{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CfnNetworkMigrationStackCreate",
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CfnNetworkMigrationStackDescribeStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CfnNetworkMigrationStackListStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:ListStacks"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "CfnNetworkMigrationStackOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DeleteStack",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources",
        "cloudformation:GetTemplateSummary",
        "cloudformation:ListStackResources",
        "cloudformation:UpdateStack",
        "cloudformation:UpdateTerminationProtection"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2NetworkProvisionCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:AllocateAddress",
        "ec2:CreateInternetGateway",
        "ec2:CreateTransitGateway",
        "ec2:CreateVpc"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2NetworkTopologyOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ec2:GetSubnetCidrReservations"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2TagOnCreateNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:elastic-ip/*",
        "arn:aws:ec2:*:*:internet-gateway/*",
        "arn:aws:ec2:*:*:natgateway/*",
        "arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
        "arn:aws:ec2:*:*:network-insights-access-scope/*",
        "arn:aws:ec2:*:*:network-insights-analysis/*",
        "arn:aws:ec2:*:*:network-insights-path/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:route-table/*",
        "arn:aws:ec2:*:*:security-group-rule/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:transit-gateway-attachment/*",
        "arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
        "arn:aws:ec2:*:*:transit-gateway-policy-table/*",
        "arn:aws:ec2:*:*:transit-gateway-route-table/*",
        "arn:aws:ec2:*:*:transit-gateway/*",
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "ec2:CreateAction": [
            "AllocateAddress",
            "CreateInternetGateway",
            "CreateNatGateway",
            "CreateNetworkInsightsAccessScope",
            "CreateNetworkInsightsPath",
            "CreateNetworkInterface",
            "CreateRouteTable",
            "CreateSecurityGroup",
            "CreateSubnet",
            "CreateTransitGateway",
            "CreateTransitGatewayConnect",
            "CreateTransitGatewayConnectPeer",
            "CreateTransitGatewayPeeringAttachment",
            "CreateTransitGatewayPolicyTable",
            "CreateTransitGatewayPrefixListReference",
            "CreateTransitGatewayRoute",
            "CreateTransitGatewayRouteTable",
            "CreateTransitGatewayRouteTableAnnouncement",
            "CreateTransitGatewayVpcAttachment",
            "CreateVpc",
            "StartNetworkInsightsAnalysis"
          ]
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnCrossOrgTgwAttachmentCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTransitGatewayVpcAttachment"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:transit-gateway-attachment/*",
        "arn:aws:ec2:*:*:transit-gateway/*",
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnNetworkOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ec2:AcceptTransitGatewayVpcAttachment",
        "ec2:AssociateNatGatewayAddress",
        "ec2:AssociateRouteTable",
        "ec2:AssociateSubnetCidrBlock",
        "ec2:AssociateTransitGatewayRouteTable",
        "ec2:AssociateVpcCidrBlock",
        "ec2:AttachInternetGateway",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteInternetGateway",
        "ec2:DeleteLaunchTemplate",
        "ec2:DeleteLaunchTemplateVersions",
        "ec2:DeleteNatGateway",
        "ec2:DeleteNetworkInsightsAnalysis",
        "ec2:DeleteNetworkInsightsPath",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteRoute",
        "ec2:DeleteRouteTable",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteSubnet",
        "ec2:DeleteTransitGateway",
        "ec2:DeleteTransitGatewayRoute",
        "ec2:DeleteTransitGatewayRouteTable",
        "ec2:DeleteTransitGatewayVpcAttachment",
        "ec2:DeleteVpc",
        "ec2:DetachInternetGateway",
        "ec2:DisableTransitGatewayRouteTablePropagation",
        "ec2:DisassociateNatGatewayAddress",
        "ec2:DisassociateRouteTable",
        "ec2:DisassociateTransitGatewayRouteTable",
        "ec2:EnableTransitGatewayRouteTablePropagation",
        "ec2:ModifySubnetAttribute",
        "ec2:ModifyTransitGateway",
        "ec2:ModifyTransitGatewayVpcAttachment",
        "ec2:ModifyVpcAttribute",
        "ec2:RejectTransitGatewayVpcAttachment",
        "ec2:ReleaseAddress",
        "ec2:ReplaceRoute",
        "ec2:ReplaceTransitGatewayRoute",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:SearchTransitGatewayRoutes",
        "ec2:StartNetworkInsightsAnalysis"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnNetworkProvisionCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNatGateway",
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSubnet",
        "ec2:CreateTransitGatewayRoute",
        "ec2:CreateTransitGatewayRouteTable",
        "ec2:CreateTransitGatewayVpcAttachment"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnNetworkProvisionCreateWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNatGateway",
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSubnet",
        "ec2:CreateTransitGatewayRoute",
