Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Application Migration Service

AWS Application Migration Service (service prefix: mgn) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Application Migration Service
Actions defined by AWS Application Migration Service
Permission-only actions for AWS Application Migration Service
Resource types defined by AWS Application Migration Service
Condition keys for AWS Application Migration Service

API operations defined by AWS Application Migration Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
ArchiveApplication	mgn:ArchiveApplication	Write
ArchiveWave	mgn:ArchiveWave	Write
AssociateApplications	mgn:AssociateApplications	Write
AssociateSourceServers	mgn:AssociateSourceServers	Write
ChangeServerLifeCycleState	mgn:ChangeServerLifeCycleState	Write
CreateApplication	mgn:CreateApplication	Write
CreateApplication	mgn:TagResource	Tagging, Write
CreateConnector	mgn:CreateConnector	Write
CreateConnector	mgn:TagResource	Tagging, Write
CreateLaunchConfigurationTemplate	mgn:CreateLaunchConfigurationTemplate	Write
CreateNetworkMigrationDefinition	mgn:CreateNetworkMigrationDefinition	Write
CreateNetworkMigrationDefinition	mgn:TagResource	Tagging, Write
CreateReplicationConfigurationTemplate	mgn:CreateReplicationConfigurationTemplate	Write
CreateReplicationConfigurationTemplate	mgn:TagResource	Tagging, Write
CreateWave	mgn:CreateWave	Write
CreateWave	mgn:TagResource	Tagging, Write
DeleteApplication	mgn:DeleteApplication	Write
DeleteConnector	mgn:DeleteConnector	Write
DeleteJob	mgn:DeleteJob	Write
DeleteLaunchConfigurationTemplate	mgn:DeleteLaunchConfigurationTemplate	Write
DeleteNetworkMigrationDefinition	mgn:DeleteNetworkMigrationDefinition	Write
DeleteReplicationConfigurationTemplate	mgn:DeleteReplicationConfigurationTemplate	Write
DeleteSourceServer	mgn:DeleteSourceServer	Write
DeleteVcenterClient	mgn:DeleteVcenterClient	Write
DeleteWave	mgn:DeleteWave	Write
DescribeJobLogItems	mgn:DescribeJobLogItems	Read
DescribeJobs	mgn:DescribeJobs	List
DescribeLaunchConfigurationTemplates	mgn:DescribeLaunchConfigurationTemplates	List
DescribeReplicationConfigurationTemplates	mgn:DescribeReplicationConfigurationTemplates	List
DescribeSourceServers	mgn:DescribeSourceServers	List
DescribeVcenterClients	mgn:DescribeVcenterClients	List
DisassociateApplications	mgn:DisassociateApplications	Write
DisassociateSourceServers	mgn:DisassociateSourceServers	Write
DisconnectFromService	mgn:DisconnectFromService	Write
FinalizeCutover	mgn:FinalizeCutover	Write
GetLaunchConfiguration	mgn:GetLaunchConfiguration	Read
GetNetworkMigrationDefinition	mgn:GetNetworkMigrationDefinition	Read
GetNetworkMigrationMapperSegmentConstruct	mgn:GetNetworkMigrationMapperSegmentConstruct	Read
GetReplicationConfiguration	mgn:GetReplicationConfiguration	Read
InitializeService	mgn:InitializeService	Write
ListApplications	mgn:ListApplications	List
ListConnectors	mgn:ListConnectors	Read
ListExportErrors	mgn:ListExportErrors	List
ListExports	mgn:ListExports	List
ListImportErrors	mgn:ListImportErrors	List
ListImportFileEnrichments	mgn:ListImportFileEnrichments	List
ListImports	mgn:ListImports	List
ListManagedAccounts	mgn:ListManagedAccounts	List
ListNetworkMigrationAnalyses	mgn:ListNetworkMigrationAnalyses	List
ListNetworkMigrationAnalysisResults	mgn:ListNetworkMigrationAnalysisResults	List
ListNetworkMigrationCodeGenerationSegments	mgn:ListNetworkMigrationCodeGenerationSegments	List
ListNetworkMigrationCodeGenerations	mgn:ListNetworkMigrationCodeGenerations	List
ListNetworkMigrationDefinitions	mgn:ListNetworkMigrationDefinitions	List
ListNetworkMigrationDeployedStacks	mgn:ListNetworkMigrationDeployedStacks	List
ListNetworkMigrationDeployments	mgn:ListNetworkMigrationDeployments	List
ListNetworkMigrationExecutions	mgn:ListNetworkMigrationExecutions	List
ListNetworkMigrationMapperSegmentConstructs	mgn:ListNetworkMigrationMapperSegmentConstructs	List
ListNetworkMigrationMapperSegments	mgn:ListNetworkMigrationMapperSegments	List
ListNetworkMigrationMappingUpdates	mgn:ListNetworkMigrationMappingUpdates	List
ListNetworkMigrationMappings	mgn:ListNetworkMigrationMappings	List
ListSourceServerActions	mgn:ListSourceServerActions	List
ListTagsForResource	mgn:ListTagsForResource	Read
ListTemplateActions	mgn:ListTemplateActions	List
ListWaves	mgn:ListWaves	List
MarkAsArchived	mgn:MarkAsArchived	Write
PauseReplication	mgn:PauseReplication	Write
