AWS Application Migration Service 的操作、资源和条件键

AWS 应用程序迁移服务（服务前缀:mgn）提供以下特定于服务的资源、操作和条件上下文密钥，供在IAM权限策略中使用。

参考：

了解如何配置该服务。
查看此服务可用的API操作列表。
了解如何使用 IAM 权限策略保护该服务及其资源。

主题

AWS Application Migration Service 定义的操作
AWS Application Migration Service 定义的资源类型
AWS Application Migration Service 的条件键

AWS Application Migration Service 定义的操作

您可以在 Action 策略语句的 IAM 元素中指定以下操作。可以使用策略授予在 AWS中执行操作的权限。当您在策略中使用操作时，通常会允许或拒绝访问具有相同名称的API操作或CLI命令。但在某些情况下，单一动作可控制对多项操作的访问。还有某些操作需要多种不同的动作。

操作表的资源类型列指示每项操作是否支持资源级权限。如果该列没有任何值，您必须在策略语句的 Resource 元素中指定策略应用的所有资源（“*”）。如果该列包含资源类型，则可以在带有该操作ARN的语句中指定该类型的资源类型。如果操作具有一个或多个必需资源，则调用方必须具有使用这些资源来使用该操作的权限。必需资源在表中以星号 (*) 表示。如果您使用IAM策略中的Resource元素限制资源访问权限，则必须为每种必需的资源类型包含ARN或模式。某些操作支持多种资源类型。如果资源类型是可选的（未指示为必需），则可以选择使用一种可选资源类型。

操作表的条件键列包括可以在策略语句的 Condition 元素中指定的键。有关与服务资源关联的条件键的更多信息，请参阅资源类型表的条件键列。

注意

资源条件键在资源类型表中列出。您可以在操作表的资源类型（* 为必需）列中找到应用于某项操作的资源类型的链接。资源类型表中的资源类型包括条件密钥列，这是应用于操作表中操作的资源条件键。

