AWSTransformServerMigrationAgentPolicy

Summary

Grants permissions for AWS Transform to perform server migration operations including replication, testing, and cutover using AWS Application Migration Service

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/AWSTransformServerMigrationAgentPolicyCopy ARN

Default version

v4

Created

2026-08-06

Last edited

2026-11-12

Services

cloudwatch, ec2, elasticloadbalancing, fsx, iam, kms, mgn, organizations, s3, s3-outposts, secretsmanager, servicequotas, ssm, sts

Control-plane actions (144)

By access level: 40 List, 31 Read, 4 Tagging, 69 Write.

Data-plane actions (8)

By access level: 2 List, 3 Read, 3 Write.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants 76 write, tagging or permissions-management actions, short of full control of any service.
• Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsReleaseManagementVPCPolicy
• AmazonAppStreamServiceAccess
• AmazonBioDiscoveryServiceLinkedRolePolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonDataZoneProjectRolePermissionsBoundary
• AmazonDataZoneSageMakerProvisioningRolePolicy

Same domain

• AWSAgentlessDiscoveryService
• AWSApplicationDiscoveryAgentAccess
• AWSApplicationDiscoveryServiceFullAccess
• AWSApplicationMigrationAgentInstallationPolicy
• AWSApplicationMigrationAgentPolicy
• AWSApplicationMigrationAgentPolicy_v2
• AWSApplicationMigrationConversionServerPolicy
• AWSApplicationMigrationFullAccess

