Select your cookie preferences

We use essential cookies and similar tools that are necessary to provide our site and services. We use performance cookies to collect anonymous statistics, so we can understand how customers use our site and make improvements. Essential cookies cannot be deactivated, but you can choose “Customize” or “Decline” to decline performance cookies.

If you agree, AWS and approved third parties will also use cookies to provide useful site features, remember your preferences, and display relevant content, including relevant advertising. To accept or decline all non-essential cookies, choose “Accept” or “Decline.” To make more detailed choices, choose “Customize.”

Installing the Agent on a secured network

Focus mode
Installing the Agent on a secured network - Application Migration Service

The AWS Application Migration Service AWS Replication Agent installer needs network access to Application Migration Service and Amazon S3 endpoints. If your on premises network is not open to Application Migration Service and Amazon S3 endpoints, then you can install the Agent with the aid of PrivateLink.

You can connect your on premises network to the subnet in your staging area VPC using AWS Virtual Private Network or AWS Direct Connect. To use the AWS VPN or AWS Direct Connect, you must use private IP in the replication settings.

Create a VPC endpoint for AWS Application Migration Service

To allow the AWS Replication Agent installer to communicate with Application Migration Service, create an interface VPC endpoint for Application Migration Service in your staging area subnet. For more information, see Creating an interface endpoint in the Amazon VPC User Guide.

If the AWS replication agents are installed with a principal using AWSApplicationMigrationAgentInstallationPolicy and a VPCE policy is used (to scope down access), add this statement to your policy:

{ "Effect": "Allow", "Principal": "*", "Action": "execute-api:Invoke", "Resource": "arn:aws:execute-api:<region>:*:*/POST/CreateSessionForMgn" }

Use the created VPC Endpoint for AWS Application Migration Service

Once you have created the VPC Endpoint, the AWS Replication Agent can connect to Application Migration Service via AWS VPN/AWS Direct Connect by using the --endpoint installation parameter. Learn more about Private DNS for interface endpoints in the Amazon VPC User Guide.

Run the AWS Replication Agent installer with the --endpoint parameter. Enter your endpoint-specific DNS hostname within the parameter. The installer will then be able to connect to Application Migration Service via the endpoint over your AWS VPN/AWS Direct Connect connection.

Create an Amazon S3 endpoint for AWS Application Migration Service

To allow the AWS Replication Agent installer to communicate with Amazon S3, create an interface Amazon S3 endpoint for Application Migration Service in your staging area subnet. For more information, see Endpoints for Amazon S3 in the Amazon VPC User Guide.

Use the created Amazon S3 Endpoint for AWS Application Migration Service

Once you have created the Amazon VPC Endpoint, the AWS Replication Agent can connect to Amazon S3 via AWS VPN/AWS Direct Connect by using the --s3-endpoint installation parameter. Learn more about Private DNS for interface endpoints in the Amazon VPC User Guide.

Run the AWS Replication Agent installer with the --s3-endpoint parameter. Enter your endpoint-specific DNS hostname. The installer will then be able to connect to Application Migration Service via the endpoint over your AWS VPN/AWS Direct Connect connection.

Prescriptive guidance

A detailed guide for rehosting servers using Application Migration Service over private networks is available here:

Migrating on-premises servers to AWS over private networks by using Application Migration Service.

PrivacySite termsCookie preferences
© 2025, Amazon Web Services, Inc. or its affiliates. All rights reserved.