有关下表中各列的详细信息，请参阅操作表。

操作	描述	访问级别	资源类型（* 为必需）	条件键	相关操作
ArchiveApplication	授予权限以存档应用程序	写入	ApplicationResource*
ArchiveWave	授予权限以存档轮次	写入	WaveResource*
AssociateApplications	授予权限以将应用程序与轮次关联	写入	ApplicationResource*
AssociateApplications	授予权限以将应用程序与轮次关联	写入	WaveResource*
AssociateSourceServers	授予权限以将源服务器与应用程序关联	写入	ApplicationResource*
AssociateSourceServers	授予权限以将源服务器与应用程序关联	写入	SourceServerResource*
BatchCreateVolumeSnapshotGroupForMgn[仅权限]	授予权限以创建卷快照组	Write	SourceServerResource*
BatchDeleteSnapshotRequestForMgn[仅权限]	授予权限以批量删除快照请求	Write
ChangeServerLifeCycleState	授予权限以更改源服务器生命周期状态	写入	SourceServerResource*
CreateApplication	授予创建应用程序的权限	写入		aws:RequestTag/${TagKey} aws:TagKeys
CreateConnector	授予创建连接器的权限	写入		aws:RequestTag/${TagKey} aws:TagKeys
CreateLaunchConfigurationTemplate	授予创建启动配置模板的权限	写入		aws:RequestTag/${TagKey} aws:TagKeys
CreateNetworkMigrationDefinition	授予创建网络迁移定义的权限	写入
CreateReplicationConfigurationTemplate	授予权限以创建复制配置模板	写入		aws:RequestTag/${TagKey} aws:TagKeys
CreateVcenterClientForMgn[仅权限]	授予创建 vcenter 客户端的权限	写入		aws:RequestTag/${TagKey} aws:TagKeys
CreateWave	授予权限以创建轮次	写入		aws:RequestTag/${TagKey} aws:TagKeys
DeleteApplication	授予删除应用程序的权限	写入	ApplicationResource*
DeleteConnector	授予权限以删除连接器	写入	ConnectorResource*
DeleteJob	授予权限以删除作业	写入	JobResource*
DeleteLaunchConfigurationTemplate	授予删除启动配置模板的权限	写入	LaunchConfigurationTemplateResource*
DeleteNetworkMigrationDefinition	授予删除网络迁移定义的权限	写入	NetworkMigrationDefinitionResource*
DeleteReplicationConfigurationTemplate	授予权限以删除复制配置模板	Write	ReplicationConfigurationTemplateResource*
DeleteSourceServer	授予权限以删除源服务器	写入	SourceServerResource*
DeleteVcenterClient	授予删除 vcenter 客户端的权限	写入	VcenterClientResource*
DeleteWave	授予权限以删除轮次	写入	WaveResource*
DescribeJobLogItems	授予权限以描述作业日志项目	Read	JobResource*
DescribeJobs	授予权限以描述作业	列表
DescribeLaunchConfigurationTemplates	授予描述启动配置模板的权限	列表
DescribeReplicationConfigurationTemplates	授予权限以描述复制配置模板	List
DescribeReplicationServerAssociationsForMgn[仅权限]	授予权限以描述复制服务器关联	Read
DescribeSnapshotRequestsForMgn[仅权限]	授予权限以描述快照请求	Read
DescribeSourceServers	授予权限以描述源服务器	列表
DescribeVcenterClients	授予描述 vcenter 客户端的权限	列表
DisassociateApplications	授予权限以取消应用程序与轮次的关联	写入	ApplicationResource*
DisassociateApplications	授予权限以取消应用程序与轮次的关联	写入	WaveResource*
DisassociateSourceServers	授予权限以取消源服务器与应用程序的关联	写入	ApplicationResource*
DisassociateSourceServers	授予权限以取消源服务器与应用程序的关联	写入	SourceServerResource*
DisconnectFromService	授予权限以断开源服务器与服务的连接	Write	SourceServerResource*
FinalizeCutover	授予权限以完成切换	Write	SourceServerResource*
GetAgentCommandForMgn[仅权限]	授予权限以获取代理命令	Read	SourceServerResource*
GetAgentConfirmedResumeInfoForMgn[仅权限]	授予权限以获取代理确认的简历信息	Read	SourceServerResource*
GetAgentInstallationAssetsForMgn[仅权限]	授予权限以获取代理安装资产	Read
GetAgentReplicationInfoForMgn[仅权限]	授予权限以获取代理复制信息	Read	SourceServerResource*
GetAgentRuntimeConfigurationForMgn[仅权限]	授予权限以获取代理运行时配置	Read	SourceServerResource*
GetAgentSnapshotCreditsForMgn[仅权限]	授予权限以获取代理快照积分	Read	SourceServerResource*
GetChannelCommandsForMgn[仅权限]	授予权限以获取通道命令	Read
GetLaunchConfiguration	授予权限以获取启动配置	读取	SourceServerResource*
GetNetworkMigrationDefinition	授予获取网络迁移定义的权限	读取	NetworkMigrationDefinitionResource*
