AWS Managed Policies. A maze of twisty passages all alike. Explore them here. If it looks like a button, it's clickable. Always up to date.

AWSMigrationHubOrchestratorServiceRolePolicy details (in AWS console)

Policy Name

AWSMigrationHubOrchestratorServiceRolePolicy

Description

Provides permissions necessary for Migration Hub Orchestrator to migrate and modernize your on-premises workloads

ARN

arn:aws:iam::aws:policy/aws-service-role/AWSMigrationHubOrchestratorServiceRolePolicy

Path

/aws-service-role/

PolicyId

ANPAZKAPJZG4LSN7AHAZR

AttachmentCount

discovery launchwizard ec2 mgh ssm s3 events mgn

[
  {
    "Effect": "Allow",
    "Action": [
      "discovery:DescribeConfigurations",
      "discovery:ListConfigurations"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "launchwizard:ListProvisionedApps",
      "launchwizard:DescribeProvisionedApp",
      "launchwizard:ListDeployments",
      "launchwizard:GetDeployment"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "ec2:DescribeInstances"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "ec2:CreateLaunchTemplateVersion",
      "ec2:ModifyLaunchTemplate"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "ec2:DescribeLaunchTemplates"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "mgh:GetHomeRegion"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "ssm:SendCommand",
      "ssm:GetCommandInvocation",
      "ssm:CancelCommand"
    ],
    "Resource": [
      "arn:aws:ssm:*::document/AWS-RunRemoteScript",
      "arn:aws:ec2:*:*:instance/*",
      "arn:aws:s3:::aws-migrationhub-orchestrator-*",
      "arn:aws:s3:::migrationhub-orchestrator-*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "ssm:DescribeInstanceInformation",
      "ssm:GetCommandInvocation"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "s3:GetObject"
    ],
    "Resource": [
      "arn:aws:s3:::migrationhub-orchestrator-*",
      "arn:aws:s3:::migrationhub-orchestrator-*/*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "events:PutTargets",
      "events:DescribeRule",
      "events:DeleteRule",
      "events:PutRule",
      "events:RemoveTargets"
    ],
    "Resource": [
      "arn:aws:events:*:*:rule/MigrationHubOrchestratorManagedRule*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "mgn:GetReplicationConfiguration",
      "mgn:GetLaunchConfiguration",
      "mgn:StartCutover",
      "mgn:FinalizeCutover",
      "mgn:StartTest",
      "mgn:UpdateReplicationConfiguration",
      "mgn:DescribeSourceServers",
      "mgn:MarkAsArchived",
      "mgn:ChangeServerLifeCycleState"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "ec2:DescribeImportImageTasks"
    ],
    "Resource": [
      "*"
    ]
  },
  {
    "Effect": "Allow",
    "Action": [
      "s3:ListBucket"
    ],
    "Resource": [
      "arn:aws:s3:::*"
    ]
  }
]