Skip to main content
IAM Policy Map

AWSTransformNetworkMigrationAgentPolicy

OperatorAWS managedActivePermissions reviewedShow on mapCompare

Summary

Grants permissions for AWS Transform to deploy and configure network infrastructure including VPCs, Transit Gateways, and route tables for network migration

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN
arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy
Default version
v4
Created
Last edited
Services
cloudformation, directconnect, ec2, elasticloadbalancing, globalaccelerator, iam, kms, lambda, logs, mgn, network-firewall, organizations, ram, s3, ssm, sts, tiros, wellarchitected

Control-plane actions (242)

By access level: 69 List, 5 Permissions management, 51 Read, 8 Tagging, 109 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
CloudFormation10 of 1043 List, 3 Read, 4 Write; 10 restricted, 10 conditionalcloudformation:CreateStack, cloudformation:DeleteStack, cloudformation:DescribeStackEvents, cloudformation:DescribeStackResources, cloudformation:DescribeStacks, cloudformation:GetTemplateSummary, cloudformation:ListStackResources, cloudformation:ListStacks, cloudformation:UpdateStack, cloudformation:UpdateTerminationProtection
Direct Connect6 of 736 Read; 6 restricted, 6 conditionaldirectconnect:DescribeConnections, directconnect:DescribeDirectConnectGatewayAssociations, directconnect:DescribeDirectConnectGatewayAttachments, directconnect:DescribeDirectConnectGateways, directconnect:DescribeVirtualGateways, directconnect:DescribeVirtualInterfaces
EC294 of 83434 List, 3 Read, 1 Tagging, 56 Write; 94 restricted, 94 conditionalec2:AcceptTransitGatewayVpcAttachment, ec2:AllocateAddress, ec2:AssociateNatGatewayAddress, ec2:AssociateRouteTable, ec2:AssociateSubnetCidrBlock, ec2:AssociateTransitGatewayRouteTable, ec2:AssociateVpcCidrBlock, ec2:AttachInternetGateway, ec2:AuthorizeSecurityGroupEgress, ec2:AuthorizeSecurityGroupIngress, ec2:CreateInternetGateway, ec2:CreateNatGateway and 82 more
ELB20 of 771 List, 9 Read, 1 Tagging, 9 Write; 20 restricted, 20 conditionalelasticloadbalancing:AddTags, elasticloadbalancing:CreateListener, elasticloadbalancing:CreateLoadBalancer, elasticloadbalancing:CreateTargetGroup, elasticloadbalancing:DeleteListener, elasticloadbalancing:DeleteLoadBalancer, elasticloadbalancing:DeleteTargetGroup, elasticloadbalancing:DescribeCapacityReservation, elasticloadbalancing:DescribeListenerAttributes, elasticloadbalancing:DescribeListeners, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeLoadBalancers and 8 more
GlobalAccelerator7 of 567 List; 7 restricted, 7 conditionalglobalaccelerator:ListAccelerators, globalaccelerator:ListCustomRoutingAccelerators, globalaccelerator:ListCustomRoutingEndpointGroups, globalaccelerator:ListCustomRoutingListeners, globalaccelerator:ListCustomRoutingPortMappings, globalaccelerator:ListEndpointGroups, globalaccelerator:ListListeners
IAM12 of 1902 List, 3 Permissions management, 2 Read, 1 Tagging, 4 Write; 12 restricted, 12 conditionaliam:AttachRolePolicy, iam:CreateRole, iam:CreateServiceLinkedRole, iam:DeleteRole, iam:DeleteRolePolicy, iam:DetachRolePolicy, iam:GetRole, iam:GetRolePolicy, iam:ListAttachedRolePolicies, iam:ListRolePolicies, iam:PassRole, iam:TagRole
KMS3 of 581 Read, 2 Write; 3 restricted, 3 conditionalkms:Decrypt, kms:DescribeKey, kms:GenerateDataKey
Lambda9 of 1216 Read, 1 Tagging, 2 Write; 9 restricted, 9 conditionallambda:CreateFunction, lambda:DeleteFunction, lambda:GetFunction, lambda:GetFunctionCodeSigningConfig, lambda:GetFunctionConfiguration, lambda:GetFunctionRecursionConfig, lambda:GetRuntimeManagementConfig, lambda:ListTags, lambda:TagResource
CloudWatch Logs3 of 1333 Write; 3 restricted, 3 conditionallogs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents
MGN28 of 14715 List, 1 Read, 1 Tagging, 11 Write; 28 restricted, 28 conditionalmgn:CreateNetworkMigrationDefinition, mgn:DeleteNetworkMigrationDefinition, mgn:GetNetworkMigrationDefinition, mgn:ListNetworkMigrationAnalyses, mgn:ListNetworkMigrationAnalysisResults, mgn:ListNetworkMigrationCodeGenerationSegments, mgn:ListNetworkMigrationCodeGenerations, mgn:ListNetworkMigrationDefinitions, mgn:ListNetworkMigrationDeployedStacks, mgn:ListNetworkMigrationDeployedStacksDeletions, mgn:ListNetworkMigrationDeployments, mgn:ListNetworkMigrationExecutionArtifacts and 16 more