PutSourceServerAction	mgn:PutSourceServerAction	Write
PutTemplateAction	mgn:PutTemplateAction	Write
RemoveSourceServerAction	mgn:RemoveSourceServerAction	Write
RemoveTemplateAction	mgn:RemoveTemplateAction	Write
ResumeReplication	mgn:ResumeReplication	Write
RetryDataReplication	mgn:RetryDataReplication	Write
StartCutover	mgn:StartCutover	Write
StartCutover	mgn:TagResource	Tagging, Write
StartExport	mgn:StartExport	Write
StartExport	mgn:TagResource	Tagging, Write
StartImport	mgn:StartImport	Write
StartImport	mgn:TagResource	Tagging, Write
StartImportFileEnrichment	mgn:StartImportFileEnrichment	Write
StartNetworkMigrationAnalysis	mgn:StartNetworkMigrationAnalysis	Write
StartNetworkMigrationCodeGeneration	mgn:StartNetworkMigrationCodeGeneration	Write
StartNetworkMigrationDeployment	mgn:StartNetworkMigrationDeployment	Write
StartNetworkMigrationMapping	mgn:StartNetworkMigrationMapping	Write
StartNetworkMigrationMappingUpdate	mgn:StartNetworkMigrationMappingUpdate	Write
StartReplication	mgn:StartReplication	Write
StartTest	mgn:StartTest	Write
StartTest	mgn:TagResource	Tagging, Write
StopReplication	mgn:StopReplication	Write
TagResource	mgn:TagResource	Tagging, Write
TerminateTargetInstances	mgn:TagResource	Tagging, Write
TerminateTargetInstances	mgn:TerminateTargetInstances	Write
UnarchiveApplication	mgn:UnarchiveApplication	Write
UnarchiveWave	mgn:UnarchiveWave	Write
UntagResource	mgn:UntagResource	Tagging, Write
UpdateApplication	mgn:UpdateApplication	Write
UpdateConnector	mgn:UpdateConnector	Write
UpdateLaunchConfiguration	mgn:UpdateLaunchConfiguration	Write
UpdateLaunchConfigurationTemplate	mgn:UpdateLaunchConfigurationTemplate	Write
UpdateNetworkMigrationDefinition	mgn:UpdateNetworkMigrationDefinition	Write
UpdateNetworkMigrationMapperSegment	mgn:UpdateNetworkMigrationMapperSegment	Write
UpdateReplicationConfiguration	mgn:UpdateReplicationConfiguration	Write
UpdateReplicationConfigurationTemplate	mgn:UpdateReplicationConfigurationTemplate	Write
UpdateSourceServer	mgn:UpdateSourceServer	Write
UpdateSourceServerReplicationType	mgn:UpdateSourceServerReplicationType	Write
UpdateWave	mgn:UpdateWave	Write

Actions defined by AWS Application Migration Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ArchiveApplication	Grants permission to archive an application	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
ArchiveWave	Grants permission to archive a wave	WaveResource*	aws:ResourceTag/${TagKey}	Write
AssociateApplications	Grants permission to associate applications to a wave	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
AssociateApplications	Grants permission to associate applications to a wave	WaveResource*	aws:ResourceTag/${TagKey}	Write
AssociateSourceServers	Grants permission to associate source servers to an application	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
AssociateSourceServers		SourceServerResource*	aws:ResourceTag/${TagKey}	Write
ChangeServerLifeCycleState	Grants permission to change source server life cycle state	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
CreateApplication	Grants permission to create an application		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateConnector	Grants permission to create connector		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLaunchConfigurationTemplate	Grants permission to create launch configuration template		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateNetworkMigrationDefinition	Grants permission to create a network migration definition		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateReplicationConfigurationTemplate	Grants permission to create replication configuration template		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateWave	Grants permission to create a wave		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteApplication	Grants permission to delete an application	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
DeleteConnector	Grants permission to delete connector	ConnectorResource*	aws:ResourceTag/${TagKey}	Write
DeleteJob	Grants permission to delete job	JobResource*	aws:ResourceTag/${TagKey}	Write
DeleteLaunchConfigurationTemplate	Grants permission to delete launch configuration template	LaunchConfigurationTemplateResource*	aws:ResourceTag/${TagKey}	Write
DeleteNetworkMigrationDefinition	Grants permission to delete a network migration definition	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
