Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Migration Hub Orchestrator

AWS Migration Hub Orchestrator (service prefix: migrationhub-orchestrator) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Migration Hub Orchestrator
Actions defined by AWS Migration Hub Orchestrator
Resource types defined by AWS Migration Hub Orchestrator
Condition keys for AWS Migration Hub Orchestrator

API operations defined by AWS Migration Hub Orchestrator

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateTemplate	migrationhub-orchestrator:CreateTemplate	Write
CreateTemplate	migrationhub-orchestrator:TagResource	Tagging, Write
CreateWorkflow	migrationhub-orchestrator:CreateWorkflow	Write
CreateWorkflow	migrationhub-orchestrator:TagResource	Tagging, Write
CreateWorkflowStep	migrationhub-orchestrator:CreateWorkflowStep	Write
CreateWorkflowStepGroup	migrationhub-orchestrator:CreateWorkflowStepGroup	Write
DeleteTemplate	migrationhub-orchestrator:DeleteTemplate	Write
DeleteWorkflow	migrationhub-orchestrator:DeleteWorkflow	Write
DeleteWorkflowStep	migrationhub-orchestrator:DeleteWorkflowStep	Write
DeleteWorkflowStepGroup	migrationhub-orchestrator:DeleteWorkflowStepGroup	Write
GetTemplate	migrationhub-orchestrator:GetTemplate	Read
GetTemplateStep	migrationhub-orchestrator:GetTemplateStep	Read
GetTemplateStepGroup	migrationhub-orchestrator:GetTemplateStepGroup	Read
GetWorkflow	migrationhub-orchestrator:GetWorkflow	Read
GetWorkflowStep	migrationhub-orchestrator:GetWorkflowStep	Read
GetWorkflowStepGroup	migrationhub-orchestrator:GetWorkflowStepGroup	Read
ListPlugins	migrationhub-orchestrator:ListPlugins	List
ListTagsForResource	migrationhub-orchestrator:ListTagsForResource	Read
ListTemplateStepGroups	migrationhub-orchestrator:ListTemplateStepGroups	List
ListTemplateSteps	migrationhub-orchestrator:ListTemplateSteps	List
ListTemplates	migrationhub-orchestrator:ListTemplates	List
ListWorkflowStepGroups	migrationhub-orchestrator:ListWorkflowStepGroups	List
ListWorkflowSteps	migrationhub-orchestrator:ListWorkflowSteps	List
ListWorkflows	migrationhub-orchestrator:ListWorkflows	List
RetryWorkflowStep	migrationhub-orchestrator:RetryWorkflowStep	Write
StartWorkflow	migrationhub-orchestrator:StartWorkflow	Write
StopWorkflow	migrationhub-orchestrator:StopWorkflow	Write
TagResource	migrationhub-orchestrator:TagResource	Tagging, Write
UntagResource	migrationhub-orchestrator:UntagResource	Tagging, Write
UpdateWorkflow	migrationhub-orchestrator:UpdateWorkflow	Write
UpdateWorkflowStep	migrationhub-orchestrator:UpdateWorkflowStep	Write
UpdateWorkflowStepGroup	migrationhub-orchestrator:UpdateWorkflowStepGroup	Write

Actions defined by AWS Migration Hub Orchestrator

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateTemplate	Grants permission to create a custom template			Write
CreateWorkflow	Grants permission to create a workflow based on the selected template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkflowStep	Grants permission to create a step under a workflow and a specific step group	workflow*	aws:ResourceTag/${TagKey}	Write
CreateWorkflowStepGroup	Grants permission to to create a custom step group for a given workflow	workflow*	aws:ResourceTag/${TagKey}	Write
DeleteTemplate	Grants permission to delete a custom template	template*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflow	Grants permission to a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflowStep	Grants permission to delete a step from a specific step group under a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflowStepGroup	Grants permission to delete a step group associated with a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
GetMessage	Grants permission to the plugin to receive information from the service			Read
GetTemplate	Grants permission to get retrieve metadata for a Template	template*	aws:ResourceTag/${TagKey}	Read
GetTemplateStep	Grants permission to retrieve details of a step associated with a template and a step group	template*	aws:ResourceTag/${TagKey}	Read
GetTemplateStepGroup	Grants permission to retrieve metadata of a step group under a template	template*	aws:ResourceTag/${TagKey}	Read
GetWorkflow	Grants permission to retrieve metadata asscociated with a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
GetWorkflowStep	Grants permission to get details of step associated with a workflow and a step group	workflow*	aws:ResourceTag/${TagKey}	Read
GetWorkflowStepGroup	Grants permission to get details of a step group associated with a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
ListPlugins	Grants permission to get a list all registered Plugins			List
ListTagsForResource	Grants permission to get a list of all the tags tied to a resource	template*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		workflow*	aws:ResourceTag/${TagKey}	Read
ListTemplateStepGroups	Grants permission to lists step groups of a template	template*	aws:ResourceTag/${TagKey}	List
ListTemplateSteps	Grants permission to get a list of steps in a step group	template*	aws:ResourceTag/${TagKey}	List
ListTemplates	Grants permission to get a list of all Templates available to customer			List
ListWorkflowStepGroups	Grants permission to get list of step groups associated with a workflow	workflow*	aws:ResourceTag/${TagKey}	List
ListWorkflowSteps	Grants permission to get a list of steps within step group associated with a workflow	workflow*	aws:ResourceTag/${TagKey}	List
ListWorkflows	Grants permission to list all workflows			List
RegisterPlugin	Grants permission to register the plugin to receive an ID and to start receiving messages from the service			Write
RetryWorkflowStep	Grants permission to retry a failed step within a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
SendMessage	Grants permission to the plugin to send information to the service			Write
StartWorkflow	Grants permission to start a workflow or resume a stopped workflow	workflow*	aws:ResourceTag/${TagKey}	Write
StopWorkflow	Grants permission to stop a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a resource	template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to add tags to a resource	workflow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a resource	template	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a resource	workflow	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateTemplate	Grants permission to update a custom template	template*	aws:ResourceTag/${TagKey}	Write
UpdateWorkflow	Grants permission to update the metadata associated with the workflow	workflow*	aws:ResourceTag/${TagKey}	Write
UpdateWorkflowStep	Grants permission to update metadata and status of a custom step within a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
UpdateWorkflowStepGroup	Grants permission to update metadata associated with a step group in a given workflow	workflow*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Migration Hub Orchestrator

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
template	arn:${Partition}:migrationhub-orchestrator:${Region}:${Account}:template/${ResourceId}	aws:ResourceTag/${TagKey}
workflow	arn:${Partition}:migrationhub-orchestrator:${Region}:${Account}:workflow/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Migration Hub Orchestrator

AWS Migration Hub Orchestrator defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Migration Hub (mgh)

AWS Migration Hub Refactor Spaces (refactor-spaces)