Network Firewall7 of 893 List, 4 Read; 7 restricted, 7 conditionalnetwork-firewall:DescribeFirewall, network-firewall:DescribeFirewallPolicy, network-firewall:DescribeResourcePolicy, network-firewall:DescribeRuleGroup, network-firewall:ListFirewallPolicies, network-firewall:ListFirewalls, network-firewall:ListRuleGroups
Organizations1 of 631 List; 0 restricted, 0 conditionalorganizations:ListAccounts
Resource Access Manager7 of 391 Read, 1 Tagging, 5 Write; 7 restricted, 7 conditionalram:AssociateResourceShare, ram:CreateResourceShare, ram:DeleteResourceShare, ram:DisassociateResourceShare, ram:GetResourceShares, ram:TagResource, ram:UpdateResourceShare
S38 of 1551 List, 4 Read, 1 Tagging, 2 Write; 8 restricted, 8 conditionals3:CreateBucket, s3:GetBucketLocation, s3:GetBucketPublicAccessBlock, s3:GetBucketTagging, s3:GetObjectAttributes, s3:ListBucketMultipartUploads, s3:PutBucketTagging, s3:PutEncryptionConfiguration
Systems Manager8 of 1642 List, 2 Permissions management, 1 Read, 1 Tagging, 2 Write; 8 restricted, 8 conditionalssm:AddTagsToResource, ssm:DeleteParameter, ssm:DeleteResourcePolicy, ssm:GetParameters, ssm:GetResourcePolicies, ssm:ListTagsForResource, ssm:PutParameter, ssm:PutResourcePolicy
STS1 of 161 Write; 1 restricted, 1 conditionalsts:AssumeRole
TirosAll 5 actions (see the Tiros page)3 Read, 2 Write; 5 restricted, 5 conditionaltiros:CreateQuery, tiros:ExtendQuery, tiros:GetQueryAnswer, tiros:GetQueryExplanation, tiros:GetQueryExtensionAccounts
Well-Architected Tool13 of 957 Read, 6 Write; 13 restricted, 13 conditionalwellarchitected:CreateAgentContext, wellarchitected:CreateAgentGoal, wellarchitected:GetAgentProfile, wellarchitected:GetAgentRecommendation, wellarchitected:GetAgentRecommendationGeneration, wellarchitected:ListAgentContexts, wellarchitected:ListAgentGoals, wellarchitected:ListAgentProfiles, wellarchitected:ListAgentRecommendations, wellarchitected:StartAgentRecommendationGeneration, wellarchitected:UpdateAgentContext, wellarchitected:UpdateAgentGoal and 1 more
CloudFormation: 10 actions
  • cloudformation:CreateStack (Write)
  • cloudformation:DeleteStack (Write)
  • cloudformation:DescribeStackEvents (Read)
  • cloudformation:DescribeStackResources (Read)
  • cloudformation:DescribeStacks (List)
  • cloudformation:GetTemplateSummary (Read)
  • cloudformation:ListStackResources (List)
  • cloudformation:ListStacks (List)
  • cloudformation:UpdateStack (Write)
  • cloudformation:UpdateTerminationProtection (Write)
Direct Connect: 6 actions
  • directconnect:DescribeConnections (Read)
  • directconnect:DescribeDirectConnectGatewayAssociations (Read)
  • directconnect:DescribeDirectConnectGatewayAttachments (Read)
  • directconnect:DescribeDirectConnectGateways (Read)
  • directconnect:DescribeVirtualGateways (Read)
  • directconnect:DescribeVirtualInterfaces (Read)
EC2: 94 actions
  • ec2:AcceptTransitGatewayVpcAttachment (Write)
  • ec2:AllocateAddress (Write)
  • ec2:AssociateNatGatewayAddress (Write)
  • ec2:AssociateRouteTable (Write)
  • ec2:AssociateSubnetCidrBlock (Write)
  • ec2:AssociateTransitGatewayRouteTable (Write)
  • ec2:AssociateVpcCidrBlock (Write)
  • ec2:AttachInternetGateway (Write)
  • ec2:AuthorizeSecurityGroupEgress (Write)
  • ec2:AuthorizeSecurityGroupIngress (Write)
  • ec2:CreateInternetGateway (Write)
  • ec2:CreateNatGateway (Write)
  • ec2:CreateNetworkInsightsPath (Write)
  • ec2:CreateNetworkInterface (Write)
  • ec2:CreateRoute (Write)
  • ec2:CreateRouteTable (Write)
  • ec2:CreateSecurityGroup (Write)
  • ec2:CreateSubnet (Write)
  • ec2:CreateTags (Tagging)
  • ec2:CreateTransitGateway (Write)
  • ec2:CreateTransitGatewayRoute (Write)
  • ec2:CreateTransitGatewayRouteTable (Write)
  • ec2:CreateTransitGatewayVpcAttachment (Write)
  • ec2:CreateVpc (Write)
  • ec2:DeleteInternetGateway (Write)
  • ec2:DeleteLaunchTemplate (Write)
  • ec2:DeleteLaunchTemplateVersions (Write)
  • ec2:DeleteNatGateway (Write)
  • ec2:DeleteNetworkInsightsAnalysis (Write)
  • ec2:DeleteNetworkInsightsPath (Write)
  • ec2:DeleteNetworkInterface (Write)
  • ec2:DeleteRoute (Write)
  • ec2:DeleteRouteTable (Write)