GetNetworkMigrationMapperSegmentConstruct	授予获取网络迁移映射器分段构造的权限	读取	NetworkMigrationDefinitionResource*
GetReplicationConfiguration	授予权限以获取复制配置	读取	SourceServerResource*
GetVcenterClientCommandsForMgn[仅权限]	授予获取 vcenter 客户端命令的权限	读取	VcenterClientResource*
InitializeService	授予权限以初始化服务	写入			iam:AddRoleToInstanceProfile iam:CreateInstanceProfile iam:CreateServiceLinkedRole iam:GetInstanceProfile
IssueClientCertificateForMgn[仅权限]	授予颁发客户端证书的权限	写入	SourceServerResource
ListApplications	授予权限以列出应用程序摘要	列表
ListConnectors	授予权限以列出连接器	读取
ListExportErrors	授予权限以列出导出任务的错误	列表	ExportResource*
ListExports	授予权限以列出导出任务	列表
ListImportErrors	授予权限以列出导入任务的错误	列表	ImportResource*
ListImports	授予权限以列出导入任务	列表
ListManagedAccounts	授予列出托管账户的权限	列表
ListNetworkMigrationAnalyses	授予列出网络迁移分析的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationAnalysisResults	授予列出网络迁移分析结果的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationCodeGenerationSegments	授予列出网络迁移代码生成段的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationCodeGenerations	授予列出网络迁移代码世代的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationDefinitions	授予列出网络迁移定义的权限	列表
ListNetworkMigrationDeployedStacks	授予列出网络迁移部署堆栈的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationDeployedStacksDeletions	授予列出网络迁移部署堆栈删除的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationDeployments	授予列出网络迁移部署的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationExecutions	授予列出网络迁移执行的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationMapperSegmentConstructs	授予列出网络迁移映射器分段结构的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationMapperSegments	授予列出网络迁移映射器分段的权限	列表	NetworkMigrationDefinitionResource*
ListNetworkMigrationMappings	授予列出网络迁移映射的权限	列表	NetworkMigrationDefinitionResource*
ListSourceServerActions	授予权限以列出源服务器操作文档	列表	SourceServerResource*
ListTagsForResource	授予权限以列出资源的标签	读取
ListTemplateActions	授予权限以列出启动配置模板操作文档	列表	LaunchConfigurationTemplateResource*
ListWaves	授予权限以列出轮次摘要	列表
MarkAsArchived	授予权限以将源服务器标记为已存档	Write	SourceServerResource*
NotifyAgentAuthenticationForMgn[仅权限]	授予权限以通知代理身份验证	Write	SourceServerResource*
NotifyAgentConnectedForMgn[仅权限]	授予权限以通知代理已连接	Write	SourceServerResource*
NotifyAgentDisconnectedForMgn[仅权限]	授予权限以通知代理已断开连接	Write	SourceServerResource*
NotifyAgentReplicationProgressForMgn[仅权限]	授予权限以通知代理复制进度	Write	SourceServerResource*
NotifyVcenterClientStartedForMgn[仅权限]	授予通知 vcenter 客户端已启动的权限	写入	VcenterClientResource*
PauseReplication	授予暂停复制的权限	写入	SourceServerResource*
PutSourceServerAction	授予权限以发送源服务器操作文档	写入	SourceServerResource*
PutTemplateAction	授予权限以发送启动配置模板操作文档	写入	LaunchConfigurationTemplateResource*
RegisterAgentForMgn[仅权限]	授予权限以注册代理	写入		aws:RequestTag/${TagKey} aws:TagKeys
RemoveSourceServerAction	授予权限以删除源服务器操作文档	写入	SourceServerResource*
RemoveTemplateAction	授予权限以删除启动配置模板操作文档	写入	LaunchConfigurationTemplateResource*
ResumeReplication	授予恢复复制的权限	写入	SourceServerResource*
RetryDataReplication	授予权限以重试复制	Write	SourceServerResource*
SendAgentLogsForMgn[仅权限]	授予权限以发送代理日志	Write	SourceServerResource*
SendAgentMetricsForMgn[仅权限]	授予权限以发送代理指标	Write	SourceServerResource*
SendChannelCommandResultForMgn[仅权限]	授予权限以发送通道命令结果	Write
SendClientLogsForMgn[仅权限]	授予权限以发送客户端日志	Write