        "ec2:CreateTransitGatewayRouteTable",
        "ec2:CreateTransitGatewayVpcAttachment"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "ec2:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAddresses",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeEgressOnlyInternetGateways",
        "ec2:DescribeInstances",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeManagedPrefixLists",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkInsightsAnalyses",
        "ec2:DescribeNetworkInsightsPaths",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribePrefixLists",
        "ec2:DescribeRegions",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeTransitGatewayConnects",
        "ec2:DescribeTransitGatewayPeeringAttachments",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeVpcEndpointServiceConfigurations",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:GetManagedPrefixListEntries",
        "ec2:GetTransitGatewayRouteTableAssociations",
        "ec2:GetTransitGatewayRouteTablePropagations"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnSecurityGroupCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnSecurityGroupTagCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group-rule/*",
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Ec2ViaCfnSecurityGroupsForVpcRead",
      "Effect": "Allow",
      "Action": [
        "ec2:GetSecurityGroupsForVpc"
      ],
      "Resource": "arn:aws:ec2:*:*:vpc/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnListenerCreateOnLoadBalancer",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:CreateListener"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ],
          "elasticloadbalancing:ListenerProtocol": [
            "HTTP",
            "TCP",
            "TCP_UDP",
            "UDP"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnListenerOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DeleteListener",
        "elasticloadbalancing:ModifyListenerAttributes"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:listener/app/*",
        "arn:aws:elasticloadbalancing:*:*:listener/net/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnLoadBalancerAndTargetGroupOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DeleteLoadBalancer",
        "elasticloadbalancing:DeleteTargetGroup",
        "elasticloadbalancing:ModifyLoadBalancerAttributes",
        "elasticloadbalancing:ModifyTargetGroupAttributes"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*",
        "arn:aws:elasticloadbalancing:*:*:targetgroup/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ElbViaCfnLoadBalancerCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:CreateLoadBalancer"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "elasticloadbalancing:Scheme": "internal"
        }
      }
    },
    {
      "Sid": "ElbViaCfnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DescribeCapacityReservation",
        "elasticloadbalancing:DescribeListenerAttributes",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ElbViaCfnTagOnCreate",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:AddTags"
      ],
      "Resource": [
        "arn:aws:elasticloadbalancing:*:*:listener/app/*",
        "arn:aws:elasticloadbalancing:*:*:listener/net/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
        "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*",
        "arn:aws:elasticloadbalancing:*:*:targetgroup/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "elasticloadbalancing:CreateAction": [
            "CreateListener",
            "CreateLoadBalancer",
            "CreateTargetGroup"
          ]
        }
      }
    },
    {
      "Sid": "ElbViaCfnTargetGroupCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:CreateTargetGroup"
      ],
      "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IamElbServiceLinkedRoleCreate",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IamTgwServiceLinkedRoleCreate",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "StringLike": {
          "iam:AWSServiceName": "transitgateway.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleCleanupOperations",
      "Effect": "Allow",
      "Action": [
        "iam:DeleteRole",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleCreate",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRolePassRole",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "iam:PassedToService": "lambda.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRolePolicyAttach",
      "Effect": "Allow",
      "Action": [
        "iam:AttachRolePolicy"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ArnEquals": {
          "iam:PolicyARN": [
            "arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationCustomResource",
            "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
          ]
        },
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "IamViaCfnTgwLambdaRoleTag",
      "Effect": "Allow",
      "Action": [
        "iam:TagRole"
      ],
      "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "KmsS3EncryptionOperationsNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
      "Condition": {
        "StringLike": {
          "kms:ViaService": "s3.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionCreate",
      "Effect": "Allow",
      "Action": [
        "lambda:CreateFunction"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionOperations",
      "Effect": "Allow",
      "Action": [