  • ec2:DeleteSecurityGroup (Write)
  • ec2:DeleteSubnet (Write)
  • ec2:DeleteTransitGateway (Write)
  • ec2:DeleteTransitGatewayRoute (Write)
  • ec2:DeleteTransitGatewayRouteTable (Write)
  • ec2:DeleteTransitGatewayVpcAttachment (Write)
  • ec2:DeleteVpc (Write)
  • ec2:DescribeAccountAttributes (List)
  • ec2:DescribeAddresses (List)
  • ec2:DescribeAvailabilityZones (List)
  • ec2:DescribeCustomerGateways (List)
  • ec2:DescribeEgressOnlyInternetGateways (List)
  • ec2:DescribeInstances (List)
  • ec2:DescribeInternetGateways (List)
  • ec2:DescribeManagedPrefixLists (List)
  • ec2:DescribeNatGateways (List)
  • ec2:DescribeNetworkAcls (List)
  • ec2:DescribeNetworkInsightsAnalyses (List)
  • ec2:DescribeNetworkInsightsPaths (List)
  • ec2:DescribeNetworkInterfaces (List)
  • ec2:DescribePrefixLists (List)
  • ec2:DescribeRegions (List)
  • ec2:DescribeRouteTables (List)
  • ec2:DescribeSecurityGroupRules (List)
  • ec2:DescribeSecurityGroups (List)
  • ec2:DescribeSubnets (List)
  • ec2:DescribeTransitGatewayAttachments (List)
  • ec2:DescribeTransitGatewayConnects (List)
  • ec2:DescribeTransitGatewayPeeringAttachments (List)
  • ec2:DescribeTransitGatewayRouteTables (List)
  • ec2:DescribeTransitGatewayVpcAttachments (List)
  • ec2:DescribeTransitGateways (List)
  • ec2:DescribeVpcEndpointServiceConfigurations (List)
  • ec2:DescribeVpcEndpoints (List)
  • ec2:DescribeVpcPeeringConnections (List)
  • ec2:DescribeVpcs (List)
  • ec2:DescribeVpnConnections (List)
  • ec2:DescribeVpnGateways (List)
  • ec2:DetachInternetGateway (Write)
  • ec2:DisableTransitGatewayRouteTablePropagation (Write)
  • ec2:DisassociateNatGatewayAddress (Write)
  • ec2:DisassociateRouteTable (Write)
  • ec2:DisassociateTransitGatewayRouteTable (Write)
  • ec2:EnableTransitGatewayRouteTablePropagation (Write)
  • ec2:GetManagedPrefixListEntries (Read)
  • ec2:GetSecurityGroupsForVpc (Read)
  • ec2:GetSubnetCidrReservations (Read)
  • ec2:GetTransitGatewayRouteTableAssociations (List)
  • ec2:GetTransitGatewayRouteTablePropagations (List)
  • ec2:ModifySubnetAttribute (Write)
  • ec2:ModifyTransitGateway (Write)
  • ec2:ModifyTransitGatewayVpcAttachment (Write)
  • ec2:ModifyVpcAttribute (Write)
  • ec2:RejectTransitGatewayVpcAttachment (Write)
  • ec2:ReleaseAddress (Write)
  • ec2:ReplaceRoute (Write)
  • ec2:ReplaceTransitGatewayRoute (Write)
  • ec2:RevokeSecurityGroupEgress (Write)
  • ec2:RevokeSecurityGroupIngress (Write)
  • ec2:SearchTransitGatewayRoutes (List)
  • ec2:StartNetworkInsightsAnalysis (Write)
ELB: 20 actions
  • elasticloadbalancing:AddTags (Tagging)
  • elasticloadbalancing:CreateListener (Write)
  • elasticloadbalancing:CreateLoadBalancer (Write)
  • elasticloadbalancing:CreateTargetGroup (Write)
  • elasticloadbalancing:DeleteListener (Write)
  • elasticloadbalancing:DeleteLoadBalancer (Write)
  • elasticloadbalancing:DeleteTargetGroup (Write)
  • elasticloadbalancing:DescribeCapacityReservation (Read)
  • elasticloadbalancing:DescribeListenerAttributes (Read)
  • elasticloadbalancing:DescribeListeners (Read)
  • elasticloadbalancing:DescribeLoadBalancerAttributes (Read)
  • elasticloadbalancing:DescribeLoadBalancers (List)
  • elasticloadbalancing:DescribeRules (Read)
  • elasticloadbalancing:DescribeTags (Read)
  • elasticloadbalancing:DescribeTargetGroupAttributes (Read)
  • elasticloadbalancing:DescribeTargetGroups (Read)
  • elasticloadbalancing:DescribeTargetHealth (Read)
  • elasticloadbalancing:ModifyListenerAttributes (Write)
  • elasticloadbalancing:ModifyLoadBalancerAttributes (Write)
  • elasticloadbalancing:ModifyTargetGroupAttributes (Write)
GlobalAccelerator: 7 actions
  • globalaccelerator:ListAccelerators (List)
  • globalaccelerator:ListCustomRoutingAccelerators (List)
  • globalaccelerator:ListCustomRoutingEndpointGroups (List)
  • globalaccelerator:ListCustomRoutingListeners (List)
  • globalaccelerator:ListCustomRoutingPortMappings (List)
  • globalaccelerator:ListEndpointGroups (List)
  • globalaccelerator:ListListeners (List)
IAM: 12 actions
  • iam:AttachRolePolicy (Permissions management)
  • iam:CreateRole (Write)
  • iam:CreateServiceLinkedRole (Write)
  • iam:DeleteRole (Write)
  • iam:DeleteRolePolicy (Permissions management)