SendClientMetricsForMgn[仅权限]	授予权限以发送客户端指标	写入
SendVcenterClientCommandResultForMgn[仅权限]	授予发送 vcenter 客户端命令结果的权限	写入	VcenterClientResource*
SendVcenterClientLogsForMgn[仅权限]	授予发送 vcenter 客户端日志的权限	写入	VcenterClientResource*
SendVcenterClientMetricsForMgn[仅权限]	授予发送 vcenter 客户端指标的权限	写入	VcenterClientResource*
StartCutover	授予权限以启动切换	写入	SourceServerResource*		ec2:AttachVolume ec2:AuthorizeSecurityGroupEgress ec2:AuthorizeSecurityGroupIngress ec2:CreateLaunchTemplate ec2:CreateLaunchTemplateVersion ec2:CreateSecurityGroup ec2:CreateSnapshot ec2:CreateTags ec2:CreateVolume ec2:DeleteLaunchTemplateVersions ec2:DeleteSnapshot ec2:DeleteVolume ec2:DescribeAccountAttributes ec2:DescribeAvailabilityZones ec2:DescribeImages ec2:DescribeInstanceAttribute ec2:DescribeInstanceStatus ec2:DescribeInstanceTypes ec2:DescribeInstances ec2:DescribeLaunchTemplateVersions ec2:DescribeLaunchTemplates ec2:DescribeSecurityGroups ec2:DescribeSnapshots ec2:DescribeSubnets ec2:DescribeVolumes ec2:DetachVolume ec2:ModifyInstanceAttribute ec2:ModifyLaunchTemplate ec2:ReportInstanceStatus ec2:RevokeSecurityGroupEgress ec2:RunInstances ec2:StartInstances ec2:StopInstances ec2:TerminateInstances iam:PassRole mgn:ListTagsForResource
StartCutover	授予权限以启动切换	写入		aws:RequestTag/${TagKey} aws:TagKeys
StartExport	授予权限以启动导出任务	写入			ec2:DescribeLaunchTemplateVersions mgn:DescribeSourceServers mgn:GetLaunchConfiguration mgn:ListApplications mgn:ListWaves s3:PutObject
StartImport	授予权限以创建导入任务	写入			ec2:CreateLaunchTemplateVersion ec2:DescribeLaunchTemplateVersions ec2:ModifyLaunchTemplate mgn:DescribeSourceServers mgn:GetLaunchConfiguration mgn:ListApplications mgn:ListWaves mgn:TagResource mgn:UpdateLaunchConfiguration s3:PutObject
StartNetworkMigrationAnalysis	授予启动网络迁移分析的权限	写入	NetworkMigrationDefinitionResource*		directconnect:DescribeConnections directconnect:DescribeDirectConnectGatewayAssociations directconnect:DescribeDirectConnectGatewayAttachments directconnect:DescribeDirectConnectGateways directconnect:DescribeVirtualGateways directconnect:DescribeVirtualInterfaces ec2:AuthorizeSecurityGroupIngress ec2:CreateNetworkInsightsPath ec2:CreateNetworkInterface ec2:CreateSecurityGroup ec2:CreateTags ec2:DeleteNetworkInsightsAnalysis ec2:DeleteNetworkInsightsPath ec2:DeleteNetworkInterface ec2:DeleteSecurityGroup ec2:DeleteTags ec2:DescribeAvailabilityZones ec2:DescribeCustomerGateways ec2:DescribeInstances ec2:DescribeInternetGateways ec2:DescribeManagedPrefixLists ec2:DescribeNatGateways ec2:DescribeNetworkAcls ec2:DescribeNetworkInsightsAnalyses ec2:DescribeNetworkInsightsPaths ec2:DescribeNetworkInterfaces ec2:DescribePrefixLists ec2:DescribeRegions ec2:DescribeRouteTables ec2:DescribeSecurityGroups ec2:DescribeSubnets ec2:DescribeTransitGatewayAttachments ec2:DescribeTransitGatewayConnects ec2:DescribeTransitGatewayPeeringAttachments ec2:DescribeTransitGatewayRouteTables ec2:DescribeTransitGatewayVpcAttachments ec2:DescribeTransitGateways ec2:DescribeVpcEndpointServiceConfigurations ec2:DescribeVpcEndpoints ec2:DescribeVpcPeeringConnections ec2:DescribeVpcs ec2:DescribeVpnConnections ec2:DescribeVpnGateways