Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Migration Hub

AWS Migration Hub (service prefix: mgh) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Migration Hub
Actions defined by AWS Migration Hub
Resource types defined by AWS Migration Hub
Condition keys for AWS Migration Hub

API operations defined by AWS Migration Hub

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Access level
AssociateCreatedArtifact	mgh	mgh:AssociateCreatedArtifact	Write
AssociateDiscoveredResource	mgh	mgh:AssociateDiscoveredResource	Write
AssociateSourceResource	mgh	mgh:AssociateSourceResource	Write
CreateProgressUpdateStream	mgh	mgh:CreateProgressUpdateStream	Write
DeleteProgressUpdateStream	mgh	mgh:DeleteProgressUpdateStream	Write
DescribeApplicationState	mgh	mgh:DescribeApplicationState	Read
DescribeMigrationTask	mgh	mgh:DescribeMigrationTask	Read
DisassociateCreatedArtifact	mgh	mgh:DisassociateCreatedArtifact	Write
DisassociateDiscoveredResource	mgh	mgh:DisassociateDiscoveredResource	Write
DisassociateSourceResource	mgh	mgh:DisassociateSourceResource	Write
ImportMigrationTask	mgh	mgh:ImportMigrationTask	Write
ListApplicationStates	mgh	mgh:ListApplicationStates	List
ListCreatedArtifacts	mgh	mgh:ListCreatedArtifacts	List
ListDiscoveredResources	mgh	mgh:ListDiscoveredResources	List
ListMigrationTaskUpdates	mgh	mgh:ListMigrationTaskUpdates	List
ListMigrationTasks	mgh	mgh:ListMigrationTasks	List
ListProgressUpdateStreams	mgh	mgh:ListProgressUpdateStreams	List
ListSourceResources	mgh	mgh:ListSourceResources	List
NotifyApplicationState	mgh	mgh:NotifyApplicationState	Write
NotifyMigrationTaskState	mgh	mgh:NotifyMigrationTaskState	Write
PutResourceAttributes	mgh	mgh:PutResourceAttributes	Write
CreateHomeRegionControl	migrationhub-config	mgh:CreateHomeRegionControl	Write
DeleteHomeRegionControl	migrationhub-config	mgh:DeleteHomeRegionControl	Write
DescribeHomeRegionControls	migrationhub-config	mgh:DescribeHomeRegionControls	List
GetHomeRegion	migrationhub-config	mgh:GetHomeRegion	Read

