AWS Migration Hub is no longer open to new customers as of November 7, 2025. For capabilities similar to AWS Migration Hub, explore [AWS Transform](https://aws.amazon.com/transform).

# AWS Migration Hub API Permissions: Actions and Resources Reference
API Permissions Reference

When you are setting up [Access control](auth-and-access-control.md#access-control) and writing a permissions policy that you can attach to an IAM identity (identity-based policies), you can use the following table as a reference. The table lists each Migration Hub API operation, the corresponding actions for which you can grant permissions to perform the action, and the AWS resource for which you can grant the permissions. You specify the actions in the policy's `Action` field, and you specify the resource value in the policy's `Resource` field. 

**Note**  
To specify an action, use the `mgh:` prefix followed by the API operation name (for example, `mgh:CreateProgressUpdateStream`).

Use the scroll bars to see the rest of the table.


**AWS Migration Hub API and Required Permissions for Actions**  

| Migration Hub API Operations | Required Permissions (API Actions) | Resources | 
| --- | --- | --- | 
|  [AssociateCreatedArtifact](http://docs.aws.amazon.com/migrationhub/latest/ug/API_AssociateCreatedArtifact.html)  | mgh:AssociateCreatedArtifact |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
|  [AssociateDiscoveredResource](http://docs.aws.amazon.com/migrationhub/latest/ug/API_AssociateDiscoveredResource.html)  |  mgh:AssociateDiscoveredResource  |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
|  [CreateProgressUpdateStream](http://docs.aws.amazon.com/migrationhub/latest/ug/API_CreateProgressUpdateStream.html)  | mgh:CreateProgressUpdateStream |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id  | 
| [DeleteProgressUpdateStream](http://docs.aws.amazon.com/migrationhub/latest/ug/API_DeleteProgressUpdateStream.html) | mgh:DeleteProgressUpdateStream |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id  | 
| [DescribeApplicationState](http://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeApplicationState.html)  |  mgh:DescribeApplicationState  |  \$1  | 
| [DescribeMigrationTask](http://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeMigrationTask.html) | mgh:DescribeMigrationTask |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
|  [DisassociateCreatedArtifact](http://docs.aws.amazon.com/migrationhub/latest/ug/API_DisassociateCreatedArtifact.html)  | mgh:DisassociateCreatedArtifact |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
| [DisassociateDiscoveredResource](http://docs.aws.amazon.com/migrationhub/latest/ug/API_DisassociateDiscoveredResource.html) | mgh:DisassociateDiscoveredResource |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
| [ImportMigrationTask](http://docs.aws.amazon.com/migrationhub/latest/ug/API_ImportMigrationTask.html) | mgh:ImportMigrationTask |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
| [ListCreatedArtifacts](http://docs.aws.amazon.com/migrationhub/latest/ug/API_ListCreatedArtifacts.html) | mgh:ListCreatedArtifacts |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
|  [ListDiscoveredResources](http://docs.aws.amazon.com/migrationhub/latest/ug/API_ListDiscoveredResources.html)  | mgh:ListDiscoveredResources |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
|  [ListMigrationTasks](http://docs.aws.amazon.com/migrationhub/latest/ug/API_ListMigrationTasks.html)  | mgh:ListMigrationTasks |  \$1  | 
|  [ListProgressUpdateStreams](http://docs.aws.amazon.com/migrationhub/latest/ug/API_ListProgressUpdateStreams.html)  | mgh:ListProgressUpdateStreams |  \$1  | 
| [NotifyApplicationState](http://docs.aws.amazon.com/migrationhub/latest/ug/API_NotifyApplicationState.html) | mgh:NotifyApplicationState |  \$1  | 
| [NotifyMigrationTaskState](http://docs.aws.amazon.com/migrationhub/latest/ug/API_NotifyMigrationTaskState.html) | mgh:NotifyMigrationTaskState |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 
| [PutResourceAttributes](http://docs.aws.amazon.com/migrationhub/latest/ug/API_PutResourceAttributes.html) | mgh:PutResourceAttributes |  arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id or arn:aws:mgh:region:account-id:ProgressUpdateStreamName/resource-id/\$1  | 


**AWS Migration Hub Home Region API and Required Permissions for Actions**  

| Migration Hub API Operations | Required Permissions (API Actions) | Resources | 
| --- | --- | --- | 
|  [CreateHomeRegionControl](https://docs.aws.amazon.com/migrationhub-home-region/latest/APIReference/API_CreateHomeRegionControl.html)  | mgh:CreateHomeRegionControl |  \$1  | 
|  [DescribeHomeRegionControls](https://docs.aws.amazon.com/migrationhub-home-region/latest/APIReference/API_DescribeHomeRegionControls.html)  | mgh:DescribeHomeRegionControls |  \$1  | 
|  [GetHomeRegion](https://docs.aws.amazon.com/migrationhub-home-region/latest/APIReference/API_GetHomeRegion.html)  | mgh:GetHomeRegion |  \$1  | 

## Related Topics

+ [Access control](auth-and-access-control.md#access-control)