ec2:GetManagedPrefixListEntries ec2:GetTransitGatewayRouteTablePropagations ec2:SearchTransitGatewayRoutes ec2:StartNetworkInsightsAnalysis elasticloadbalancing:DescribeListeners elasticloadbalancing:DescribeLoadBalancerAttributes elasticloadbalancing:DescribeLoadBalancers elasticloadbalancing:DescribeRules elasticloadbalancing:DescribeTags elasticloadbalancing:DescribeTargetGroupAttributes elasticloadbalancing:DescribeTargetGroups elasticloadbalancing:DescribeTargetHealth globalaccelerator:ListAccelerators globalaccelerator:ListCustomRoutingAccelerators globalaccelerator:ListCustomRoutingEndpointGroups globalaccelerator:ListCustomRoutingListeners globalaccelerator:ListCustomRoutingPortMappings globalaccelerator:ListEndpointGroups globalaccelerator:ListListeners network-firewall:DescribeFirewall network-firewall:DescribeFirewallPolicy network-firewall:DescribeResourcePolicy network-firewall:DescribeRuleGroup network-firewall:ListFirewallPolicies network-firewall:ListFirewalls network-firewall:ListRuleGroups tiros:CreateQuery tiros:ExtendQuery tiros:GetQueryAnswer tiros:GetQueryExplanation tiros:GetQueryExtensionAccounts
StartNetworkMigrationCodeGeneration	授予启动网络迁移代码生成的权限	写入	NetworkMigrationDefinitionResource*
StartNetworkMigrationDeployedStacksDeletion	授予开始删除网络迁移部署堆栈的权限	写入	NetworkMigrationDefinitionResource*		ec2:AcceptTransitGatewayVpcAttachment ec2:AssociateNatGatewayAddress ec2:AssociateRouteTable ec2:AssociateSubnetCidrBlock ec2:AssociateTransitGatewayRouteTable ec2:AssociateVpcCidrBlock ec2:AttachInternetGateway ec2:AttachVolume ec2:AuthorizeSecurityGroupEgress ec2:AuthorizeSecurityGroupIngress ec2:DeleteInternetGateway ec2:DeleteLaunchTemplate ec2:DeleteLaunchTemplateVersions ec2:DeleteNatGateway ec2:DeleteNetworkAcl ec2:DeleteNetworkAclEntry ec2:DeleteNetworkInsightsAnalysis ec2:DeleteNetworkInsightsPath ec2:DeleteNetworkInterface ec2:DeleteRoute ec2:DeleteRouteTable ec2:DeleteSecurityGroup ec2:DeleteSnapshot ec2:DeleteSubnet ec2:DeleteTransitGateway ec2:DeleteTransitGatewayRoute ec2:DeleteTransitGatewayRouteTable ec2:DeleteTransitGatewayVpcAttachment ec2:DeleteVolume ec2:DeleteVpc ec2:DetachInternetGateway ec2:DetachVolume ec2:DisableTransitGatewayRouteTablePropagation ec2:DisassociateNatGatewayAddress ec2:DisassociateRouteTable ec2:DisassociateTransitGatewayRouteTable ec2:EnableTransitGatewayRouteTablePropagation ec2:ModifyInstanceAttribute ec2:ModifyLaunchTemplate ec2:ModifySubnetAttribute ec2:ModifyTransitGateway ec2:ModifyTransitGatewayVpcAttachment ec2:ModifyVolume ec2:ModifyVpcAttribute ec2:RejectTransitGatewayVpcAttachment ec2:ReleaseAddress ec2:ReplaceNetworkAclAssociation ec2:ReplaceNetworkAclEntry ec2:ReplaceRoute ec2:ReplaceTransitGatewayRoute ec2:RevokeSecurityGroupEgress ec2:RevokeSecurityGroupIngress ec2:SearchTransitGatewayRoutes
