aws-iam-managed-policies 0.0.641 → 0.0.643

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/managedPolicies.json +4414 -18
  2. package/package.json +1 -1
package/dist/managedPolicies.json CHANGED
@@ -503721,8 +503721,8 @@
503721
503721
  },
503722
503722
  "CloudWatchAutomaticDashboardsAccess": {
503723
503723
  "arn": "arn:aws:iam::aws:policy/CloudWatchAutomaticDashboardsAccess",
503724
- "latestVersionId": "v4",
503725
- "versionsCount": 4,
503724
+ "latestVersionId": "v5",
503725
+ "versionsCount": 5,
503726
503726
  "versions": {
503727
503727
  "v1": {
503728
503728
  "createdDate": "2019-07-23T10:01:08.000Z",
@@ -503947,10 +503947,69 @@
503947
503947
  }
503948
503948
  ]
503949
503949
  }
503950
+ },
503951
+ "v5": {
503952
+ "createdDate": "2019-07-23T10:01:08.000Z",
503953
+ "document": {
503954
+ "Version": "2012-10-17",
503955
+ "Statement": [
503956
+ {
503957
+ "Effect": "Allow",
503958
+ "Action": [
503959
+ "autoscaling:DescribeAutoScalingGroups",
503960
+ "cloudfront:GetDistribution",
503961
+ "cloudfront:ListDistributions",
503962
+ "dynamodb:DescribeTable",
503963
+ "dynamodb:ListTables",
503964
+ "ec2:DescribeInstances",
503965
+ "ec2:DescribeVolumes",
503966
+ "ecs:DescribeClusters",
503967
+ "ecs:DescribeContainerInstances",
503968
+ "ecs:ListClusters",
503969
+ "ecs:ListContainerInstances",
503970
+ "ecs:ListServices",
503971
+ "elasticache:DescribeCacheClusters",
503972
+ "elasticbeanstalk:DescribeEnvironments",
503973
+ "elasticfilesystem:DescribeFileSystems",
503974
+ "elasticloadbalancing:DescribeLoadBalancers",
503975
+ "kinesis:DescribeStream",
503976
+ "kinesis:ListStreams",
503977
+ "lambda:GetFunction",
503978
+ "lambda:GetFunctionConfiguration",
503979
+ "lambda:ListFunctions",
503980
+ "lambda:ListTags",
503981
+ "rds:DescribeDBClusters",
503982
+ "rds:DescribeDBInstances",
503983
+ "resource-groups:ListGroupResources",
503984
+ "resource-groups:ListGroups",
503985
+ "route53:GetHealthCheck",
503986
+ "route53:ListHealthChecks",
503987
+ "s3:ListAllMyBuckets",
503988
+ "s3:ListBucket",
503989
+ "sns:ListTopics",
503990
+ "sqs:GetQueueAttributes",
503991
+ "sqs:GetQueueUrl",
503992
+ "sqs:ListQueues",
503993
+ "synthetics:DescribeCanariesLastRun",
503994
+ "tag:GetResources"
503995
+ ],
503996
+ "Resource": "*"
503997
+ },
503998
+ {
503999
+ "Effect": "Allow",
504000
+ "Action": [
504001
+ "apigateway:GET"
504002
+ ],
504003
+ "Resource": [
504004
+ "arn:aws:apigateway:*::/restapis*"
504005
+ ]
504006
+ }
504007
+ ]
504008
+ }
503950
504009
  }
503951
504010
  },
503952
504011
  "createdDate": "2019-07-23T10:01:08.000Z",
503953
- "lastUpdatedDate": "2021-04-20T13:05:40.000Z"
504012
+ "lastUpdatedDate": "2026-08-07T10:42:17.000Z"
503954
504013
  },
503955
504014
  "ConfigConformsServiceRolePolicy": {
503956
504015
  "arn": "arn:aws:iam::aws:policy/aws-service-role/ConfigConformsServiceRolePolicy",
@@ -1393188,8 +1393247,8 @@
1393188
1393247
  },
1393189
1393248
  "AmazonSageMakerJobRuntimeAccess": {
1393190
1393249
  "arn": "arn:aws:iam::aws:policy/AmazonSageMakerJobRuntimeAccess",
1393191
- "latestVersionId": "v1",
1393192
- "versionsCount": 1,
1393250
+ "latestVersionId": "v2",
1393251
+ "versionsCount": 2,
1393193
1393252
  "versions": {
1393194
1393253
  "v1": {
1393195
1393254
  "createdDate": "2026-06-03T02:42:10.000Z",
@@ -1393227,10 +1393286,64 @@
1393227
1393286
  }
1393228
1393287
  ]
1393229
1393288
  }
1393289
+ },
1393290
+ "v2": {
1393291
