기계 번역으로 제공되는 번역입니다. 제공된 번역과 원본 영어의 내용이 상충하는 경우에는 영어 버전이 우선합니다.
# AWSApplicationMigrationNetworkMigrationMultiAccount
**설명**: CloudFormation을 통한 VMware에서 AWS 네트워크 인프라로의 마이그레이션을 자동화할 수 있는 권한을 제공합니다.
`AWSApplicationMigrationNetworkMigrationMultiAccount`은(는) [AWS 관리형 정책](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)입니다.
## 이 정책 사용
사용자, 그룹 및 역할에 `AWSApplicationMigrationNetworkMigrationMultiAccount`를 연결할 수 있습니다.
## 정책 세부 정보
+ **Type**: AWS managed 정책
+ **생성 시간**: 2025년 11월 10일, 09:04 UTC
+ **편집된 시간:** 2026년 2월 12일, 17:58 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationMultiAccount`
## 정책 버전
**정책 버전:** v3(기본값)
정책의 기본 버전은 정책에 대한 권한을 정의하는 버전입니다. 정책이 있는 사용자 또는 역할이 AWS 리소스에 대한 액세스를 요청하면는 정책의 기본 버전을 AWS 확인하여 요청을 허용할지 여부를 결정합니다.
## JSON 정책 문서
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "EC2CFNReadonlyPrefixList",
"Effect" : "Allow",
"Action" : [
"ec2:GetManagedPrefixListEntries"
],
"Resource" : [
"arn:aws:ec2:*:*:prefix-list/*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "NetworkAnalyzer",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeNetworkInterfaces"
],
"Resource" : [
"*"
]
},
{
"Sid" : "CreatePermissionsByCFNNACL",
"Effect" : "Allow",
"Action" : [
"ec2:ReplaceNetworkAclAssociation"
],
"Resource" : [
"arn:aws:ec2:*:*:network-acl/*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByCFNNACLSN",
"Effect" : "Allow",
"Action" : [
"ec2:ReplaceNetworkAclAssociation"
],
"Resource" : [
"arn:aws:ec2:*:*:subnet/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "EC2CFNReadonly",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCustomerGateways",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeHosts",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePrefixLists",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayConnects",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeVolumes",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations"
],
"Resource" : [
"*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "MGNCFNDescribe",
"Effect" : "Allow",
"Action" : [
"cloudformation:DescribeStacks",
"cloudformation:ListStacks"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/Nmd*"
},
{
"Sid" : "CFNCreate",
"Effect" : "Allow",
"Action" : [
"cloudformation:CreateStack"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "CFNOperations",
"Effect" : "Allow",
"Action" : [
"cloudformation:DeleteStack",
"cloudformation:UpdateStack",
"cloudformation:UpdateTerminationProtection",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplateSummary",
"cloudformation:ListStackResources",
"cloudformation:DescribeStackEvents"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/Nmd*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "CFNProvision",
"Effect" : "Allow",
"Action" : [
"ec2:AllocateAddress"
],
"Resource" : [
"arn:aws:ec2:*:*:elastic-ip/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "AnalyzerEC2PutResourcePolicy",
"Effect" : "Allow",
"Action" : [
"ec2:PutResourcePolicy"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "AnalyzerEC2ResourceOperations",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteSecurityGroup",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "AnalyzerEC2ResourceSgTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : [
"arn:aws:ec2:*:*:vpc/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "AnalyzerEC2RequestSgTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "AnalyzerEC2SecurityGroupTags",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"ec2:CreateAction" : [
"CreateSecurityGroup"
]
}
}
},
{
"Sid" : "EC2TagCFNSG",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByCFN",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByResourceTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkAcl",
"ec2:CreateNetworkAclEntry",
"ec2:CreateSubnet",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateNatGateway",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInsightsPath"
],
"Resource" : [
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:elastic-ip/*"
],
"Condition" : {
"StringEquals" : {
"ec2:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AllowCreateTGWVpcAttachmentSameOrg",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource" : [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceOrgID" : "${aws:PrincipalOrgID}"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CFNProvisionNetworking",
"Effect" : "Allow",
"Action" : [
"ec2:CreateInternetGateway",
"ec2:CreateVpc",
"ec2:CreateTransitGateway"
],
"Resource" : [