StartNetworkMigrationDeployment	授予启动网络迁移部署的权限	写入	NetworkMigrationDefinitionResource*		ec2:AcceptTransitGatewayVpcAttachment ec2:AssociateNatGatewayAddress ec2:AssociateRouteTable ec2:AssociateSubnetCidrBlock ec2:AssociateTransitGatewayRouteTable ec2:AssociateVpcCidrBlock ec2:AttachInternetGateway ec2:AttachVolume ec2:AuthorizeSecurityGroupEgress ec2:AuthorizeSecurityGroupIngress ec2:CreateNatGateway ec2:CreateNetworkAcl ec2:CreateNetworkAclEntry ec2:CreateNetworkInsightsPath ec2:CreateNetworkInterface ec2:CreateRoute ec2:CreateRouteTable ec2:CreateSecurityGroup ec2:CreateSubnet ec2:CreateTags ec2:CreateTransitGatewayRoute ec2:CreateTransitGatewayRouteTable ec2:CreateTransitGatewayVpcAttachment ec2:DeleteInternetGateway ec2:DeleteLaunchTemplate ec2:DeleteLaunchTemplateVersions ec2:DeleteNatGateway ec2:DeleteNetworkAcl ec2:DeleteNetworkAclEntry ec2:DeleteNetworkInsightsAnalysis ec2:DeleteNetworkInsightsPath ec2:DeleteNetworkInterface ec2:DeleteRoute ec2:DeleteRouteTable ec2:DeleteSecurityGroup ec2:DeleteSnapshot ec2:DeleteSubnet ec2:DeleteTransitGateway ec2:DeleteTransitGatewayRoute ec2:DeleteTransitGatewayRouteTable ec2:DeleteTransitGatewayVpcAttachment ec2:DeleteVolume ec2:DeleteVpc ec2:DescribeAccountAttributes ec2:DescribeAddresses ec2:DescribeAvailabilityZones ec2:DescribeCustomerGateways ec2:DescribeEgressOnlyInternetGateways ec2:DescribeHosts ec2:DescribeImages ec2:DescribeInstanceAttribute ec2:DescribeInstanceStatus ec2:DescribeInstanceTypes ec2:DescribeInstances ec2:DescribeInternetGateways ec2:DescribeLaunchTemplateVersions ec2:DescribeLaunchTemplates ec2:DescribeManagedPrefixLists ec2:DescribeNatGateways ec2:DescribeNetworkAcls ec2:DescribeNetworkInsightsAnalyses ec2:DescribeNetworkInsightsPaths ec2:DescribeNetworkInterfaces ec2:DescribePrefixLists ec2:DescribeRegions ec2:DescribeRouteTables ec2:DescribeSecurityGroupRules ec2:DescribeSecurityGroups ec2:DescribeSnapshots ec2:DescribeSubnets ec2:DescribeTransitGatewayAttachments ec2:DescribeTransitGatewayConnects ec2:DescribeTransitGatewayPeeringAttachments ec2:DescribeTransitGatewayRouteTables ec2:DescribeTransitGatewayVpcAttachments ec2:DescribeTransitGateways ec2:DescribeVolumes ec2:DescribeVpcEndpointServiceConfigurations ec2:DescribeVpcEndpoints ec2:DescribeVpcPeeringConnections ec2:DescribeVpcs ec2:DescribeVpnConnections ec2:DescribeVpnGateways ec2:DetachInternetGateway ec2:DetachVolume ec2:DisableTransitGatewayRouteTablePropagation ec2:DisassociateNatGatewayAddress ec2:DisassociateRouteTable ec2:DisassociateTransitGatewayRouteTable ec2:EnableTransitGatewayRouteTablePropagation ec2:GetEbsDefaultKmsKeyId ec2:GetEbsEncryptionByDefault ec2:GetManagedPrefixListEntries ec2:GetTransitGatewayRouteTableAssociations ec2:GetTransitGatewayRouteTablePropagations ec2:ModifyInstanceAttribute ec2:ModifyLaunchTemplate ec2:ModifySubnetAttribute ec2:ModifyTransitGateway ec2:ModifyTransitGatewayVpcAttachment ec2:ModifyVolume ec2:ModifyVpcAttribute ec2:RejectTransitGatewayVpcAttachment ec2:ReleaseAddress ec2:ReplaceNetworkAclAssociation ec2:ReplaceNetworkAclEntry ec2:ReplaceRoute ec2:ReplaceTransitGatewayRoute ec2:RevokeSecurityGroupEgress ec2:RevokeSecurityGroupIngress ec2:SearchTransitGatewayRoutes ec2:StartNetworkInsightsAnalysis
StartNetworkMigrationMapping	授予启动网络迁移映射的权限	写入	NetworkMigrationDefinitionResource*
StartReplication	授予启动复制的权限	写入	SourceServerResource*