DeleteReplicationConfigurationTemplate	Grants permission to delete replication configuration template	ReplicationConfigurationTemplateResource*	aws:ResourceTag/${TagKey}	Write
DeleteSourceServer	Grants permission to delete source server	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
DeleteVcenterClient	Grants permission to delete vcenter client	VcenterClientResource*	aws:ResourceTag/${TagKey}	Write
DeleteWave	Grants permission to delete a wave	WaveResource*	aws:ResourceTag/${TagKey}	Write
DescribeJobLogItems	Grants permission to describe job log items	JobResource*	aws:ResourceTag/${TagKey}	Read
DescribeJobs	Grants permission to describe jobs			List
DescribeLaunchConfigurationTemplates	Grants permission to describe launch configuration template			List
DescribeReplicationConfigurationTemplates	Grants permission to describe replication configuration template			List
DescribeSourceServers	Grants permission to describe source servers			List
DescribeVcenterClients	Grants permission to describe vcenter clients			List
DisassociateApplications	Grants permission to disassociate applications from a wave	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
DisassociateApplications	Grants permission to disassociate applications from a wave	WaveResource*	aws:ResourceTag/${TagKey}	Write
DisassociateSourceServers	Grants permission to disassociate source servers from an application	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
DisassociateSourceServers		SourceServerResource*	aws:ResourceTag/${TagKey}	Write
DisconnectFromService	Grants permission to disconnect source server from service	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
FinalizeCutover	Grants permission to finalize cutover	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
GetAccountSettings	Grants permission to get account settings			Read
GetLaunchConfiguration	Grants permission to get launch configuration	SourceServerResource*	aws:ResourceTag/${TagKey}	Read
GetNetworkMigrationDefinition	Grants permission to get a network migration definition	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Read
GetNetworkMigrationMapperSegmentConstruct	Grants permission to get a network migration mapper segment construct	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Read
GetReplicationConfiguration	Grants permission to get replication configuration	SourceServerResource*	aws:ResourceTag/${TagKey}	Read
InitializeService	Grants permission to initialize service			Write
ListApplications	Grants permission to list application summaries			List
ListConnectors	Grants permission to list connectors			Read
ListExportErrors	Grants permission to list the errors of an export task	ExportResource*	aws:ResourceTag/${TagKey}	List
ListExports	Grants permission to list export tasks			List
ListImportErrors	Grants permission to list the errors of an import task	ImportResource*	aws:ResourceTag/${TagKey}	List
ListImportFileEnrichments	Grants permission to list the import file enrichment tasks			List
ListImports	Grants permission to list the import tasks			List
ListManagedAccounts	Grants permission to list managed accounts			List
ListNetworkMigrationAnalyses	Grants permission to list network migration analyses	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationAnalysisResults	Grants permission to list network migration analysis results	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationCodeGenerationSegments	Grants permission to list network migration code generation segments	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationCodeGenerations	Grants permission to list network migration code generations	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationDefinitions	Grants permission to list network migration definitions			List
ListNetworkMigrationDeployedStacks	Grants permission to list network migration deployed stacks	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationDeployedStacksDeletions	Grants permission to list network migration deployed stacks deletions	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationDeployments	Grants permission to list network migration deployments	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationExecutions	Grants permission to list network migration executions	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationMapperSegmentConstructs	Grants permission to list network migration mapper segment constructs	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationMapperSegments	Grants permission to list network migration mapper segments	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationMappingUpdates	Grants permission to list network migration mapping updates	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListNetworkMigrationMappings	Grants permission to list network migration mappings	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	List