  • iam:DetachRolePolicy (Permissions management)
  • iam:GetRole (Read)
  • iam:GetRolePolicy (Read)
  • iam:ListAttachedRolePolicies (List)
  • iam:ListRolePolicies (List)
  • iam:PassRole (Write)
  • iam:TagRole (Tagging)
KMS: 3 actions
  • kms:Decrypt (Write)
  • kms:DescribeKey (Read)
  • kms:GenerateDataKey (Write)
Lambda: 9 actions
  • lambda:CreateFunction (Write)
  • lambda:DeleteFunction (Write)
  • lambda:GetFunction (Read)
  • lambda:GetFunctionCodeSigningConfig (Read)
  • lambda:GetFunctionConfiguration (Read)
  • lambda:GetFunctionRecursionConfig (Read)
  • lambda:GetRuntimeManagementConfig (Read)
  • lambda:ListTags (Read)
  • lambda:TagResource (Tagging)
CloudWatch Logs: 3 actions
  • logs:CreateLogGroup (Write)
  • logs:CreateLogStream (Write)
  • logs:PutLogEvents (Write)
MGN: 28 actions
  • mgn:CreateNetworkMigrationDefinition (Write)
  • mgn:DeleteNetworkMigrationDefinition (Write)
  • mgn:GetNetworkMigrationDefinition (Read)
  • mgn:ListNetworkMigrationAnalyses (List)
  • mgn:ListNetworkMigrationAnalysisResults (List)
  • mgn:ListNetworkMigrationCodeGenerationSegments (List)
  • mgn:ListNetworkMigrationCodeGenerations (List)
  • mgn:ListNetworkMigrationDefinitions (List)
  • mgn:ListNetworkMigrationDeployedStacks (List)
  • mgn:ListNetworkMigrationDeployedStacksDeletions (List)
  • mgn:ListNetworkMigrationDeployments (List)
  • mgn:ListNetworkMigrationExecutionArtifacts (List)
  • mgn:ListNetworkMigrationExecutions (List)
  • mgn:ListNetworkMigrationInsights (List)
  • mgn:ListNetworkMigrationMapperSegmentConstructs (List)
  • mgn:ListNetworkMigrationMapperSegments (List)
  • mgn:ListNetworkMigrationMappingUpdates (List)
  • mgn:ListNetworkMigrationMappings (List)
  • mgn:StartNetworkMigrationAnalysis (Write)
  • mgn:StartNetworkMigrationCodeGeneration (Write)
  • mgn:StartNetworkMigrationDeployedStacksDeletion (Write)
  • mgn:StartNetworkMigrationDeployment (Write)
  • mgn:StartNetworkMigrationMapping (Write)
  • mgn:StartNetworkMigrationMappingUpdate (Write)
  • mgn:TagResource (Tagging)
  • mgn:UpdateNetworkMigrationDefinition (Write)
  • mgn:UpdateNetworkMigrationMapperSegment (Write)
  • mgn:UpdateNetworkMigrationMapperSegmentConstruct (Write)
Network Firewall: 7 actions
  • network-firewall:DescribeFirewall (Read)
  • network-firewall:DescribeFirewallPolicy (Read)
  • network-firewall:DescribeResourcePolicy (Read)
  • network-firewall:DescribeRuleGroup (Read)
  • network-firewall:ListFirewallPolicies (List)
  • network-firewall:ListFirewalls (List)
  • network-firewall:ListRuleGroups (List)
Organizations: 1 actions
  • organizations:ListAccounts (List)
Resource Access Manager: 7 actions
  • ram:AssociateResourceShare (Write)
  • ram:CreateResourceShare (Write)
  • ram:DeleteResourceShare (Write)
  • ram:DisassociateResourceShare (Write)
  • ram:GetResourceShares (Read)
  • ram:TagResource (Tagging)
  • ram:UpdateResourceShare (Write)
S3: 8 actions
  • s3:CreateBucket (Write)
  • s3:GetBucketLocation (Read)
  • s3:GetBucketPublicAccessBlock (Read)
  • s3:GetBucketTagging (Read)
  • s3:GetObjectAttributes (Read)
  • s3:ListBucketMultipartUploads (List)
  • s3:PutBucketTagging (Tagging)
  • s3:PutEncryptionConfiguration (Write)
Systems Manager: 8 actions
  • ssm:AddTagsToResource (Tagging)
  • ssm:DeleteParameter (Write)
  • ssm:DeleteResourcePolicy (Permissions management)
  • ssm:GetParameters (Read)
  • ssm:GetResourcePolicies (List)
  • ssm:ListTagsForResource (List)
  • ssm:PutParameter (Write)
  • ssm:PutResourcePolicy (Permissions management)
STS: 1 actions
  • sts:AssumeRole (Write)
Well-Architected Tool: 13 actions
  • wellarchitected:CreateAgentContext (Write)
  • wellarchitected:CreateAgentGoal (Write)
  • wellarchitected:GetAgentProfile (Read)
  • wellarchitected:GetAgentRecommendation (Read)
  • wellarchitected:GetAgentRecommendationGeneration (Read)
  • wellarchitected:ListAgentContexts (Read)
  • wellarchitected:ListAgentGoals (Read)
  • wellarchitected:ListAgentProfiles (Read)
  • wellarchitected:ListAgentRecommendations (Read)
  • wellarchitected:StartAgentRecommendationGeneration (Write)
  • wellarchitected:UpdateAgentContext (Write)
  • wellarchitected:UpdateAgentGoal (Write)
  • wellarchitected:UpdateAgentProfile (Write)