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudWatchViaMgnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricData"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2LaunchTemplateOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateLaunchTemplateVersion",
        "ec2:ModifyLaunchTemplate"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2OperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeInstanceTypes",
        "ec2:DescribeInstanceTypeOfferings",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeLaunchTemplateVersions"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2TagOnCreateServerMigration",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:launch-template/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:security-group-rule/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "ec2:CreateAction": [
            "CreateLaunchTemplate",
            "CreateSecurityGroup"
          ]
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnInstanceLifecycleOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ec2:AttachVolume",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:CreateSnapshot",
        "ec2:DeleteLaunchTemplateVersions",
        "ec2:DeleteVolume",
        "ec2:DetachVolume",
        "ec2:ModifyInstanceAttribute",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RunInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:launch-template/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnInstanceProvisionCreateWithRequestTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup",
        "ec2:CreateSnapshot",
        "ec2:CreateVolume",
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:volume/*",
        "arn:aws:ec2:*::snapshot/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnLaunchOnSharedVpc",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup",
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedFor": "AWSTransform"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnLaunchOnWorkspaceVpc",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup",
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedFor": "AWSTransform"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeImages",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeInstances",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeSnapshots",
        "ec2:DescribeSubnets",
        "ec2:GetSubnetCidrReservations",
        "ec2:DescribeVolumes",
        "ec2:GetEbsEncryptionByDefault",
        "ec2:GetEbsDefaultKmsKeyId"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnCreateSecurityGroupOnAmsVpc",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": "arn:aws:ec2:*:*:vpc/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnRunInstancesOnAmsSubnet",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:network-interface/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnRunInstancesOnImage",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": "arn:aws:ec2:*::image/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnRunInstancesOnSg",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnSecurityGroupCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "Null": {
          "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnTagOnCreateSecurityGroup",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "Null": {
          "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "ec2:CreateAction": "CreateSecurityGroup"
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnTagOnCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:volume/*",
        "arn:aws:ec2:*::snapshot/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "ec2:CreateAction": [
            "CreateSecurityGroup",
            "CreateSnapshot",
            "CreateVolume",
            "RunInstances"
          ]
        }
      }
    },
    {
      "Sid": "Ec2ViaMgnVolumeFromSnapshotCreate",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVolume"
      ],
      "Resource": "arn:aws:ec2:*::snapshot/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform",
          "ec2:Owner": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ElbOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ElbTargetGroupRegisterTargetsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:RegisterTargets"
      ],
      "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
        }
      }
    },
    {
      "Sid": "FsxOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "fsx:DescribeFileSystems",
        "fsx:DescribeStorageVirtualMachines"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "FsxViaMgnDescribeOperations",
      "Effect": "Allow",
      "Action": [
        "fsx:DescribeVolumes",
        "fsx:DescribeSnapshots"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "FsxViaMgnCreateVolume",
      "Effect": "Allow",
      "Action": "fsx:CreateVolume",
      "Resource": [
        "arn:aws:fsx:*:*:volume/*/*",
        "arn:aws:fsx:*:*:storage-virtual-machine/*/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "Null": {
          "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "FsxViaMgnDeleteVolumeAndTag",
      "Effect": "Allow",
      "Action": [
        "fsx:DeleteVolume",
        "fsx:TagResource"
      ],
      "Resource": "arn:aws:fsx:*:*:volume/*/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "Null": {
          "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "FsxViaMgnCreateSnapshot",
      "Effect": "Allow",
      "Action": "fsx:CreateSnapshot",
      "Resource": [
        "arn:aws:fsx:*:*:snapshot/*/*",
        "arn:aws:fsx:*:*:volume/*/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "Null": {
          "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IamViaMgnEc2PassRole",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole",
        "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole",
        "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "iam:PassedToService": "ec2.amazonaws.com"
        }
      }
    },
    {
      "Sid": "KmsS3EncryptionOperationsServerMigration",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
      "Condition": {
        "StringLike": {