ListSourceServerActions	Grants permission to list source server action documents	SourceServerResource*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a resource			Read
ListTemplateActions	Grants permission to list launch configuration template action documents	LaunchConfigurationTemplateResource*	aws:ResourceTag/${TagKey}	List
ListWaves	Grants permission to list wave summaries			List
MarkAsArchived	Grants permission to mark source server as archived	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
PauseReplication	Grants permission to pause replication	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
PutSourceServerAction	Grants permission to put source server action document	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
PutTemplateAction	Grants permission to put launch configuration template action document	LaunchConfigurationTemplateResource*	aws:ResourceTag/${TagKey}	Write
RemoveSourceServerAction	Grants permission to remove source server action document	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
RemoveTemplateAction	Grants permission to remove launch configuration template action document	LaunchConfigurationTemplateResource*	aws:ResourceTag/${TagKey}	Write
ResumeReplication	Grants permission to resume replication	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
RetryDataReplication	Grants permission to retry replication	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
StartCutover	Grants permission to start cutover	SourceServerResource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartExport	Grants permission to start an export task		aws:RequestTag/${TagKey} aws:TagKeys	Write
StartImport	Grants permission to create an import task		aws:RequestTag/${TagKey} aws:TagKeys	Write
StartImportFileEnrichment	Grants permission to start import file enrichment			Write
StartNetworkMigrationAnalysis	Grants permission to start a network migration analysis	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
StartNetworkMigrationCodeGeneration	Grants permission to start network migration code generation	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
StartNetworkMigrationDeployedStacksDeletion	Grants permission to start deletion of network migration deployed stacks	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
StartNetworkMigrationDeployment	Grants permission to start a network migration deployment	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
StartNetworkMigrationMapping	Grants permission to start a network migration mapping	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
StartNetworkMigrationMappingUpdate	Grants permission to start a network migration mapping update	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
StartReplication	Grants permission to start replication	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
StartTest	Grants permission to start test	SourceServerResource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StopReplication	Grants permission to stop replication	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to assign a resource tag	ApplicationResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction	Tagging, Write
		ConnectorResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		ExportResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		ImportResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		JobResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		LaunchConfigurationTemplateResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		ReplicationConfigurationTemplateResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		SourceServerResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		VcenterClientResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
		WaveResource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys mgn:CreateAction