Data-plane actions (8)

By access level: 2 List, 2 Read, 4 Write.

Data-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
Lambda1 of 141 Write; 1 restricted, 1 conditionallambda:InvokeFunction
S37 of 252 List, 2 Read, 3 Write; 7 restricted, 7 conditionals3:AbortMultipartUpload, s3:DeleteObject, s3:GetObject, s3:GetObjectVersion, s3:ListBucket, s3:ListMultipartUploadParts, s3:PutObject
Lambda: 1 actions
  • lambda:InvokeFunction (Write)
S3: 7 actions
  • s3:AbortMultipartUpload (Write)
  • s3:DeleteObject (Write)
  • s3:GetObject (Read)
  • s3:GetObjectVersion (Read)
  • s3:ListBucket (List)
  • s3:ListMultipartUploadParts (List)
  • s3:PutObject (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants 126 write, tagging or permissions-management actions, short of full control of any service.
  • Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
  • Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).
  • Grants permissions-management actions on iam, but only for scoped resources or under conditions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CfnNetworkMigrationStackCreate",
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CfnNetworkMigrationStackDescribeStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CfnNetworkMigrationStackListStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:ListStacks"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "CfnNetworkMigrationStackOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DeleteStack",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources",
        "cloudformation:GetTemplateSummary",
        "cloudformation:ListStackResources",
        "cloudformation:UpdateStack",
        "cloudformation:UpdateTerminationProtection"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2NetworkProvisionCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:AllocateAddress",
        "ec2:CreateInternetGateway",
        "ec2:CreateTransitGateway",
        "ec2:CreateVpc"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2NetworkTopologyOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ec2:GetSubnetCidrReservations"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2TagOnCreateNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:elastic-ip/*",
        "arn:aws:ec2:*:*:internet-gateway/*",
        "arn:aws:ec2:*:*:natgateway/*",
        "arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
        "arn:aws:ec2:*:*:network-insights-access-scope/*",
        "arn:aws:ec2:*:*:network-insights-analysis/*",
        "arn:aws:ec2:*:*:network-insights-path/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:route-table/*",
        "arn:aws:ec2:*:*:security-group-rule/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:transit-gateway-attachment/*",
        "arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
        "arn:aws:ec2:*:*:transit-gateway-policy-table/*",
        "arn:aws:ec2:*:*:transit-gateway-route-table/*",
        "arn:aws:ec2:*:*:transit-gateway/*",
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "ec2:CreateAction": [
            "AllocateAddress",
            "CreateInternetGateway",
            "CreateNatGateway",
            "CreateNetworkInsightsAccessScope",
            "CreateNetworkInsightsPath",
            "CreateNetworkInterface",
            "CreateRouteTable",
            "CreateSecurityGroup",
            "CreateSubnet",
            "CreateTransitGateway",
            "CreateTransitGatewayConnect",
            "CreateTransitGatewayConnectPeer",
            "CreateTransitGatewayPeeringAttachment",
            "CreateTransitGatewayPolicyTable",
            "CreateTransitGatewayPrefixListReference",
            "CreateTransitGatewayRoute",
            "CreateTransitGatewayRouteTable",
            "CreateTransitGatewayRouteTableAnnouncement",
            "CreateTransitGatewayVpcAttachment",
            "CreateVpc",
            "StartNetworkInsightsAnalysis"
          ]
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnCrossOrgTgwAttachmentCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTransitGatewayVpcAttachment"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:transit-gateway-attachment/*",
        "arn:aws:ec2:*:*:transit-gateway/*",
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnNetworkOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ec2:AcceptTransitGatewayVpcAttachment",
        "ec2:AssociateNatGatewayAddress",
        "ec2:AssociateRouteTable",
        "ec2:AssociateSubnetCidrBlock",
        "ec2:AssociateTransitGatewayRouteTable",
        "ec2:AssociateVpcCidrBlock",
        "ec2:AttachInternetGateway",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteInternetGateway",
        "ec2:DeleteLaunchTemplate",
        "ec2:DeleteLaunchTemplateVersions",
        "ec2:DeleteNatGateway",
        "ec2:DeleteNetworkInsightsAnalysis",
        "ec2:DeleteNetworkInsightsPath",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteRoute",
        "ec2:DeleteRouteTable",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteSubnet",
        "ec2:DeleteTransitGateway",
        "ec2:DeleteTransitGatewayRoute",
        "ec2:DeleteTransitGatewayRouteTable",
        "ec2:DeleteTransitGatewayVpcAttachment",
        "ec2:DeleteVpc",
        "ec2:DetachInternetGateway",
        "ec2:DisableTransitGatewayRouteTablePropagation",
        "ec2:DisassociateNatGatewayAddress",
        "ec2:DisassociateRouteTable",
        "ec2:DisassociateTransitGatewayRouteTable",
        "ec2:EnableTransitGatewayRouteTablePropagation",
        "ec2:ModifySubnetAttribute",
        "ec2:ModifyTransitGateway",
        "ec2:ModifyTransitGatewayVpcAttachment",
        "ec2:ModifyVpcAttribute",
