Installing the Agent on a secured network

The AWS Application Migration Service AWS Replication Agent installer needs network access to Application Migration Service and Amazon S3 endpoints. If your on premises network is not open to Application Migration Service and Amazon S3 endpoints, then you can install the Agent with the aid of PrivateLink.

You can connect your on premises network to the subnet in your staging area VPC using AWS Virtual Private Network or AWS Direct Connect. To use the AWS VPN or AWS Direct Connect, you must use private IP in the replication settings.

Create a VPC endpoint for AWS Application Migration Service

To allow the AWS Replication Agent installer to communicate with Application Migration Service, create an interface VPC endpoint for Application Migration Service in your staging area subnet. For more information, see Creating an interface endpoint in the Amazon VPC User Guide.

If the AWS replication agents are installed with a principal using AWSApplicationMigrationAgentInstallationPolicy and a VPCE policy is used (to scope down access), add the following statement to your policy:

{
       "Effect": "Allow",
       "Principal": "*",
       "Action": "execute-api:Invoke",
       "Resource": "arn:aws:execute-api:<region>:*:*/POST/CreateSessionForMgn"
}

Use the created VPC Endpoint for AWS Application Migration Service

Once you have created the VPC Endpoint, the AWS Replication Agent can connect to Application Migration Service via AWS VPN/AWS Direct Connect by using the --endpoint installation parameter. Learn more about Private DNS for interface endpoints in the Amazon VPC User Guide.

Run the AWS Replication Agent installer with the --endpoint parameter. Enter your endpoint-specific DNS hostname within the parameter. The installer will then be able to connect to Application Migration Service via the endpoint over your AWS VPN/AWS Direct Connect connection.

Create an Amazon S3 endpoint for AWS Application Migration Service

To allow the AWS Replication Agent installer to communicate with Amazon S3, create an interface Amazon S3 endpoint for Application Migration Service in your staging area subnet. For more information, see Endpoints for Amazon S3 in the Amazon VPC User Guide.

Use the created Amazon S3 Endpoint for AWS Application Migration Service

Once you have created the Amazon VPC Endpoint, the AWS Replication Agent can connect to Amazon S3 via AWS VPN/AWS Direct Connect by using the --s3-endpoint installation parameter. Learn more about Private DNS for interface endpoints in the Amazon VPC User Guide.

Run the AWS Replication Agent installer with the --s3-endpoint parameter. Enter your endpoint-specific DNS hostname. The installer will then be able to connect to Application Migration Service via the endpoint over your AWS VPN/AWS Direct Connect connection.

Prescriptive guidance

A detailed guide for rehosting servers using Application Migration Service over private networks is available here:

Migrating on-premises servers to AWS over private networks by using Application Migration Service.