TerminateTargetInstances	Grants permission to terminate target instances	SourceServerResource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UnarchiveApplication	Grants permission to unarchive an application	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
UnarchiveWave	Grants permission to unarchive a wave	WaveResource*	aws:ResourceTag/${TagKey}	Write
UntagResource	Grants permission to untag a resource	ApplicationResource	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		ConnectorResource	aws:ResourceTag/${TagKey} aws:TagKeys
		JobResource	aws:ResourceTag/${TagKey} aws:TagKeys
		LaunchConfigurationTemplateResource	aws:ResourceTag/${TagKey} aws:TagKeys
		ReplicationConfigurationTemplateResource	aws:ResourceTag/${TagKey} aws:TagKeys
		SourceServerResource	aws:ResourceTag/${TagKey} aws:TagKeys
		VcenterClientResource	aws:ResourceTag/${TagKey} aws:TagKeys
		WaveResource	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccountSettings	Grants permission to update account settings			Write
UpdateApplication	Grants permission to update an application	ApplicationResource*	aws:ResourceTag/${TagKey}	Write
UpdateConnector	Grants permission to update connector	ConnectorResource*	aws:ResourceTag/${TagKey}	Write
UpdateLaunchConfiguration	Grants permission to update launch configuration	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateLaunchConfigurationTemplate	Grants permission to update launch configuration	LaunchConfigurationTemplateResource*	aws:ResourceTag/${TagKey}	Write
UpdateNetworkMigrationDefinition	Grants permission to update a network migration definition	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
UpdateNetworkMigrationMapperSegment	Grants permission to update a network migration mapper segment	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
UpdateNetworkMigrationMapperSegmentConstruct	Grants permission to update a network migration mapper segment construct	NetworkMigrationDefinitionResource*	aws:ResourceTag/${TagKey}	Write
UpdateReplicationConfiguration	Grants permission to update replication configuration	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateReplicationConfigurationTemplate	Grants permission to update replication configuration template	ReplicationConfigurationTemplateResource*	aws:ResourceTag/${TagKey}	Write
UpdateSourceServer	Grants permission to update source server	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateSourceServerReplicationType	Grants permission to update source server replication type	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateWave	Grants permission to update a wave	WaveResource*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Application Migration Service

The following actions are defined by AWS Application Migration Service but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchCreateVolumeSnapshotGroupForMgn	Grants permission to create volume snapshot group	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
BatchDeleteSnapshotRequestForMgn	Grants permission to batch delete snapshot request			Write
CreateVcenterClientForMgn	Grants permission to create vcenter client		aws:RequestTag/${TagKey} aws:TagKeys	Write
DescribeReplicationServerAssociationsForMgn	Grants permission to describe replication server associations			Read
DescribeSnapshotRequestsForMgn	Grants permission to describe snapshots requests			Read
GetAgentCommandForMgn	Grants permission to get agent command	SourceServerResource*	aws:ResourceTag/${TagKey}	Read
GetAgentConfirmedResumeInfoForMgn	Grants permission to get agent confirmed resume info	SourceServerResource*	aws:ResourceTag/${TagKey}	Read
GetAgentInstallationAssetsForMgn	Grants permission to get agent installation assets			Read
GetAgentReplicationInfoForMgn	Grants permission to get agent replication info	SourceServerResource*	aws:ResourceTag/${TagKey}	Read
GetAgentRuntimeConfigurationForMgn	Grants permission to get agent runtime configuration	SourceServerResource*	aws:ResourceTag/${TagKey}	Read
GetAgentSnapshotCreditsForMgn	Grants permission to get agent snapshots credits	SourceServerResource*	aws:ResourceTag/${TagKey}	Read
GetChannelCommandsForMgn	Grants permission to get channel commands			Read
GetVcenterClientCommandsForMgn	Grants permission to get vcenter client commands	VcenterClientResource*	aws:ResourceTag/${TagKey}	Read
IssueClientCertificateForMgn	Grants permission to issue a client certificate	SourceServerResource	aws:ResourceTag/${TagKey}	Write
