AWS Migration Hub is no longer open to new customers as of November 7, 2025. For capabilities similar to AWS Migration Hub, explore [AWS Transform](https://aws.amazon.com/transform). # Roles and permissions Roles and permissions Migration Hub Journeys defines the concept of membership. Migrator spaces and migration journeys can have individuals as members. These are the individuals that can participate in the migration process. Migration spaces and migration journeys can also have teams as members. A team consists of individuals. A team cannot contain other teams. Members can have different roles. The following table shows the five roles that Migration Hub Journeys defines. It is possible to simultaneously have roles in different resources. For example, an individual can simultaneously be a `MigrationSpaceAdmin` in one migration space, a `MigrationSpaceContributor` in another migration space, and a `JourneyAdmin` in several migration journeys in those two migration spaces, a `JourneyContributor` in a journey that's in a migration space of which that individual space isn't a member, and a `TeamContributor` in several teams in multiple migration spaces. However, an individual or a team cannot simultaneously have more than one role in the same resource. For example, an individual cannot simultaneously be a `JourneyAdmin` and a `JourneyContributor` within the same migration journey. **** | Resource type | Possible member roles | | --- | --- | | Migration space | MigrationSpaceAdmin, MigrationSpaceContributor, none | | Migration journey | JourneyAdmin, JourneyContributor | | Team | TeamContributor | The following topics explain how to get these roles or assign them to others, and which actions each of the roles allow you to perform. **Topics** + [ # Roles ](roles.md) + [ # Permissions ](permissions-table.md) # Roles Migration Hub Journeys defines five roles: `MigrationSpaceAdmin`, `MigrationSpaceContributor`, `JourneyAdmin`, `JourneyContributor`, and `TeamContributor`. This topic explains how to assign these roles. For the permissions that are associated with each of the five roles, see [Permissions](permissions-table.md). **Important** When you edit the role of a team or an individual, it can take up to 5 minutes for the role change to take effect after you see the change in the console. ## MigrationSpaceAdmin When you create a migration space, you automatically get the `MigrationSpaceAdmin` for that space. When you're a `MigrationSpaceAdmin`, you can also grant this role to others. **To grant the `MigrationSpaceAdmin` role to an individual that is already a member of the migration space** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space to which you want to give the individual the `MigrationSpaceAdmin` role. 1. Choose the **Individuals** tab. 1. Choose the radio button next to the name of the individual to whom you want to give the `MigrationSpaceAdmin` role. 1. Choose **Edit role**. 1. In the dialog box, choose the **MigrationSpaceAdmin** option. 1. Choose **Save**. **To grant the `MigrationSpaceAdmin` role to an individual that isn't already a member of the migration space** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space to which you want to give the individual the `MigrationSpaceAdmin` role. 1. Choose the **Individuals** tab. 1. Choose **Invite**. 1. Enter the individual's email address and choose the **MigrationSpaceAdmin** option. 1. Choose **Invite**. **To grant the `MigrationSpaceAdmin` role to a team that is already a member of the migration space** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space to which you want to give the individual the `MigrationSpaceAdmin` role. 1. Choose the **Teams** tab. 1. Choose the radio button next to the name of the team to which you want to give the `MigrationSpaceAdmin` role. 1. Choose **Edit role**. 1. In the dialog box, choose the **MigrationSpaceAdmin** option. 1. Choose **Update**. **To grant the `MigrationSpaceAdmin` role to a team that isn't already a member of the migration space** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space in which you want to create a team and to make that team a `MigrationSpaceAdmin`. 1. Choose the **Teams** tab. 1. Choose **Create team**. 1. Enter a name and an optional description for the team, and choose the **MigrationSpaceAdmin** option. 