Actions defined by AWS Migration Hub

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptConnection	Grants permission to accept a connection	ConnectionResource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgh:ConnectionResourceConnectionArn	Write
AssociateAutomationUnitRole	Grants permission to associate an IAM role to an automation unit	AutomationUnitResource*	mgh:AutomationUnitResourceAutomationUnitArn	Write
AssociateCreatedArtifact	Grants permission to associate a given AWS artifact to a MigrationTask	migrationTask*		Write
AssociateDiscoveredResource	Grants permission to associate a given ADS resource to a MigrationTask	migrationTask*		Write
AssociateSourceResource	Grants permission to associate source resource	migrationTask*		Write
BatchAssociateIamRoleWithConnection	Grants permission to batch-associate IAM roles with a connection	ConnectionResource*	aws:ResourceTag/${TagKey} mgh:ConnectionResourceConnectionArn	Write
BatchDisassociateIamRoleFromConnection	Grants permission to batch-disassociate IAM roles from a connection	ConnectionResource*	aws:ResourceTag/${TagKey} mgh:ConnectionResourceConnectionArn	Write
CreateAutomationRun	Grants permission to create an automation unit run			Write
CreateAutomationUnit	Grants permission to create an automation unit			Write
CreateHomeRegionControl	Grants permission to create a Migration Hub Home Region Control			Write
CreateProgressUpdateStream	Grants permission to create a ProgressUpdateStream	progressUpdateStream*		Write
DeleteAutomationRun	Grants permission to delete an automation unit run	AutomationRunResource*	mgh:AutomationRunResourceRunID	Write
DeleteAutomationUnit	Grants permission to delete an automation unit	AutomationUnitResource*	mgh:AutomationUnitResourceAutomationUnitArn	Write
DeleteConnection	Grants permission to delete a connection	ConnectionResource*	aws:ResourceTag/${TagKey} mgh:ConnectionResourceConnectionArn	Write
DeleteHomeRegionControl	Grants permission to delete a Migration Hub Home Region Control			Write
DeleteProgressUpdateStream	Grants permission to delete a ProgressUpdateStream	progressUpdateStream*		Write
DescribeApplicationState	Grants permission to get an Application Discovery Service Application's state			Read
DescribeAutomationRun	Grants permission to describe an automation unit run	AutomationRunResource*	mgh:AutomationRunResourceRunID	Read
DescribeAutomationUnit	Grants permission to describe an automation unit	AutomationUnitResource*	mgh:AutomationUnitResourceAutomationUnitArn	Read
DescribeHomeRegionControls	Grants permission to list Home Region Controls			List
DescribeMigrationTask	Grants permission to describe a MigrationTask	migrationTask*		Read
DisassociateAutomationUnitRole	Grants permission to disassociate an IAM role from an automation unit	AutomationUnitResource*	mgh:AutomationUnitResourceAutomationUnitArn	Write
DisassociateCreatedArtifact	Grants permission to disassociate a given AWS artifact from a MigrationTask	migrationTask*		Write
DisassociateDiscoveredResource	Grants permission to disassociate a given ADS resource from a MigrationTask	migrationTask*		Write
DisassociateSourceResource	Grants permission to diassociate source resource	migrationTask*		Write
GetConnection	Grants permission to get a connection	ConnectionResource*	aws:ResourceTag/${TagKey} mgh:ConnectionResourceConnectionArn	Read
GetHomeRegion	Grants permission to get the Migration Hub Home Region			Read
ImportMigrationTask	Grants permission to import a MigrationTask	migrationTask*		Write
ListApplicationStates	Grants permission to list Application statuses			List
ListAutomationRuns	Grants permission to list automation unit runs			List
ListAutomationUnits	Grants permission to list automation units			List
ListConnectionRoles	Grants permission to list connection roles	ConnectionResource*	aws:ResourceTag/${TagKey} mgh:ConnectionResourceConnectionArn	List
ListConnections	Grants permission to list connections			List
ListCreatedArtifacts	Grants permission to list associated created artifacts for a MigrationTask	migrationTask*		List
ListDiscoveredResources	Grants permission to list associated ADS resources from MigrationTask	migrationTask*		List
ListMigrationTaskUpdates	Grants permission to list migration tasks updates	migrationTask*		List
ListMigrationTasks	Grants permission to list MigrationTasks			List
ListProgressUpdateStreams	Grants permission to to list ProgressUpdateStreams			List
ListSourceResources	Grants permission to list source resources	migrationTask*		List
ListTagsForResource	Grants permission to list tags for a resource			List
NotifyApplicationState	Grants permission to update an Application Discovery Service Application's state			Write
NotifyMigrationTaskState	Grants permission to notify latest MigrationTask state	migrationTask*		Write
PutResourceAttributes	Grants permission to put ResourceAttributes	migrationTask*		Write
RejectConnection	Grants permission to reject a connection	ConnectionResource*	aws:ResourceTag/${TagKey} mgh:ConnectionResourceConnectionArn	Write
TagResource	Grants permission to tag a resource		aws:RequestTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag a resource		aws:TagKeys	Tagging, Write

Resource types defined by AWS Migration Hub

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
AutomationRunResource	arn:${Partition}:mgh:${Region}:${Account}:automation-run/${RunID}	mgh:AutomationRunResourceRunID
AutomationUnitResource	arn:${Partition}:mgh:${Region}:${Account}:automation-unit/${AutomationUnitId}	mgh:AutomationUnitResourceAutomationUnitArn
ConnectionResource	arn:${Partition}:mgh:${Region}:${Account}:${ConnectionArn}	aws:ResourceTag/${TagKey} mgh:ConnectionResourceConnectionArn
migrationTask	arn:${Partition}:mgh:${Region}:${Account}:progressUpdateStream/${Stream}/migrationTask/${Task}
progressUpdateStream	arn:${Partition}:mgh:${Region}:${Account}:progressUpdateStream/${Stream}

Condition keys for AWS Migration Hub

AWS Migration Hub defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString
mgh:AutomationRunResourceRunID	AutomationRunResource resource runID identifier	String
mgh:AutomationUnitResourceAutomationUnitArn	AutomationUnitResource resource automationUnitArn identifier	ARN
mgh:ConnectionResourceConnectionArn	ConnectionResource resource connectionArn identifier	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Migration Acceleration Program Credits (mapcredits)

AWS Migration Hub Orchestrator (migrationhub-orchestrator)