        "ec2:RejectTransitGatewayVpcAttachment",
        "ec2:ReleaseAddress",
        "ec2:ReplaceRoute",
        "ec2:ReplaceTransitGatewayRoute",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:SearchTransitGatewayRoutes",
        "ec2:StartNetworkInsightsAnalysis"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnNetworkProvisionCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNatGateway",
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSubnet",
        "ec2:CreateTransitGatewayRoute",
        "ec2:CreateTransitGatewayRouteTable",
        "ec2:CreateTransitGatewayVpcAttachment"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnNetworkProvisionCreateWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNatGateway",
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSubnet",
        "ec2:CreateTransitGatewayRoute",
        "ec2:CreateTransitGatewayRouteTable",
        "ec2:CreateTransitGatewayVpcAttachment"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "ec2:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAddresses",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeEgressOnlyInternetGateways",
        "ec2:DescribeInstances",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeManagedPrefixLists",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkInsightsAnalyses",
        "ec2:DescribeNetworkInsightsPaths",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribePrefixLists",
        "ec2:DescribeRegions",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeTransitGatewayConnects",
        "ec2:DescribeTransitGatewayPeeringAttachments",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeVpcEndpointServiceConfigurations",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:GetManagedPrefixListEntries",
        "ec2:GetTransitGatewayRouteTableAssociations",
        "ec2:GetTransitGatewayRouteTablePropagations"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnSecurityGroupCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnSecurityGroupTagCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group-rule/*",
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnSecurityGroupsForVpcRead",
      "Effect": "Allow",
      "Action": [
        "ec2:GetSecurityGroupsForVpc"
      ],
      "Resource": "arn:aws:ec2:*:*:vpc/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnListenerCreateOnLoadBalancer",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:CreateListener"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ],
          "elasticloadbalancing:ListenerProtocol": [
            "HTTP",
            "TCP",
            "TCP_UDP",
            "UDP"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnListenerOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DeleteListener",
        "elasticloadbalancing:ModifyListenerAttributes"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:listener/app/*",
        "arn:aws:elasticloadbalancing:*:*:listener/net/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnLoadBalancerAndTargetGroupOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DeleteLoadBalancer",
        "elasticloadbalancing:DeleteTargetGroup",
        "elasticloadbalancing:ModifyLoadBalancerAttributes",
        "elasticloadbalancing:ModifyTargetGroupAttributes"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*",
        "arn:aws:elasticloadbalancing:*:*:targetgroup/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnLoadBalancerCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:CreateLoadBalancer"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "elasticloadbalancing:Scheme": "internal"
        }
      }
    },
    {
      "Sid": "ElbViaCfnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DescribeCapacityReservation",
        "elasticloadbalancing:DescribeListenerAttributes",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ElbViaCfnTagOnCreate",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:AddTags"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:listener/app/*",
        "arn:aws:elasticloadbalancing:*:*:listener/net/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*",
        "arn:aws:elasticloadbalancing:*:*:targetgroup/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "elasticloadbalancing:CreateAction": [
            "CreateListener",
            "CreateLoadBalancer",
            "CreateTargetGroup"
          ]
        }
      }
    },
    {
      "Sid": "ElbViaCfnTargetGroupCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:CreateTargetGroup"
      ],
      "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IamElbServiceLinkedRoleCreate",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IamTgwServiceLinkedRoleCreate",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "StringLike": {
          "iam:AWSServiceName": "transitgateway.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleCleanupOperations",
      "Effect": "Allow",
      "Action": [
        "iam:DeleteRole",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleCreate",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRolePassRole",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "iam:PassedToService": "lambda.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRolePolicyAttach",
      "Effect": "Allow",
      "Action": [
        "iam:AttachRolePolicy"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ArnEquals": {
          "iam:PolicyARN": [
            "arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationCustomResource",
            "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
          ]
        },
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleTag",
      "Effect": "Allow",
      "Action": [