1. Choose **Create**. ## MigrationSpaceContributor A `MigrationSpaceAdmin` can invite an individual to become a `MigrationSpaceContributor` in that space. The `MigrationSpaceAdmin` can also create a new team and give it the `MigrationSpaceContributor` in that space. In addition, a `MigrationSpaceAdmin` can change the role of a team or an individual from `MigrationSpaceAdmin` to `MigrationSpaceContributor`. **To invite an individual to become a `MigrationSpaceContributor`** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space to which you want to give the individual the `MigrationSpaceContributor` role. 1. Choose the **Individuals** tab. 1. Choose **Invite**. 1. Enter the individual's email address and choose the **MigrationSpaceContributor** option. 1. Choose **Invite**. 1. Notify the individual to whom you sent the invitation that they will receive an email from the following address: `no-reply@es.prod.us-east-2.service.migops.migration-services.aws.dev` The body of the email will have a **Respond** button that they can use to accept or reject the invitation. In addition to the invitation email, the individual can also go to **Pending actions** to see the invitation that you sent them and to accept it or reject it. For more information, see [Pending actions](pending-actions.md). **Important** For the recipient of the invitation to get the `MigrationSpaceContributor` role, they must accept the invitation that you sent them. To accept the invitation, they can choose **Respond** in the invitation email, or they can go directly to **Pending actions** in the Migration Hub Journeys console. For more information, see [Pending actions](pending-actions.md). **To create a team and give it the `MigrationSpaceContributor` role** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space in which you want to create the team. 1. Choose the **Teams** tab. 1. Choose **Create team**. 1. Enter a name and an optional description for the team, and choose the **MigrationSpaceContributor** option. 1. Choose **Create**. **To change the role of an individual from `MigrationSpaceAdmin` to `MigrationSpaceContributor`** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space in which you want to make the change. 1. Choose the **Individuals** tab. 1. Choose the radio button next to the individual whose role you want to change. 1. Choose **Edit role**. 1. Choose the **MigrationSpaceContributor** option. 1. Choose **Update**. **To change the role of a team from `MigrationSpaceAdmin` to `MigrationSpaceContributor`** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space in which you want to make the change. 1. Choose the **Teams** tab. 1. Choose the radio button next to the team whose role you want to change. 1. Choose **Edit role**. 1. Choose the **MigrationSpaceContributor** option. 1. Choose **Update**. ## JourneyAdmin A `MigrationSpaceAdmin` or a `JourneyAdmin` can make an individual or a team a `JourneyAdmin`. **To grant the `JourneyAdmin` role to an individual or a team that is already a member of the migration journey** 1. In the navigation pane, choose **Migration journeys**. 1. Choose the name of the migration journey to which you want to give the individual or team the `JourneyAdmin` role. 1. Choose the **Individuals and teams** tab. 1. Choose the radio button next to the individual or team to whom you want to give the `JourneyAdmin` role. 1. Choose **Edit role**. 1. In the dialog box, choose the **JourneyAdmin** option. 1. Choose **Save**. **To grant the `JourneyAdmin` role to an individual or a team that isn't already a member of the migration journey** 1. In the navigation pane, choose **Migration journeys**. 1. Choose the name of the migration journey to which you want to give the individual or team the **JourneyAdmin** role. 1. Choose the **Individuals and teams** tab. 1. Choose **Invite**. 1. Specify the email address of the individual or team that you want to invite. 1. Under **Role**, choose the **JourneyAdmin** option. 1. Choose **Invite**. 