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:transit-gateway/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "CreatePermissionsByRequestTagNetworking",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkAcl",
"ec2:CreateSubnet",
"ec2:CreateRouteTable"
],
"Resource" : [
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByRequestTagRouting",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkAclEntry",
"ec2:CreateRoute"
],
"Resource" : [
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:route-table/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByRequestTagNAT",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNatGateway"
],
"Resource" : [
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:elastic-ip/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByRequestTagTransitGateway",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayRoute"
],
"Resource" : [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByRequestTagTGWAttachment",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource" : [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreatePermissionsByRequestTagNetworkInterface",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInterface"
],
"Resource" : [
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "DeleteENI",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteNetworkInterface"
],
"Resource" : [
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
},
{
"Sid" : "CreatePermissionsByRequestTagInsights",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInsightsPath"
],
"Resource" : [
"arn:aws:ec2:*:*:network-insights-path/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "EC2TagCFN",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-policy-table/*",
"arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
"arn:aws:ec2:*:*:network-insights-access-scope/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:network-insights-analysis/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"ec2:CreateAction" : [
"CreateTransitGatewayVpcAttachment",
"CreateTransitGatewayRouteTableAnnouncement",
"CreateTransitGatewayRouteTable",
"CreateTransitGatewayRoute",
"CreateTransitGatewayPrefixListReference",
"CreateTransitGatewayPolicyTable",
"CreateTransitGatewayPeeringAttachment",
"CreateTransitGatewayConnectPeer",
"CreateTransitGatewayConnect",
"CreateTransitGateway",
"CreateInternetGateway",
"CreateNatGateway",
"CreateSubnet",
"CreateNetworkAcl",
"CreateRouteTable",
"CreateNetworkInterface",
"CreateNetworkInsightsPath",
"CreateNetworkInsightsAccessScope",
"CreateLaunchTemplate",
"AllocateAddress",
"StartNetworkInsightsAnalysis",
"CreateVpc"
]
}
}
},
{
"Sid" : "deployerWorkload",
"Effect" : "Allow",
"Action" : [
"ssm:GetParameters"
],
"Resource" : [
"arn:aws:ssm:*:*:parameter/network-migration/*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "putParameter",
"Effect" : "Allow",
"Action" : [
"ssm:PutParameter",
"ssm:AddTagsToResource"
],
"Resource" : [
"arn:aws:ssm:*:*:parameter/network-migration/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "deleteParameter",
"Effect" : "Allow",
"Action" : [
"ssm:DeleteParameter",
"ssm:PutResourcePolicy",
"ssm:DeleteResourcePolicy",
"ssm:ListTagsForResource",
"ssm:GetResourcePolicies"
],
"Resource" : [
"arn:aws:ssm:*:*:parameter/network-migration/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "ramTAgReource",
"Effect" : "Allow",
"Action" : [
"ram:TagResource"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreateResourceShareTransitGateway",
"Effect" : "Allow",
"Action" : [
"ram:CreateResourceShare"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"Bool" : {
"ram:RequestedAllowsExternalPrincipals" : "false"
}
}
},
{
"Sid" : "AssociateResourceShare",
"Effect" : "Allow",
"Action" : [
"ram:AssociateResourceShare"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService",
"ram:RequestedResourceType" : [
"ec2:TransitGateway",
"ssm:Parameter"
]
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreateResourceShareWithResourceTag",
"Effect" : "Allow",
"Action" : [
"ram:DeleteResourceShare",
"ram:DisassociateResourceShare",
"ram:UpdateResourceShare"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AllowGetResourceShares",
"Effect" : "Allow",
"Action" : [
"ram:GetResourceShares"
],
"Resource" : "arn:aws:ram:*:*:resource-share/*"
},
{
"Sid" : "CreateCustomResourceLogGroup",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:/aws/lambda/network-migration-modify-tgw*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreateCustomResourceLambda",
"Effect" : "Allow",