        "iam:TagRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "KmsS3EncryptionOperationsNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
      "Condition": {
        "StringLike": {
          "kms:ViaService": "s3.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionCreate",
      "Effect": "Allow",
      "Action": [
        "lambda:CreateFunction"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionOperations",
      "Effect": "Allow",
      "Action": [
        "lambda:DeleteFunction",
        "lambda:GetFunctionCodeSigningConfig",
        "lambda:GetFunctionConfiguration",
        "lambda:GetFunctionRecursionConfig",
        "lambda:GetRuntimeManagementConfig",
        "lambda:InvokeFunction"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionReadOnly",
      "Effect": "Allow",
      "Action": [
        "lambda:GetFunction",
        "lambda:ListTags"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionTag",
      "Effect": "Allow",
      "Action": [
        "lambda:TagResource"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "LogsViaCfnNetworkMigrationOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionCreate",
      "Effect": "Allow",
      "Action": [
        "mgn:CreateNetworkMigrationDefinition"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionDelete",
      "Effect": "Allow",
      "Action": [
        "mgn:DeleteNetworkMigrationDefinition"
      ],
      "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": [
            "AWSTransform",
            "QTransform"
          ]
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionOperations",
      "Effect": "Allow",
      "Action": [
        "mgn:GetNetworkMigrationDefinition",
        "mgn:ListNetworkMigrationInsights",
        "mgn:ListNetworkMigrationMappingUpdates",
        "mgn:StartNetworkMigrationMappingUpdate",
        "mgn:UpdateNetworkMigrationDefinition",
        "mgn:UpdateNetworkMigrationMapperSegment",
        "mgn:UpdateNetworkMigrationMapperSegmentConstruct"
      ],
      "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionTagOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:TagResource"
      ],
      "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSTransform",
          "mgn:CreateAction": "CreateNetworkMigrationDefinition"
        }
      }
    },
    {
      "Sid": "NetworkMigrationOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "mgn:ListNetworkMigrationAnalyses",
        "mgn:ListNetworkMigrationAnalysisResults",
        "mgn:ListNetworkMigrationCodeGenerationSegments",
        "mgn:ListNetworkMigrationCodeGenerations",
        "mgn:ListNetworkMigrationDefinitions",
        "mgn:ListNetworkMigrationDeployedStacks",
        "mgn:ListNetworkMigrationDeployedStacksDeletions",
        "mgn:ListNetworkMigrationDeployments",
        "mgn:ListNetworkMigrationExecutions",
        "mgn:ListNetworkMigrationMapperSegmentConstructs",
        "mgn:ListNetworkMigrationMapperSegments",
        "mgn:ListNetworkMigrationExecutionArtifacts",
        "mgn:ListNetworkMigrationMappings"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "NetworkMigrationOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:StartNetworkMigrationAnalysis",
        "mgn:StartNetworkMigrationCodeGeneration",
        "mgn:StartNetworkMigrationDeployedStacksDeletion",
        "mgn:StartNetworkMigrationDeployment",
        "mgn:StartNetworkMigrationMapping"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "OrganizationsOperationsReadOnlyNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RamShareCrossAccountOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ram:GetResourceShares"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "RamViaCfnShareAssociateOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ram:AssociateResourceShare"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService",
          "ram:RequestedResourceType": [
            "ec2:TransitGateway",
            "ssm:Parameter"
          ]
        }
      }
    },
    {
      "Sid": "RamViaCfnShareCreate",
      "Effect": "Allow",
      "Action": [
        "ram:CreateResourceShare"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "Bool": {
          "ram:RequestedAllowsExternalPrincipals": "false"
        },
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "RamViaCfnShareOperations",
      "Effect": "Allow",
      "Action": [
        "ram:DeleteResourceShare",
        "ram:DisassociateResourceShare",
        "ram:UpdateResourceShare"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "RamViaCfnShareTagOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ram:TagResource"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerAnalysisStart",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags",
        "ec2:StartNetworkInsightsAnalysis"
      ],
      "Resource": "arn:aws:ec2:*:*:network-insights-analysis/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCleanupOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteNetworkInsightsAnalysis",
        "ec2:DeleteNetworkInsightsPath",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteSecurityGroup"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCreateWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface",
        "ec2:CreateSecurityGroup",
        "ec2:StartNetworkInsightsAnalysis"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCrossOrgPathCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInsightsPath"
      ],
      "Resource": "arn:aws:ec2:*:*:network-interface/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "directconnect:DescribeConnections",
        "directconnect:DescribeDirectConnectGatewayAssociations",
        "directconnect:DescribeDirectConnectGatewayAttachments",