1. Notify the individual to whom you sent the invitation that they will receive an email from the following address: `no-reply@es.prod.us-east-2.service.migops.migration-services.aws.dev` The body of the email will have a **Respond** button that they can use to accept or reject the invitation. In addition to the invitation email, the individual can also go to **Pending actions** to see the invitation that you sent them and to accept it or reject it. For more information, see [Pending actions](pending-actions.md). **Important** For the recipient of the invitation to get the `JourneyAdmin` role, they must accept the invitation that you sent them. To accept the invitation, they can choose **Respond** in the invitation email, or they can go directly to **Pending actions** in the Migration Hub Journeys console. For more information, see [Pending actions](pending-actions.md). ## JourneyContributor A `MigrationSpaceAdmin` or a `JourneyAdmin` can invite an individual or a team to become a `JourneyContributor`. **Important** If an individual or a team is a `JourneyContributor` in a journey, but a `MigrationSpaceAdmin` in the migration space that contains that journey, then that individual or team is effectively a `JourneyAdmin` of that journey. Their role will appear as `JourneyContributor`, but they will be able to perform all the actions that a `JourneyAdmin` has the permissions to perform. **To grant the `JourneyContributor` role to an individual or a team that is already a member of the migration journey** 1. In the navigation pane, choose **Migration journeys**. 1. Choose the name of the migration journey to which you want to give the individual or team the `JourneyContributor` role. 1. Choose the **Individuals and teams** tab. 1. Choose the radio button next to the individual or team to whom you want to give the `JourneyContributor` role. 1. Choose **Edit role**. 1. In the dialog box, choose the **JourneyContributor** option. 1. Choose **Save**. **To grant the `JourneyContributor` role to an individual or a team that isn't already a member of the migration journey** 1. In the navigation pane, choose **Migration journeys**. 1. Choose the name of the migration journey to which you want to give the individual or team the `JourneyContributor` role. 1. Choose the **Individuals and teams** tab. 1. Choose **Invite**. 1. Specify the email address of the individual or team that you want to invite. 1. Under **Role**, choose the **JourneyContributor** option. 1. Choose **Invite**. 1. Notify the individual to whom you sent the invitation that they will receive an email from the following address: `no-reply@es.prod.us-east-2.service.migops.migration-services.aws.dev` The body of the email will have a **Respond** button that they can use to accept or reject the invitation. In addition to the invitation email, the individual can also go to **Pending actions** to see the invitation that you sent them and to accept it or reject it. For more information, see [Pending actions](pending-actions.md). **Important** For the recipient of the invitation to get the `JourneyContributor` role, they must accept the invitation that you sent them. To accept the invitation, they can choose **Respond** in the invitation email, or they can go directly to **Pending actions** in the Migration Hub Journeys console. For more information, see [Pending actions](pending-actions.md). ## TeamContributor A `MigrationSpaceAdmin` can invite an individual to become a `TeamContributor`. **To invite an individual to become a `TeamContributor`** 1. In the navigation pane, choose **Migration spaces**. 1. Choose the name of the migration space to which you want to give the individual or team the `TeamContributor` role. 1. Choose the **Teams** tab. 1. Choose the name of the team to which you want to invite an individual. 1. Choose **Invite**. 1. Specify the email address of the individual that you want to invite. 1. Choose **Invite**. 1. Notify the individual to whom you sent the invitation that they will receive an email from the following address: `no-reply@es.prod.us-east-2.service.migops.migration-services.aws.dev` The body of the email will have a **Respond** button that they can use to accept or reject the invitation. In addition to the invitation email, the individual can also go to **Pending actions** to see the invitation that you sent them and to accept it or reject it. For more information, see [Pending actions](pending-actions.md). **Important** For the recipient of the invitation to get the `TeamContributor` role, they must accept the invitation that you sent them. To accept the invitation, they can choose **Respond** in the invitation email, or they can go directly to **Pending actions** in the Migration Hub Journeys console. For more information, see [Pending actions](pending-actions.md). # Permissions