NotifyAgentAuthenticationForMgn	Grants permission to notify agent authentication	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
NotifyAgentConnectedForMgn	Grants permission to notify agent is connected	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
NotifyAgentDisconnectedForMgn	Grants permission to notify agent is disconnected	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
NotifyAgentReplicationProgressForMgn	Grants permission to notify agent replication progress	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
NotifyVcenterClientStartedForMgn	Grants permission to notify vcenter client started	VcenterClientResource*	aws:ResourceTag/${TagKey}	Write
RegisterAgentForMgn	Grants permission to register agent		aws:RequestTag/${TagKey} aws:TagKeys	Write
SendAgentLogsForMgn	Grants permission to send agent logs	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
SendAgentMetricsForMgn	Grants permission to send agent metrics	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
SendChannelCommandResultForMgn	Grants permission to send channel command result			Write
SendClientLogsForMgn	Grants permission to send client logs			Write
SendClientMetricsForMgn	Grants permission to send client metrics			Write
SendVcenterClientCommandResultForMgn	Grants permission to send vcenter client command result	VcenterClientResource*	aws:ResourceTag/${TagKey}	Write
SendVcenterClientLogsForMgn	Grants permission to send vcenter client logs	VcenterClientResource*	aws:ResourceTag/${TagKey}	Write
SendVcenterClientMetricsForMgn	Grants permission to send vcenter client metrics	VcenterClientResource*	aws:ResourceTag/${TagKey}	Write
StartSnapshotGroupForMgn	Grants permission to start snapshot group requests			Write
UpdateAgentBacklogForMgn	Grants permission to update agent backlog	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateAgentConversionInfoForMgn	Grants permission to update agent conversion info	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateAgentReplicationInfoForMgn	Grants permission to update agent replication info	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateAgentReplicationProcessStateForMgn	Grants permission to update agent replication process state	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
UpdateAgentSourcePropertiesForMgn	Grants permission to update agent source properties	SourceServerResource*	aws:ResourceTag/${TagKey}	Write
VerifyClientRoleForMgn	Grants permission to verify client role			Read

Resource types defined by AWS Application Migration Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
ApplicationResource	arn:${Partition}:mgn:${Region}:${Account}:application/${ApplicationID}	aws:ResourceTag/${TagKey}
ConnectorResource	arn:${Partition}:mgn:${Region}:${Account}:connector/${ConnectorID}	aws:ResourceTag/${TagKey}
ExportResource	arn:${Partition}:mgn:${Region}:${Account}:export/${ExportID}	aws:ResourceTag/${TagKey}
ImportResource	arn:${Partition}:mgn:${Region}:${Account}:import/${ImportID}	aws:ResourceTag/${TagKey}
JobResource	arn:${Partition}:mgn:${Region}:${Account}:job/${JobID}	aws:ResourceTag/${TagKey}
LaunchConfigurationTemplateResource	arn:${Partition}:mgn:${Region}:${Account}:launch-configuration-template/${LaunchConfigurationTemplateID}	aws:ResourceTag/${TagKey}
NetworkMigrationDefinitionResource	arn:${Partition}:mgn:${Region}:${Account}:network-migration-definition/${NetworkMigrationDefinitionID}	aws:ResourceTag/${TagKey}
ReplicationConfigurationTemplateResource	arn:${Partition}:mgn:${Region}:${Account}:replication-configuration-template/${ReplicationConfigurationTemplateID}	aws:ResourceTag/${TagKey}
SourceServerResource	arn:${Partition}:mgn:${Region}:${Account}:source-server/${SourceServerID}	aws:ResourceTag/${TagKey}
VcenterClientResource	arn:${Partition}:mgn:${Region}:${Account}:vcenter-client/${VcenterClientID}	aws:ResourceTag/${TagKey}
WaveResource	arn:${Partition}:mgn:${Region}:${Account}:wave/${WaveID}	aws:ResourceTag/${TagKey}

Condition keys for AWS Application Migration Service

AWS Application Migration Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by presence of tag keys in the request	ArrayOfString
mgn:CreateAction	Filters access by the name of a resource-creating API action	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Application Discovery Service (discovery)

AWS Application Transformation Service (application-transformation)