Create permissions manually

Create a policy from the following JSON:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "mgn:TagResource"
            ],
            "Resource": "arn:aws:mgn:*:*:connector/*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "mgn:CreateAction": "CreateConnector"
                }
            }
        },
        {
            "Action": [
                "mgn:CreateConnector"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Name the policy MGNConnectorInstallerPolicy.

Create a role with your account as the trusted entity. Alternatively use a custom trust policy that will grant the user or identity that will install the Connector, permission to assume this role.

Attach the MGNConnectorInstallerPolicy policy to the Permission policies.

Name the role MGNConnectorInstallerRole.

After replacing ACCOUNT-ID with your account number, and AWS_REGION with the connector region, create a policy from the following JSON:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/AWSApplicationMigrationConnectorSharingRole_ACCOUNT-ID",
            "Effect": "Allow"
        },
        {
            "Condition": {
                "Null": {
                    "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
                }
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "arn:aws:secretsmanager:*:*:secret:*",
            "Effect": "Allow"
        },
        {
            "Action": "s3:GetObject",
            "Resource":
                ["arn:aws:s3:::aws-application-migration-service-AWS_REGION/latest/source-automation-client/linux/ssaf-client/ssaf_client",
                "arn:aws:s3:::amazon-ssm-AWS_REGION/*"],
            "Effect": "Allow"
        }
    ]
}

If you have created an S3 bucket for SSM logging, replace LOGS-BUCKET with the bucket name and append the following statements to the above policy:

{
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::LOGS-BUCKET/*",
    "Effect": "Allow"
}

In order for the MGN connector to send logs to CloudWatch, append the following statement to the above policy:

{
    "Effect": "Allow",
    "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents"
    ],
    "Resource": "*"
}

Name the policy MgnConnectorPolicy

Create a role with the following trust relationship:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ssm.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Attach the following policies:

Name the role AWSApplicationMigrationConnectorManagementRole