Skip to main content
IAM Policy Map
IAM Policy Map
Migration & Transfer: Switch between the hub and domains
MapList

Can change permissions or pass roles: 8 of 54 policies: 0 unrestricted, 8 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 13 of 54 policies: 7 write, 4 read only, 2 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Migration & Transfer policies

Moving workloads, databases and data into AWS.

54 AWS managed policies. 1 have reviewed guidance; the rest have authoritative permission data pending editorial review. 5 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (19)

Migration Hub (4)

Elastic Disaster Recovery (3)

  • AWSElasticDisasterRecoveryConsoleFullAccessAdmin

    This policy provides full access to all public APIs of AWS Elastic Disaster Recovery (DRS), as well as permissions to read KMS key, License Manager, Resource Groups, Elastic Load Balancing, IAM, and EC2 information. Attach this policy to yo…

  • AWSElasticDisasterRecoveryConsoleFullAccess_v2Admin

    This policy provides full access to all public APIs of AWS Elastic Disaster Recovery (AWS DRS), as well as all public APIs in other AWS services used by AWS DRS Console. Attach this policy to your users or roles.

  • AWSElasticDisasterRecoveryReadOnlyAccessReader

    You can attach the AWSElasticDisasterRecoveryReadOnlyAccess policy to your IAM identities. This policy provides permissions to all read-only public APIs of Elastic Disaster Recovery (DRS), as well as some read-only APIs of other AWS service…

Transfer Family (3)

Application Discovery (2)

Application Migration Service (2)

  • AWSApplicationMigrationFullAccessAdmin

    This policy provides permissions to all public APIs of AWS Application Migration Service (MGN), as well as permissions to read KMS key information. Attach this policy to your IAM users or roles.

  • AWSApplicationMigrationReadOnlyAccessReader

    This policy provides permissions to all read-only public APIs of Application Migration Service (MGN), as well as some read-only APIs of other AWS services that are required in order to make full read-only use of the MGN console. Attach this…

DataSync (2)

Other services (3)

Operator and limited (14)

Application Migration Service (4)

  • AWSApplicationMigrationAgentInstallationPolicyOperator

    This policy allows installing the AWS Replication Agent, which is used with AWS Application Migration Service (MGN) to migrate external servers to AWS. Attach this policy to your IAM users or roles whose credentials you provide when install…

  • AWSApplicationMigrationAgentPolicyOperator

    This policy allows installing and using the AWS Replication Agent, which is used with AWS Application Migration Service (MGN) to migrate external servers to AWS. Attach this policy to your IAM users or roles whose credentials you provide wh…

  • AWSApplicationMigrationServiceEc2InstancePolicyOperator

    This policy allows installing and using the AWS Replication Agent, which is used by AWS Application Migration Service (AWS MGN) to migrate source servers that run on EC2 (cross-Region or cross-AZ). An IAM role with this policy should be att…

  • AWSApplicationMigrationVCenterClientPolicyOperator

    This policy allows installing and using the AWS VCenter Client, which is used with AWS Application Migration Service (MGN) to migrate external servers to AWS. Attach this policy to your IAM users or roles whose credentials you provide when …

Transform (3)

DMS (2)

Elastic Disaster Recovery (2)

  • AWSElasticDisasterRecoveryAgentInstallationPolicyOperator

    This policy allows installing the AWS Replication Agent, which is used with AWS Elastic Disaster Recovery (DRS) to recover external servers to AWS. Attach this policy to your IAM users or roles whose credentials you provide during the insta…

  • AWSElasticDisasterRecoveryFailbackInstallationPolicyOperator

    You can attach the AWSElasticDisasterRecoveryFailbackInstallationPolicy policy to your IAM identities. This policy allows installing the Elastic Disaster Recovery Failback Client, which is used to failback Recovery Instances back to your or…

Other services (3)

  • AWSApplicationDiscoveryAgentAccessOperator

    Provides access for the Discovery Agent to register with AWS Application Discovery Service.

  • AWSImportExportFullAccessOperator

    Provides read and write access to the jobs created under the AWS account.

  • AWSMigrationHubStrategyCollectorOperator

    Grants permissions to allow communication with the AWS Migration Hub Strategy Recommendations service, read/write access to S3 buckets related to the service, Amazon API Gateway access to upload logs and metrics to AWS, AWS Secrets Manager …

Service roles (16)

Elastic Disaster Recovery (9)

  • AWSElasticDisasterRecoveryAgentPolicyOperator

    This policy allows using the AWS Replication Agent, which is used with AWS Elastic Disaster Recovery (DRS) to recover source servers to AWS. We do not recommend that you attach this policy to your IAM users or roles.

  • AWSElasticDisasterRecoveryConversionServerPolicyOperator

    This policy is attached to the AWS Elastic Disaster Recovery Conversion server's instance role. This policy allows Elastic Disaster Recovery (DRS) Conversion Servers, which are EC2 instances launched by Elastic Disaster Recovery, to communi…

  • AWSElasticDisasterRecoveryCrossAccountReplicationPolicyOperator

    This policy allows AWS Elastic Disaster Recovery (DRS) to support cross-account replication and cross-account failback.

