NEW - You can now accelerate your migration and modernization with AWS Transform. Read Getting Started in the AWS Transform User Guide.

Network requirements for Application Migration Service

Before you use Application Migration Service, make sure to prepare your environments. Preparation includes setting correct network settings, defining network requirements, and opening the correct ports.

Service and network architecture overview

Watch the AWS Application Migration Service - Service architecture and network architecture video for an in-depth overview of the Application Migration Service architecture.

This is the Application Migration Service network diagram:

Network setting preparations

As part of network setting preparations, set up a staging area and operational subnets.

Staging area subnet

Before setting up Application Migration Service you should create a subnet which will be used by the service as a staging area for data replicated from your source servers to AWS.

Operational subnets

Test and cutover instances are launched in a subnet you specify in the Amazon EC2 launch template associated with each source server. The Amazon EC2 launch template is created automatically when you add a source server to AWS Application Migration Service.

Learn more about launching test and cutover instances.

Learn more about how Amazon EC2 launch templates are used.

Required connectivity settings

To prepare your network for running AWS Application Migration Service, configure the following connectivity settings. All communication is encrypted with TLS.

Endpoints and firewall allowlist

Add the following endpoints and URLs to your firewall allowlist.

Application Migration Service API endpoints

Replace region with the AWS Region code you are replicating to (for example, us-east-1).

Amazon EC2 endpoint

The staging area subnet requires outbound access to the Amazon EC2 endpoint of its AWS Region.

Amazon S3 buckets

The AWS Replication Agent installer and the staging area subnet require access to Amazon S3. Allowlist these buckets:

https://aws-mgn-clients-<region>.s3.<region>.amazonaws.com/
https://aws-mgn-clients-hashes-<region>.s3.<region>.amazonaws.com/
https://aws-mgn-internal-<region>.s3.<region>.amazonaws.com/
https://aws-mgn-internal-hashes-<region>.s3.<region>.amazonaws.com/
https://aws-application-migration-service-<region>.s3.<region>.amazonaws.com/
https://aws-application-migration-service-hashes-<region>.s3.<region>.amazonaws.com/
https://amazon-ssm-<region>.s3.<region>.amazonaws.com/
https://al2023-repos-<region>-de612dc2.s3.<region>.amazonaws.com/
   

Amazon S3 VPC Endpoint policy

If you use an Amazon S3 VPC Endpoint, you must provide sufficient permissions for service functionality, as shown in this example policy for replicating to us-east-1:

JSON

{
	"Version":"2012-10-17",
	 "Statement": [
		{
			 "Effect":  "Allow",
			 "Principal": {
				 "AWS":  "*"
			},
			 "Action":  "s3:GetObject",
			 "Resource": [
				 "arn:aws:s3:::aws-mgn-clients-us-east-1/*",
				 "arn:aws:s3:::aws-mgn-clients-hashes-us-east-1/*",
				 "arn:aws:s3:::aws-mgn-clients-us-east-1/*",
				 "arn:aws:s3:::aws-mgn-clients-us-east-1/*",
				 "arn:aws:s3:::aws-mgn-clients-hashes-us-east-1/*",
				 "arn:aws:s3:::aws-mgn-internal-us-east-1/*",
				 "arn:aws:s3:::aws-mgn-internal-hashes-us-east-1/*",
				 "arn:aws:s3:::aws-application-migration-service-us-east-1/*",
				 "arn:aws:s3:::aws-application-migration-service-hashes-us-east-1/*",
				 "arn:aws:s3:::amazon-ssm-us-east-1/*",
				 "arn:aws:s3:::al2023-repos-us-east-1-de612dc2/*"
			]
		}
	]
}

Communication between source servers and AWS Application Migration Service over TCP port 443

Each source server that is added to Application Migration Service must continuously communicate with the Application Migration Service API endpoint over TCP port 443.

The main operations performed through this route are:

Communication between source servers and the staging area subnet over TCP port 1500

Each source server with an installed AWS Replication Agent continuously communicates with the replication servers in the staging area subnet over TCP port 1500. This port is used for the transfer of replicated data from the source servers to the staging area subnet.

The replicated data is encrypted and compressed when transferred over TCP port 1500. The data is encrypted on the source infrastructure before transfer and decrypted at the staging area subnet before being written to the volumes.

AWS Application Migration Service uses TLS 1.2 end to end from the agent installed on the source server to the Replication Server. Each replication server gets assigned a specific TLS server certificate, which is distributed to the corresponding Agent and validated on the agent side.

Communication between the staging area subnet and AWS Application Migration Service over TCP port 443

The replication servers in the staging area subnet must continuously communicate with Application Migration Service over TCP port 443. The main operations performed through this route are:

There are two ways to establish direct connectivity to the Internet for the VPC of the staging area, as described in the VPC FAQ:

Troubleshooting connectivity issues

If there is no connection between your source servers and Application Migration Service, make sure that your corporate firewall enables connectivity from the source servers to Application Migration Service over TCP port 443. If the connectivity is blocked, enable it.

Enabling Windows Firewall for TCP port 443 connectivity

Enabling Linux Firewall for TCP port 443 connectivity