StartTest	授予权限以启动测试	写入	SourceServerResource*		ec2:AttachVolume ec2:AuthorizeSecurityGroupEgress ec2:AuthorizeSecurityGroupIngress ec2:CreateLaunchTemplate ec2:CreateLaunchTemplateVersion ec2:CreateSecurityGroup ec2:CreateSnapshot ec2:CreateTags ec2:CreateVolume ec2:DeleteLaunchTemplateVersions ec2:DeleteSnapshot ec2:DeleteVolume ec2:DescribeAccountAttributes ec2:DescribeAvailabilityZones ec2:DescribeImages ec2:DescribeInstanceAttribute ec2:DescribeInstanceStatus ec2:DescribeInstanceTypes ec2:DescribeInstances ec2:DescribeLaunchTemplateVersions ec2:DescribeLaunchTemplates ec2:DescribeSecurityGroups ec2:DescribeSnapshots ec2:DescribeSubnets ec2:DescribeVolumes ec2:DetachVolume ec2:ModifyInstanceAttribute ec2:ModifyLaunchTemplate ec2:ReportInstanceStatus ec2:RevokeSecurityGroupEgress ec2:RunInstances ec2:StartInstances ec2:StopInstances ec2:TerminateInstances iam:PassRole mgn:ListTagsForResource
StartTest	授予权限以启动测试	写入		aws:RequestTag/${TagKey} aws:TagKeys
StopReplication	授予权限以停止复制	写入	SourceServerResource*
TagResource	授予权限以分配资源标签	Tagging	ApplicationResource
			ConnectorResource
			JobResource
			LaunchConfigurationTemplateResource
			ReplicationConfigurationTemplateResource
			SourceServerResource
			VcenterClientResource
			WaveResource
				aws:RequestTag/${TagKey} mgn:CreateAction aws:TagKeys
TerminateTargetInstances	授予权限以终止目标实例	写入	SourceServerResource*		ec2:DeleteVolume ec2:DescribeInstances ec2:DescribeVolumes ec2:TerminateInstances
TerminateTargetInstances	授予权限以终止目标实例	写入		aws:RequestTag/${TagKey} aws:TagKeys
UnarchiveApplication	授予权限以取消存档应用程序	写入	ApplicationResource*
UnarchiveWave	授予权限以取消存档轮次	写入	WaveResource*
UntagResource	授予权限以取消标记资源	Tagging	ApplicationResource
			ConnectorResource
			JobResource
			LaunchConfigurationTemplateResource
			ReplicationConfigurationTemplateResource
			SourceServerResource
			VcenterClientResource
			WaveResource
				aws:TagKeys
UpdateAgentBacklogForMgn[仅权限]	授予权限以更新代理积压	Write	SourceServerResource*
UpdateAgentConversionInfoForMgn[仅权限]	授予权限以更新代理转换信息	Write	SourceServerResource*
UpdateAgentReplicationInfoForMgn[仅权限]	授予权限以更新代理复制信息	Write	SourceServerResource*
UpdateAgentReplicationProcessStateForMgn[仅权限]	授予权限以更新代理复制进程状态	Write	SourceServerResource*
UpdateAgentSourcePropertiesForMgn[仅权限]	授予权限以更新代理源属性	写入	SourceServerResource*
UpdateApplication	授予更新应用程序的权限	写入	ApplicationResource*
UpdateConnector	授予更新连接器的权限	写入	ConnectorResource*
UpdateLaunchConfiguration	授予权限以更新启动配置	写入	SourceServerResource*
UpdateLaunchConfigurationTemplate	授予权限以更新启动配置	写入	LaunchConfigurationTemplateResource*
UpdateNetworkMigrationDefinition	授予更新网络迁移定义的权限	写入	NetworkMigrationDefinitionResource*
UpdateNetworkMigrationMapperSegment	授予更新网络迁移映射器分段的权限	写入	NetworkMigrationDefinitionResource*
UpdateNetworkMigrationMapperSegmentConstruct	授予更新网络迁移映射器分段结构的权限	写入	NetworkMigrationDefinitionResource*
UpdateReplicationConfiguration	授予权限以更新复制配置	Write	SourceServerResource*
UpdateReplicationConfigurationTemplate	授予权限以更新复制配置模板	写入	ReplicationConfigurationTemplateResource*
UpdateSourceServer	授予更新源服务器的权限	写入	SourceServerResource*
UpdateSourceServerReplicationType	授予更新源服务器复制类型的权限	写入	SourceServerResource*
UpdateWave	授予权限以更新轮次	写入	WaveResource*
VerifyClientRoleForMgn[仅权限]	授予验证客户端角色的权限	读取