  • AWSElasticDisasterRecoveryEc2InstancePolicyOperator

    This policy allows installing and using the AWS Replication Agent, which is used by AWS Elastic Disaster Recovery (DRS) to recover source servers that run on EC2 (cross-region or cross-AZ). An IAM role with this policy should be attached (a…

  • AWSElasticDisasterRecoveryFailbackPolicyOperator

    This policy allows using the Elastic Disaster Recovery Failback Client, which is used to failback Recovery Instances back to your original source infrastructure. We do not recommend that you attach this policy to your IAM users or roles.

  • AWSElasticDisasterRecoveryRecoveryInstancePolicyOperator

    This policy is attached to the instance role of Elastic Disaster Recovery's Recovery Instance. This policy allows the Elastic Disaster Recovery (DRS) Recovery Instance, which are EC2 instances launched by Elastic Disaster Recovery - to comm…

  • AWSElasticDisasterRecoveryReplicationServerPolicyOperator

    This policy is attached to the Elastic Disaster Recovery Replication server's instance role. This policy allows the Elastic Disaster Recovery (DRS) Replication Servers, which are EC2 instances launched by Elastic Disaster Recovery - to comm…

  • AWSElasticDisasterRecoveryStagingAccountPolicyOperator

    This policy allows read-only access to AWS Elastic Disaster Recovery (DRS) resources such as source servers and jobs. It also allows creating a converted snapshot and sharing that EBS snapshot with a specific account.

  • AWSElasticDisasterRecoveryStagingAccountPolicy_v2Operator

    This policy is used by AWS Elastic Disaster Recovery (DRS) to recover source servers into a separate target account and to allow failing back. We do not recommend that you attach this policy to your IAM users or roles.

Application Migration Service (4)

  • AWSApplicationMigrationAgentPolicy_v2Operator

    This policy allows using the AWS Replication Agent, which is used with AWS Application Migration Service (MGN) to migrate external servers to AWS. We do not recommend that you attach this policy to your IAM users or roles.

  • AWSApplicationMigrationConversionServerPolicyOperator

    This policy allows the Application Migration Service (MGN) Conversion Server, which are EC2 instances launched by Application Migration Service, to communicate with the MGN service. An IAM role with this policy is attached (as an EC2 Instan…

  • AWSApplicationMigrationMGHAccessOperator

    This policy allows AWS Application Migration Service (MGN) to send meta-data about the progress of servers being migrated using MGN to AWS Migration Hub (MGH). MGN automatically creates an IAM role with this policy attached, and assumes thi…

  • AWSApplicationMigrationReplicationServerPolicyOperator

    This policy allows the Application Migration Service (MGN) Replication Servers, which are EC2 instances launched by Application Migration Service - to communicate with the MGN service, and to create EBS snapshots in your AWS account. An IAM…

Migration Hub (3)

  • AWSMigrationHubDiscoveryAccessOperator

    Policy allows AWSMigrationHubService to call AWSApplicationDiscoveryService on behalf of the customer.

  • AWSMigrationHubDMSAccessOperator

    Policy for Database Migration Service to assume role in customer's account to call Migration Hub

  • AWSMigrationHubSMSAccessOperator

    Policy for Server Migration Service to assume role in customer's account to call Migration Hub

Service-linked roles (5)

Also relevant to Migration & Transfer (12)
  • AmazonS3OutpostsFullAccessAdmin

    Provides full access to Amazon S3 on Outposts via the AWS Management Console.

  • AmazonS3OutpostsReadOnlyAccessReader

    Provides read only access to Amazon S3 on Outposts via the AWS Management Console.

  • AWSApplicationDiscoveryAgentlessCollectorAccessOperator

    Allows Application Discovery Service Agentless Collectors to auto update, register, and communicate with Application Discovery Service

  • AWSApplicationMigrationServiceRolePolicyOperator

    Allows AWS application Migration Service to create and manage AWS resources on your behalf.

  • AWSMigrationHubOrchestratorPluginOperator

    Provides limited access to Amazon Simple Storage Service, AWS Secrets Manager and Plugin related actions for AWS Migration Hub Orchestrator.

  • AWSMigrationHubRefactorSpacesFullAccessAdmin

    Grants full access to AWS MigrationHub Refactor Spaces, AWS MigrationHub Refactor Spaces console features and other related AWS services except permissions required for AWS Lambda and AWS Resource Access Manager as they can be scoped down b…

  • AWSMigrationHubStrategyServiceRolePolicyOperator

    Enable access to AWS Resources used or managed by AWS Migration Hub Strategy Recommendations service.

  • AWSRefactoringToolkitFullAccessOperator

    This policy grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. It is intended to be attached to a local AWS profile. The policy allows uploading application artifacts and d…

  • AWSTransformNetworkMigrationAgentPolicyOperator

    Grants permissions for AWS Transform to deploy and configure network infrastructure including VPCs, Transit Gateways, and route tables for network migration

  • ServerMigration_ServiceRoleOperator

    Permissions to allow the AWS Server Migration Service to migrate VMs to EC2: allows the Server Migration Service to place the migrated resources into the customer's EC2 account.

  • ServerMigrationConnectorOperator

    Permissions to allow the AWS Server Migration Connector to migrate VMs to EC2. Allows communication with the AWS Server Migration Service, read/write access to S3 buckets starting with 'sms-b-' and 'import-to-ec2-' as well as the buckets us…

  • ServerMigrationServiceRoleForInstanceValidationOperator

    Permissions to allow the AWS SMS to run used data validation script and send script success/failure back to SMS

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.