          "kms:ViaService": "s3.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "MgnAccountSettingsOperations",
      "Effect": "Allow",
      "Action": [
        "mgn:GetAccountSettings",
        "mgn:RegisterAgentForMgn",
        "mgn:UpdateAccountSettings"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "MgnAppWaveCreate",
      "Effect": "Allow",
      "Action": [
        "mgn:CreateApplication",
        "mgn:CreateRemoteSourceAction",
        "mgn:CreateWave"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "MgnAppWaveServerTagOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:TagResource"
      ],
      "Resource": [
        "arn:aws:mgn:*:*:application/*",
        "arn:aws:mgn:*:*:source-server/*",
        "arn:aws:mgn:*:*:wave/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "MgnImportExportOperationWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:StartExport",
        "mgn:StartImport",
        "mgn:StartImportFileEnrichment"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "MgnImportExportTagOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:TagResource"
      ],
      "Resource": [
        "arn:aws:mgn:*:*:export/*",
        "arn:aws:mgn:*:*:import/*",
        "arn:aws:mgn:*:*:remote-source-action-job/*",
        "arn:aws:mgn:*:*:remote-source-action/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "mgn:CreateAction": [
            "StartExport",
            "StartImport",
            "StartRemoteSourceActionJob",
            "CreateRemoteSourceAction"
          ]
        }
      }
    },
    {
      "Sid": "MgnJobAndErrorOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "mgn:DescribeJobLogItems",
        "mgn:ListExportErrors",
        "mgn:ListImportErrors",
        "mgn:ListRemoteSourceActionInvocations"
      ],
      "Resource": [
        "arn:aws:mgn:*:*:export/*",
        "arn:aws:mgn:*:*:import/*",
        "arn:aws:mgn:*:*:job/*",
        "arn:aws:mgn:*:*:remote-source-action-job/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "MgnJobTagOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:TagResource"
      ],
      "Resource": "arn:aws:mgn:*:*:job/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform",
          "mgn:CreateAction": [
            "StartCutover",
            "StartTest",
            "TerminateTargetInstances"
          ]
        }
      }
    },
    {
      "Sid": "MgnRemoteSourceActionCrossAccountOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "mgn:StartRemoteSourceActionJob"
      ],
      "Resource": [
        "arn:aws:mgn:*:*:remote-source-action/*",
        "arn:aws:mgn:*:*:source-server/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "MgnRemoteSourceActionJobCreateWithRequestTag",
      "Effect": "Allow",
      "Action": "mgn:StartRemoteSourceActionJob",
      "Resource": "arn:aws:mgn:*:*:remote-source-action-job/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:RequestTag/CreatedBy": "AWSTransform",
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "MgnRemoteSourceActionConnectorOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "mgn:StartRemoteSourceActionJob"
      ],
      "Resource": "arn:aws:mgn:*:*:connector/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedFor": "AWSTransform"
        }
      }
    },
    {
      "Sid": "MgnRemoteSourceActionOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "mgn:DeleteRemoteSourceAction",
        "mgn:UpdateRemoteSourceAction"
      ],
      "Resource": "arn:aws:mgn:*:*:remote-source-action/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "MgnSourceServerLifecycleOperations",
      "Effect": "Allow",
      "Action": [
        "mgn:ChangeServerLifecycleState",
        "mgn:FinalizeCutover",
        "mgn:GetReplicationConfiguration",
        "mgn:ListRemoteSourceActionInvocationResults",
        "mgn:ListSourceServerActions",
        "mgn:ListTagsForResource",
        "mgn:MarkAsArchived",
        "mgn:PauseReplication",
        "mgn:PutSourceServerAction",
        "mgn:RemoveSourceServerAction",
        "mgn:ResumeReplication",
        "mgn:StartCutover",
        "mgn:StartRemoteSourceActionJob",
        "mgn:StartReplication",
        "mgn:StartTest",
        "mgn:StopReplication",
        "mgn:UpdateReplicationConfiguration",
        "mgn:UpdateSourceServer"
      ],
      "Resource": [
        "arn:aws:mgn:*:*:source-server/*",
        "arn:aws:mgn:*:*:remote-source-action/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "OrganizationsOperationsReadOnlyServerMigration",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts"
      ],
      "Resource": "*"
    },
    {
      "Sid": "PostLaunchAutomationMonitoring",
      "Effect": "Allow",
      "Action": [
        "ssm:GetAutomationExecution"
      ],
      "Resource": "arn:aws:ssm:*:*:automation-execution/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3AgentSignatureOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::aws-application-migration-service-*/latest/source-automation-client/linux/ssaf-client/ssaf_client.sig"
    },
    {
      "Sid": "S3OutpostsOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3-outposts:ListOutpostsWithS3"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "S3TargetBucketOperationsServerMigration",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:ListBucket",
        "s3:PutBucketTagging",
        "s3:PutEncryptionConfiguration"
      ],
      "Resource": "arn:aws:s3:::transform-vmware-target-*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3TargetObjectOperationsServerMigration",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:GetObjectAttributes",
        "s3:GetObjectVersion",
        "s3:ListBucketMultipartUploads",
        "s3:ListMultipartUploadParts",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::transform-vmware-target-*/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SecretsManagerOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ServerMigrationOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "mgn:DescribeJobs",
        "mgn:DescribeLaunchConfigurationTemplates",
        "mgn:DescribeReplicationConfigurationTemplates",