        "directconnect:DescribeDirectConnectGateways",
        "directconnect:DescribeVirtualGateways",
        "directconnect:DescribeVirtualInterfaces",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeInstances",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeManagedPrefixLists",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribeNetworkInsightsAnalyses",
        "ec2:DescribeNetworkInsightsPaths",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribePrefixLists",
        "ec2:DescribeRegions",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeTransitGatewayConnects",
        "ec2:DescribeTransitGatewayPeeringAttachments",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeVpcEndpointServiceConfigurations",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:GetManagedPrefixListEntries",
        "ec2:GetTransitGatewayRouteTablePropagations",
        "ec2:SearchTransitGatewayRoutes",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeRules",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth",
        "globalaccelerator:ListAccelerators",
        "globalaccelerator:ListCustomRoutingAccelerators",
        "globalaccelerator:ListCustomRoutingEndpointGroups",
        "globalaccelerator:ListCustomRoutingListeners",
        "globalaccelerator:ListCustomRoutingPortMappings",
        "globalaccelerator:ListEndpointGroups",
        "globalaccelerator:ListListeners",
        "network-firewall:DescribeFirewall",
        "network-firewall:DescribeFirewallPolicy",
        "network-firewall:DescribeResourcePolicy",
        "network-firewall:DescribeRuleGroup",
        "network-firewall:ListFirewallPolicies",
        "network-firewall:ListFirewalls",
        "network-firewall:ListRuleGroups",
        "tiros:CreateQuery",
        "tiros:ExtendQuery",
        "tiros:GetQueryAnswer",
        "tiros:GetQueryExplanation",
        "tiros:GetQueryExtensionAccounts"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerProbeCreateOnSecurityGroup",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface"
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerSecurityGroupCreateOnVpc",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": "arn:aws:ec2:*:*:vpc/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerSecurityGroupCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group-rule/*",
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3TargetBucketOperationsNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:ListBucket",
        "s3:PutBucketTagging",
        "s3:PutEncryptionConfiguration"
      ],
      "Resource": "arn:aws:s3:::transform-vmware-target-*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3TargetObjectOperationsNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:GetObjectAttributes",
        "s3:GetObjectVersion",
        "s3:ListBucketMultipartUploads",
        "s3:ListMultipartUploadParts",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::transform-vmware-target-*/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameters"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnOperationsWriteWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ssm:AddTagsToResource",
        "ssm:PutParameter"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnOperationsWriteWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "ssm:DeleteParameter",
        "ssm:DeleteResourcePolicy",
        "ssm:ListTagsForResource"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnRamSharingOperations",
      "Effect": "Allow",
      "Action": [
        "ssm:GetResourcePolicies",
        "ssm:PutResourcePolicy"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "StsCrossAccountAssumeRoleNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Resource": "arn:aws:iam::*:role/AWSTransformNetworkMigrationAgentSharingRole_${aws:PrincipalAccount}",
      "Condition": {
        "StringEquals": {
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
          "sts:ExternalId": "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
        }
      }
    },
    {
      "Sid": "WellArchitectedAgentProfileListReadOnly",
      "Effect": "Allow",
      "Action": [
        "wellarchitected:ListAgentProfiles"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "WellArchitectedAgentProfileOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "wellarchitected:CreateAgentContext",
        "wellarchitected:CreateAgentGoal",
        "wellarchitected:GetAgentProfile",
        "wellarchitected:GetAgentRecommendationGeneration",
        "wellarchitected:ListAgentContexts",
        "wellarchitected:ListAgentGoals",
        "wellarchitected:ListAgentRecommendations",
        "wellarchitected:StartAgentRecommendationGeneration",
        "wellarchitected:UpdateAgentContext",
        "wellarchitected:UpdateAgentGoal",
        "wellarchitected:UpdateAgentProfile"
      ],
      "Resource": "arn:aws:wellarchitected:*:*:agent-profile/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/AWSTransformNetworkMigration": "enabled"
        }
      }
    },
    {
      "Sid": "WellArchitectedAgentRecommendationReadOnly",
      "Effect": "Allow",
      "Action": [
        "wellarchitected:GetAgentRecommendation"
      ],
      "Resource": "arn:aws:wellarchitected:*:*:agent-recommendation/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}

Version history

Current version v4, edited by AWS on 2026-11-10. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy

Terraform

resource "aws_iam_role_policy_attachment" "awstransformnetworkmigrationagentpolicy" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSTransformNetworkMigrationAgentPolicy"),
);

Sources

Pending editorial review. No editorial sources are listed yet.