AWS Application Migration Service 定义的资源类型

以下资源类型是由该服务定义的，可以在 IAM 权限策略语句的 Resource 元素中使用这些资源类型。操作表中的每个操作指定了可以使用该操作指定的资源类型。您也可以在策略中包含条件键，从而定义资源类型。这些键显示在资源类型表的最后一列。有关下表中各列的详细信息，请参阅资源类型表。

资源类型	ARN	条件键
JobResource	`arn:${Partition}:mgn:${Region}:${Account}:job/${JobID}`	aws:ResourceTag/${TagKey}
ReplicationConfigurationTemplateResource	`arn:${Partition}:mgn:${Region}:${Account}:replication-configuration-template/${ReplicationConfigurationTemplateID}`	aws:ResourceTag/${TagKey}
LaunchConfigurationTemplateResource	`arn:${Partition}:mgn:${Region}:${Account}:launch-configuration-template/${LaunchConfigurationTemplateID}`	aws:ResourceTag/${TagKey}
VcenterClientResource	`arn:${Partition}:mgn:${Region}:${Account}:vcenter-client/${VcenterClientID}`	aws:ResourceTag/${TagKey}
SourceServerResource	`arn:${Partition}:mgn:${Region}:${Account}:source-server/${SourceServerID}`	aws:ResourceTag/${TagKey}
ApplicationResource	`arn:${Partition}:mgn:${Region}:${Account}:application/${ApplicationID}`	aws:ResourceTag/${TagKey}
WaveResource	`arn:${Partition}:mgn:${Region}:${Account}:wave/${WaveID}`	aws:ResourceTag/${TagKey}
ImportResource	`arn:${Partition}:mgn:${Region}:${Account}:import/${ImportID}`	aws:ResourceTag/${TagKey}
ExportResource	`arn:${Partition}:mgn:${Region}:${Account}:export/${ExportID}`	aws:ResourceTag/${TagKey}
ConnectorResource	`arn:${Partition}:mgn:${Region}:${Account}:connector/${ConnectorID}`	aws:ResourceTag/${TagKey}
NetworkMigrationDefinitionResource	`arn:${Partition}:mgn:${Region}:${Account}:network-migration-definition/${NetworkMigrationDefinitionID}`	aws:ResourceTag/${TagKey}

AWS Application Migration Service 的条件键

AWS 应用程序迁移服务定义了可以在IAM策略Condition元素中使用的以下条件键。您可以使用这些键进一步细化应用策略语句的条件。有关下表中各列的详细信息，请参阅条件键表。

要查看适用于所有服务的全局条件键，请参阅可用的全局条件键。

条件键	描述	Type
aws:RequestTag/${TagKey}	根据在请求中是否具有标签/键值对来筛选访问权限	字符串
aws:ResourceTag/${TagKey}	按附加到资源的标签键值对筛选操作	字符串
aws:TagKeys	根据在请求中是否具有标签键来筛选访问权限	ArrayOfString
mgn:CreateAction	按资源API创建操作的名称筛选访问权限	字符串

Javascript 在您的浏览器中被禁用或不可用。

要使用 Amazon Web Services 文档，必须启用 Javascript。请参阅浏览器的帮助页面以了解相关说明。

文档惯例

AWS Application Discovery

Amazon Application Recovery Controller - 可用区转移