        "lambda:DeleteFunction",
        "lambda:GetFunctionCodeSigningConfig",
        "lambda:GetFunctionConfiguration",
        "lambda:GetFunctionRecursionConfig",
        "lambda:GetRuntimeManagementConfig",
        "lambda:InvokeFunction"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionReadOnly",
      "Effect": "Allow",
      "Action": [
        "lambda:GetFunction",
        "lambda:ListTags"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "LambdaViaCfnNetworkMigrationFunctionTag",
      "Effect": "Allow",
      "Action": [
        "lambda:TagResource"
      ],
      "Resource": "arn:aws:lambda:*:*:function:network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "LogsViaCfnNetworkMigrationOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/network-migration*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionCreate",
      "Effect": "Allow",
      "Action": [
        "mgn:CreateNetworkMigrationDefinition"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionDelete",
      "Effect": "Allow",
      "Action": [
        "mgn:DeleteNetworkMigrationDefinition"
      ],
      "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": [
            "AWSTransform",
            "QTransform"
          ]
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionOperations",
      "Effect": "Allow",
      "Action": [
        "mgn:GetNetworkMigrationDefinition",
        "mgn:ListNetworkMigrationInsights",
        "mgn:ListNetworkMigrationMappingUpdates",
        "mgn:StartNetworkMigrationMappingUpdate",
        "mgn:UpdateNetworkMigrationDefinition",
        "mgn:UpdateNetworkMigrationMapperSegment",
        "mgn:UpdateNetworkMigrationMapperSegmentConstruct"
      ],
      "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "MgnNetworkMigrationDefinitionTagOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:TagResource"
      ],
      "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSTransform",
          "mgn:CreateAction": "CreateNetworkMigrationDefinition"
        }
      }
    },
    {
      "Sid": "NetworkMigrationOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "mgn:ListNetworkMigrationAnalyses",
        "mgn:ListNetworkMigrationAnalysisResults",
        "mgn:ListNetworkMigrationCodeGenerationSegments",
        "mgn:ListNetworkMigrationCodeGenerations",
        "mgn:ListNetworkMigrationDefinitions",
        "mgn:ListNetworkMigrationDeployedStacks",
        "mgn:ListNetworkMigrationDeployedStacksDeletions",
        "mgn:ListNetworkMigrationDeployments",
        "mgn:ListNetworkMigrationExecutions",
        "mgn:ListNetworkMigrationMapperSegmentConstructs",
        "mgn:ListNetworkMigrationMapperSegments",
        "mgn:ListNetworkMigrationExecutionArtifacts",
        "mgn:ListNetworkMigrationMappings"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "NetworkMigrationOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:StartNetworkMigrationAnalysis",
        "mgn:StartNetworkMigrationCodeGeneration",
        "mgn:StartNetworkMigrationDeployedStacksDeletion",
        "mgn:StartNetworkMigrationDeployment",
        "mgn:StartNetworkMigrationMapping"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "OrganizationsOperationsReadOnlyNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RamShareCrossAccountOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ram:GetResourceShares"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "RamViaCfnShareAssociateOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ram:AssociateResourceShare"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService",
          "ram:RequestedResourceType": [
            "ec2:TransitGateway",
            "ssm:Parameter"
          ]
        }
      }
    },
    {
      "Sid": "RamViaCfnShareCreate",
      "Effect": "Allow",
      "Action": [
        "ram:CreateResourceShare"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "Bool": {
          "ram:RequestedAllowsExternalPrincipals": "false"
        },
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "RamViaCfnShareOperations",
      "Effect": "Allow",
      "Action": [
        "ram:DeleteResourceShare",
        "ram:DisassociateResourceShare",
        "ram:UpdateResourceShare"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "RamViaCfnShareTagOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ram:TagResource"
      ],
      "Resource": "arn:aws:ram:*:*:resource-share/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerAnalysisStart",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags",
        "ec2:StartNetworkInsightsAnalysis"
      ],
      "Resource": "arn:aws:ec2:*:*:network-insights-analysis/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCleanupOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteNetworkInsightsAnalysis",
        "ec2:DeleteNetworkInsightsPath",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteSecurityGroup"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCreateWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInsightsPath",
        "ec2:CreateNetworkInterface",
        "ec2:CreateSecurityGroup",
        "ec2:StartNetworkInsightsAnalysis"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerCrossOrgPathCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInsightsPath"
      ],
      "Resource": "arn:aws:ec2:*:*:network-interface/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "directconnect:DescribeConnections",
        "directconnect:DescribeDirectConnectGatewayAssociations",