        "mgn:DescribeReplicationServerAssociationsForMgn",
        "mgn:DescribeSourceServers",
        "mgn:DescribeVcenterClients",
        "mgn:GetLaunchConfiguration",
        "mgn:GetLaunchConfigurationDefaults",
        "mgn:ListApplications",
        "mgn:ListConnectors",
        "mgn:ListExports",
        "mgn:ListImportFileEnrichments",
        "mgn:ListImports",
        "mgn:ListRemoteSourceActionJobs",
        "mgn:ListRemoteSourceActions",
        "mgn:ListTemplateActions",
        "mgn:ListWaves"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "ServerMigrationOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:AssociateApplications",
        "mgn:AssociateSourceServers",
        "mgn:DeleteApplication",
        "mgn:DeleteWave",
        "mgn:DisassociateApplications",
        "mgn:DisassociateSourceServers",
        "mgn:TerminateTargetInstances",
        "mgn:UpdateApplication",
        "mgn:UpdateLaunchConfiguration",
        "mgn:UpdateLaunchConfigurationDefaults",
        "mgn:UpdateWave"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "ServerMigrationTemplateOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "mgn:PutTemplateAction",
        "mgn:RemoveTemplateAction",
        "mgn:UpdateLaunchConfigurationTemplate",
        "mgn:UpdateReplicationConfigurationTemplate"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ServiceQuotasViaMgnOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "servicequotas:GetServiceQuota"
      ],
      "Resource": "arn:aws:servicequotas:*:*:vpc/L-2AFB9258",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SsmAgentCommandOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeInstanceInformation",
        "ssm:GetCommandInvocation",
        "ssm:ListCommandInvocations",
        "ssm:ListCommands"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "SsmAgentCommandOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ssm:SendCommand"
      ],
      "Resource": "arn:aws:ssm:*:*:managed-instance/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedFor": "AWSTransform"
        }
      }
    },
    {
      "Sid": "SsmDocumentListOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ssm:ListDocuments"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "SsmDocumentOnAwsManagedOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeDocument",
        "ssm:GetDocument",
        "ssm:ListDocumentVersions"
      ],
      "Resource": "arn:aws:ssm:*::document/AWS*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "SsmDocumentOperationsReadOnly",
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeDocument",
        "ssm:GetDocument",
        "ssm:ListDocumentVersions"
      ],
      "Resource": "arn:aws:ssm:*:*:document/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SsmMigrationDocumentOperations",
      "Effect": "Allow",
      "Action": [
        "ssm:GetDocument",
        "ssm:SendCommand"
      ],
      "Resource": "arn:aws:ssm:*::document/AWSMigration-RunSourceServerAction",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "SsmParameterServerMigrationOperationsWrite",
      "Effect": "Allow",
      "Action": [
        "ssm:DeleteParameters",
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:PutParameter"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SsmViaMgnPostLaunchCommandAndAutomation",
      "Effect": "Allow",
      "Action": [
        "ssm:SendCommand",
        "ssm:StartAutomationExecution"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:automation-definition/*:*",
        "arn:aws:ssm:*:*:automation-execution/*",
        "arn:aws:ssm:*:*:document/*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SsmViaMgnPostLaunchCommandAndAutomationOnAwsManaged",
      "Effect": "Allow",
      "Action": [
        "ssm:SendCommand",
        "ssm:StartAutomationExecution"
      ],
      "Resource": [
        "arn:aws:ssm:*::automation-definition/AWS*:*",
        "arn:aws:ssm:*::document/AWS*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
        }
      }
    },
    {
      "Sid": "SsmViaMgnPostLaunchSendCommandToInstances",
      "Effect": "Allow",
      "Action": [
        "ssm:SendCommand"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "Null": {
          "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
        },
        "StringEquals": {
          "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
          "aws:ResourceTag/CreatedBy": "AWSTransform"
        }
      }
    },
    {
      "Sid": "StsCrossAccountAssumeRole",
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Resource": "arn:aws:iam::*:role/AWSTransformRehostSharingRole_${aws:PrincipalAccount}",
      "Condition": {
        "StringEquals": {
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
          "sts:ExternalId": "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
        }
      }
    },
    {
      "Sid": "StsCrossAccountAssumeRoleViaMgn",
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Resource": "arn:aws:iam::*:role/AWSTransformRehostSharingRole_${aws:PrincipalAccount}",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "mgn.amazonaws.com"
          ]
        },
        "StringEquals": {
          "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
          "sts:ExternalId": "${aws:PrincipalAccount}:AWSTransform"
        }
      }
    }
  ]
}

Version history

Current version v4, edited by AWS on 2026-11-12.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformServerMigrationAgentPolicy
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformServerMigrationAgentPolicy
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformServerMigrationAgentPolicy

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSTransformServerMigrationAgentPolicy

resource "aws_iam_role_policy_attachment" "awstransformservermigrationagentpolicy" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSTransformServerMigrationAgentPolicy"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSTransformServerMigrationAgentPolicy"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for AWSTransformServerMigrationAgentPolicy
• Report a data issue