various elements that make up a statement:

  • Effect: The effect can be Allow or Deny. By default, IAM users don't have permission to use resources and API actions, so all requests are denied. An explicit allow overrides the default. An explicit deny overrides any allows.

  • Action: The action is the specific AWS Application Migration Service API action for which you are granting or denying permission.

  • Resource: The resource that's affected by the action. For AWS Application Migration Service, you must specify "*" as the resource.

  • Condition: Conditions are optional. They can be used to control when your policy is in effect.