        "directconnect:DescribeDirectConnectGatewayAttachments",
        "directconnect:DescribeDirectConnectGateways",
        "directconnect:DescribeVirtualGateways",
        "directconnect:DescribeVirtualInterfaces",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeInstances",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeManagedPrefixLists",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribeNetworkInsightsAnalyses",
        "ec2:DescribeNetworkInsightsPaths",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribePrefixLists",
        "ec2:DescribeRegions",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeTransitGatewayConnects",
        "ec2:DescribeTransitGatewayPeeringAttachments",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeVpcEndpointServiceConfigurations",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:GetManagedPrefixListEntries",
        "ec2:GetTransitGatewayRouteTablePropagations",
        "ec2:SearchTransitGatewayRoutes",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeRules",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth",
        "globalaccelerator:ListAccelerators",
        "globalaccelerator:ListCustomRoutingAccelerators",
        "globalaccelerator:ListCustomRoutingEndpointGroups",
        "globalaccelerator:ListCustomRoutingListeners",
        "globalaccelerator:ListCustomRoutingPortMappings",
        "globalaccelerator:ListEndpointGroups",
        "globalaccelerator:ListListeners",
        "network-firewall:DescribeFirewall",
        "network-firewall:DescribeFirewallPolicy",
        "network-firewall:DescribeResourcePolicy",
        "network-firewall:DescribeRuleGroup",
        "network-firewall:ListFirewallPolicies",
        "network-firewall:ListFirewalls",
        "network-firewall:ListRuleGroups",
        "tiros:CreateQuery",
        "tiros:ExtendQuery",
        "tiros:GetQueryAnswer",
        "tiros:GetQueryExplanation",
        "tiros:GetQueryExtensionAccounts"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerProbeCreateOnSecurityGroup",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface"
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerSecurityGroupCreateOnVpc",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": "arn:aws:ec2:*:*:vpc/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "ReachabilityAnalyzerSecurityGroupCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group-rule/*",
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3TargetBucketOperationsNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:ListBucket",
        "s3:PutBucketTagging",
        "s3:PutEncryptionConfiguration"
      ],
      "Resource": "arn:aws:s3:::transform-vmware-target-*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3TargetObjectOperationsNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:GetObjectAttributes",
        "s3:GetObjectVersion",
        "s3:ListBucketMultipartUploads",
        "s3:ListMultipartUploadParts",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::transform-vmware-target-*/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameters"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnOperationsWriteWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ssm:AddTagsToResource",
        "ssm:PutParameter"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnOperationsWriteWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "ssm:DeleteParameter",
        "ssm:DeleteResourcePolicy",
        "ssm:ListTagsForResource"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "SsmParametersViaCfnRamSharingOperations",
      "Effect": "Allow",
      "Action": [
        "ssm:GetResourcePolicies",
        "ssm:PutResourcePolicy"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "cloudformation.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "StsCrossAccountAssumeRoleNetworkMigration",
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Resource": "arn:aws:iam::*:role/AWSTransformNetworkMigrationAgentSharingRole_${aws:PrincipalAccount}",
      "Condition": {
        "StringEquals": {
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
          "sts:ExternalId": "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
        }
      }
    },
    {
      "Sid": "WellArchitectedAgentProfileListReadOnly",
      "Effect": "Allow",
      "Action": [
        "wellarchitected:ListAgentProfiles"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "WellArchitectedAgentProfileOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "wellarchitected:CreateAgentContext",
        "wellarchitected:CreateAgentGoal",
        "wellarchitected:GetAgentProfile",
        "wellarchitected:GetAgentRecommendationGeneration",
        "wellarchitected:ListAgentContexts",
        "wellarchitected:ListAgentGoals",
        "wellarchitected:ListAgentRecommendations",
        "wellarchitected:StartAgentRecommendationGeneration",
        "wellarchitected:UpdateAgentContext",
        "wellarchitected:UpdateAgentGoal",
        "wellarchitected:UpdateAgentProfile"
      ],
      "Resource": "arn:aws:wellarchitected:*:*:agent-profile/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/AWSTransformNetworkMigration": "enabled"
        }
      }
    },
    {
      "Sid": "WellArchitectedAgentRecommendationReadOnly",
      "Effect": "Allow",
      "Action": [
        "wellarchitected:GetAgentRecommendation"
      ],
      "Resource": "arn:aws:wellarchitected:*:*:agent-recommendation/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}