Migration Hub Journeys defines five roles: `MigrationSpaceAdmin`, `MigrationSpaceContributor`, `JourneyAdmin`, `JourneyContributor`, and `TeamContributor`. The following sections describe the actions that each of the five roles can perform on migration spaces, migration journeys, and teams. For information about how to get or assign these roles, see [Roles](roles.md). ## Role permissions in migration spaces The following table shows the actions that the `MigrationSpaceAdmin` and `MigrationSpaceContributor` roles can perform on a migration space. The `JourneyAdmin`, `JourneyContributor`, and `TeamContributor` roles don't grant any permissions to perform any of the actions listed in the table on migration spaces. | Action | MigrationSpaceAdmin | MigrationSpaceContributor | | --- | --- | --- | | View a migration space | Yes | Yes | | Delete a migration space | Yes | No | | Add an individual or a team as a migration-space member | Yes | No | | View migration space memberships | Yes | Yes | | Delete migration space memberships | Yes | No | | Create a journey | Yes | Yes | | View migration space journeys | Yes | No | | Create a team | Yes | No | | Delete a team | Yes | No | ## Role permissions in migration journeys The following table shows the actions that the `MigrationSpaceAdmin`, `MigrationSpaceContributor`, `JourneyAdmin`, and `JourneyContributor` roles can perform on a migration journey. The `TeamContributor` role doesn't grant any permissions to perform any of the actions listed in the table on migration journeys. | Action | MigrationSpaceAdmin | MigrationSpaceContributor | JourneyAdmin | JourneyContributor | | --- | --- | --- | --- | --- | | Transfer journey ownership | Yes | No | Yes | No | | Cancel journey transfer | Yes | No | Yes | No | | View journey details | Yes | No | Yes | Yes | | Delete journey | Yes | No | Yes | No | | Update journey | Yes | No | Yes | Yes | | Add individual as journey member | Yes | No | Yes | No | | Add a team as journey member | Yes | No | Yes if you are a member of the team that you want to add. | No | | View journey memberships | Yes | No | Yes | Yes | | Delete journey membership | Yes | You can only remove yourself. You cannot delete the membership of someone else. | Yes | You can only remove yourself. You cannot delete the membership of someone else. | | Create phase | Yes | No | Yes | Yes | | Edit phase details | Yes | No | Yes | Yes | | Move phase out of scope | Yes | No | Yes | Yes | | Move phase into scope | Yes | No | Yes | Yes | | Delete phase | Yes | No | Yes | No | | View phases | Yes | No | Yes | Yes | | Create module | Yes | No | Yes | Yes | | Delete module | Yes | No | Yes | No | | View modules | Yes | No | Yes | Yes | | View module details | Yes | No | Yes | Yes | | Edit module details | Yes | No | Yes | Yes | | Move module out of scope | Yes | No | Yes | Yes | | Move module into scope | Yes | No | Yes | Yes | | Create task | Yes | No | Yes | Yes | | Edit task | Yes | No | Yes | Yes | | Rerank task | Yes | No | Yes | Yes | | Delete task | Yes | No | Yes | No | | View tasks | Yes | No | Yes | Yes | | View task details | Yes | No | Yes | Yes | | Add comment | Yes | No | Yes | Yes | | View comments | Yes | No | Yes | Yes | | Delete comment | Yes | No | Yes | No | | Upload attachment | Yes | No | Yes | Yes | | View attachments | Yes | No | Yes | Yes | | Download attachment | Yes | No | Yes | Yes | | Delete attachment | Yes | No | Yes | No | | Create template from journey | Yes | No | Yes | No | | Customize journey | Yes | No | Yes | Yes | | Reorder modules and phases | Yes | No | Yes | Yes | ## Role permissions in teams The following table shows the actions that the `MigrationSpaceAdmin`, `MigrationSpaceContributor`, and `TeamContributor` roles can perform on a team. The `JourneyAdmin` and `JourneyContributor` roles don't grant permissions to perform any of the actions listed in the table on teams. | Action | MigrationSpaceAdmin | MigrationSpaceContributor | TeamContributor | | --- | --- | --- | --- | | View teams | Yes | Yes | No | | View team details | Yes | Yes | Yes | | Create team membership | Yes | No | No | | View team memberships | Yes | Yes | Yes | | Delete team membership | Yes | You can only remove yourself. You cannot delete the membership of someone else. | You can only remove yourself. You cannot delete the membership of someone else. |