AWSApplicationMigrationReadOnlyAccess

ReaderAWS managedActivePermissions reviewedShow on map Compare

Summary

This policy provides permissions to all read-only public APIs of Application Migration Service (MGN), as well as some read-only APIs of other AWS services that are required in order to make full read-only use of the MGN console. Attach this policy to your IAM users or roles.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSApplicationMigrationReadOnlyAccess
Default version: v7
Created: 2021-04-07
Last edited: 2026-11-09
Services: ec2, mgn, servicequotas, ssm

Control-plane actions (27)

By access level: 21 List, 6 Read.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
EC2	4 of 834	4 List; 0 restricted, 0 conditional	ec2:DescribeInstances, ec2:DescribeLaunchTemplateVersions, ec2:DescribeSecurityGroups, ec2:DescribeSubnets
MGN	21 of 147	17 List, 4 Read; 0 restricted, 0 conditional	mgn:DescribeJobLogItems, mgn:DescribeJobs, mgn:DescribeLaunchConfigurationTemplates, mgn:DescribeReplicationConfigurationTemplates, mgn:DescribeSourceServers, mgn:DescribeVcenterClients, mgn:GetLaunchConfiguration, mgn:GetLaunchConfigurationDefaults, mgn:GetReplicationConfiguration, mgn:ListApplications, mgn:ListExportErrors, mgn:ListExports and 9 more
Service Quotas	1 of 26	1 Read; 0 restricted, 0 conditional	servicequotas:GetServiceQuota
Systems Manager	1 of 164	1 Read; 0 restricted, 0 conditional	ssm:GetParameter

EC2: 4 actions

ec2:DescribeInstances (List)
ec2:DescribeLaunchTemplateVersions (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeSubnets (List)

MGN: 21 actions

mgn:DescribeJobLogItems (Read)
mgn:DescribeJobs (List)
mgn:DescribeLaunchConfigurationTemplates (List)
mgn:DescribeReplicationConfigurationTemplates (List)
mgn:DescribeSourceServers (List)
mgn:DescribeVcenterClients (List)
mgn:GetLaunchConfiguration (Read)
mgn:GetLaunchConfigurationDefaults (Read)
mgn:GetReplicationConfiguration (Read)
mgn:ListApplications (List)
mgn:ListExportErrors (List)
mgn:ListExports (List)
mgn:ListImportErrors (List)
mgn:ListImports (List)
mgn:ListRemoteSourceActionInvocationResults (List)
mgn:ListRemoteSourceActionInvocations (List)
mgn:ListRemoteSourceActionJobs (List)
mgn:ListRemoteSourceActions (List)
mgn:ListSourceServerActions (List)
mgn:ListTemplateActions (List)
mgn:ListWaves (List)

Service Quotas: 1 actions

servicequotas:GetServiceQuota (Read)

Systems Manager: 1 actions

ssm:GetParameter (Read)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants only List and Read actions.
Can read secret values or decrypt data. Reads are not a High privilege rule.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mgn:DescribeJobLogItems",
        "mgn:DescribeJobs",
        "mgn:DescribeSourceServers",
        "mgn:DescribeReplicationConfigurationTemplates",
        "mgn:GetLaunchConfiguration",
        "mgn:DescribeVcenterClients",
        "mgn:GetReplicationConfiguration",
        "mgn:DescribeLaunchConfigurationTemplates",
        "mgn:ListSourceServerActions",
        "mgn:ListTemplateActions",
        "mgn:ListApplications",
        "mgn:ListWaves",
        "mgn:ListExports",
        "mgn:ListImports",
        "mgn:ListImportErrors",
        "mgn:ListExportErrors",
        "mgn:ListRemoteSourceActions",
        "mgn:ListRemoteSourceActionJobs",
        "mgn:ListRemoteSourceActionInvocations",
        "mgn:ListRemoteSourceActionInvocationResults",
        "mgn:GetLaunchConfigurationDefaults"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "servicequotas:GetServiceQuota"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v7, edited by AWS on 2026-11-09. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSApplicationMigrationReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSApplicationMigrationReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSApplicationMigrationReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSApplicationMigrationReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "awsapplicationmigrationreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSApplicationMigrationReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSApplicationMigrationReadOnlyAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.