"Action" : [
"lambda:CreateFunction",
"lambda:TagResource"
],
"Resource" : [
"arn:aws:lambda:*:*:function:network-migration*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "GetCustomResource",
"Effect" : "Allow",
"Action" : [
"lambda:GetFunction"
],
"Resource" : [
"arn:aws:lambda:*:*:function:network-migration*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "OperationsCustomResourceLambda",
"Effect" : "Allow",
"Action" : [
"lambda:AddPermission",
"lambda:DeleteFunction",
"lambda:GetFunctionConfiguration",
"lambda:InvokeFunction"
],
"Resource" : [
"arn:aws:lambda:*:*:function:network-migration*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "CreateRoleCustomResource",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole",
"iam:TagRole"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CreatedBy" : "AWSApplicationMigrationService",
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "PassGetRoleCustomResource",
"Effect" : "Allow",
"Action" : [
"iam:GetRole"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "PassRoleCustomResource",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"iam:PassedToService" : "lambda.amazonaws.com"
}
}
},
{
"Sid" : "OperationsRoleCustomResource",
"Effect" : "Allow",
"Action" : [
"iam:DeleteRole",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:GetRolePolicy",
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AttachCustomResourceRole",
"Effect" : "Allow",
"Action" : [
"iam:AttachRolePolicy"
],
"Resource" : "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ArnEquals" : {
"iam:PolicyARN" : [
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
"arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationCustomResource"
]
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "MGNCFNBasedResourcesProvision",
"Effect" : "Allow",
"Action" : [
"ec2:AcceptTransitGatewayVpcAttachment",
"ec2:AssociateNatGatewayAddress",
"ec2:AssociateRouteTable",
"ec2:AssociateSubnetCidrBlock",
"ec2:AssociateTransitGatewayRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteInternetGateway",
"ec2:DeleteLaunchTemplate",
"ec2:DeleteLaunchTemplateVersions",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkAclEntry",
"ec2:DeleteNetworkInsightsAnalysis",
"ec2:DeleteNetworkInsightsPath",
"ec2:DeleteNetworkInterface",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSnapshot",
"ec2:DeleteSubnet",
"ec2:DeleteTransitGateway",
"ec2:DeleteTransitGatewayRoute",
"ec2:DeleteTransitGatewayRouteTable",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:DeleteVolume",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DetachVolume",
"ec2:DisableTransitGatewayRouteTablePropagation",
"ec2:DisassociateNatGatewayAddress",
"ec2:DisassociateRouteTable",
"ec2:DisassociateTransitGatewayRouteTable",
"ec2:EnableTransitGatewayRouteTablePropagation",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyLaunchTemplate",
"ec2:ModifySubnetAttribute",
"ec2:ModifyTransitGateway",
"ec2:ModifyTransitGatewayVpcAttachment",
"ec2:ModifyVolume",
"ec2:ModifyVpcAttribute",
"ec2:RejectTransitGatewayVpcAttachment",
"ec2:ReleaseAddress",
"ec2:ReplaceNetworkAclAssociation",
"ec2:ReplaceNetworkAclEntry",
"ec2:ReplaceRoute",
"ec2:ReplaceTransitGatewayRoute",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:SearchTransitGatewayRoutes",
"ec2:StartNetworkInsightsAnalysis"
],
"Resource" : [
"arn:aws:ec2:*:*:transit-gateway/*",
"arn:aws:ec2:*:*:transit-gateway-policy-table/*",
"arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
"arn:aws:ec2:*:*:transit-gateway-route-table/*",
"arn:aws:ec2:*:*:transit-gateway-attachment/*",
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-acl/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:network-insights-path/*",
"arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
"arn:aws:ec2:*:*:network-insights-access-scope/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:network-insights-analysis/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AnalyzerENIResourceTag",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInterface"
],
"Resource" : [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CreatedBy" : "AWSApplicationMigrationService"
}
}
}
]
}
```
## 자세히 알아보기
+ [IAM Identity Center에서 AWS 관리형 정책을 사용하여 권한 세트 생성](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [IAM 자격 증명 권한 추가 및 제거](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [IAM 정책의 버전 관리 이해](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [AWS 관리형 정책 시작하기 및 최소 권한으로 이동](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)