+ "createdDate": "2026-06-03T02:42:10.000Z",
1393292
+ "document": {
1393293
+ "Version": "2012-10-17",
1393294
+ "Statement": [
1393295
+ {
1393296
+ "Sid": "SageMakerJobRuntimePermissions",
1393297
+ "Effect": "Allow",
1393298
+ "Action": [
1393299
+ "sagemaker:Sample",
1393300
+ "sagemaker:SampleWithResponseStream",
1393301
+ "sagemaker:CompleteRollout",
1393302
+ "sagemaker:UpdateReward"
1393303
+ ],
1393304
+ "Resource": "arn:aws:sagemaker:*:*:job/*",
1393305
+ "Condition": {
1393306
+ "StringEquals": {
1393307
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1393308
+ }
1393309
+ }
1393310
+ },
1393311
+ {
1393312
+ "Sid": "BearerTokenPermissions",
1393313
+ "Effect": "Allow",
1393314
+ "Action": [
1393315
+ "sagemaker:CallWithBearerToken"
1393316
+ ],
1393317
+ "Resource": "*",
1393318
+ "Condition": {
1393319
+ "StringEquals": {
1393320
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1393321
+ }
1393322
+ }
1393323
+ },
1393324
+ {
1393325
+ "Sid": "KMSPermissionsForMTRLRuntime",
1393326
+ "Effect": "Allow",
1393327
+ "Action": [
1393328
+ "kms:Decrypt",
1393329
+ "kms:GenerateDataKey"
1393330
+ ],
1393331
+ "Resource": "arn:aws:kms:*:*:key/*",
1393332
+ "Condition": {
1393333
+ "StringEquals": {
1393334
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1393335
+ },
1393336
+ "StringLike": {
1393337
+ "kms:ViaService": "sagemaker.*.amazonaws.com"
1393338
+ }
1393339
+ }
1393340
+ }
1393341
+ ]
1393342
+ }
1393230
1393343
  }
1393231
1393344
  },
1393232
1393345
  "createdDate": "2026-06-03T02:42:10.000Z",
1393233
- "lastUpdatedDate": "2026-06-03T02:42:10.000Z"
1393346
+ "lastUpdatedDate": "2026-08-07T18:42:15.000Z"
1393234
1393347
  },
1393235
1393348
  "AmazonSageMakerJobFullAccess": {
1393236
1393349
  "arn": "arn:aws:iam::aws:policy/AmazonSageMakerJobFullAccess",
@@ -1398329,8 +1398442,8 @@
1398329
1398442
  },
1398330
1398443
  "AWSManagedBudgetsSpendLimitManagementAccess": {
1398331
1398444
  "arn": "arn:aws:iam::aws:policy/AWSManagedBudgetsSpendLimitManagementAccess",
1398332
- "latestVersionId": "v1",
1398333
- "versionsCount": 1,
1398445
+ "latestVersionId": "v2",
1398446
+ "versionsCount": 2,
1398334
1398447
  "versions": {
1398335
1398448
  "v1": {
1398336
1398449
  "createdDate": "2026-07-17T21:12:21.000Z",
@@ -1398370,10 +1398483,54 @@
1398370
1398483
  }
1398371
1398484
  ]
1398372
1398485
  }
1398486
+ },
1398487
+ "v2": {
1398488
+ "createdDate": "2026-07-17T21:12:21.000Z",
1398489
+ "document": {
1398490
+ "Version": "2012-10-17",
1398491
+ "Statement": [
1398492
+ {
1398493
+ "Sid": "SCPActions",
1398494
+ "Effect": "Allow",
1398495
+ "Action": [
1398496
+ "organizations:AttachPolicy",
1398497
+ "organizations:DescribePolicy",
1398498
+ "organizations:DetachPolicy"
1398499
+ ],
1398500
+ "Resource": "arn:aws:organizations::*:policy/*/service_control_policy/*",
1398501
+ "Condition": {
1398502
+ "StringEquals": {
1398503
+ "aws:ResourceTag/ManagedBy": "SpendLimit"
1398504
+ }
1398505
+ }
1398506
+ },
1398507
+ {
1398508
+ "Sid": "SCPListPolicyAction",
1398509
+ "Effect": "Allow",
1398510
+ "Action": "organizations:ListPolicies",
1398511
+ "Resource": "*"
1398512
+ },
1398513
+ {
1398514
+ "Sid": "SCPTargetActions",
1398515
+ "Effect": "Allow",
1398516
+ "Action": [
1398517
+ "organizations:AttachPolicy",
1398518
+ "organizations:DetachPolicy"
1398519
+ ],
1398520
+ "Resource": "arn:aws:organizations::*:account/*"
1398521
+ },
1398522
+ {
1398523
+ "Sid": "AccountActions",
1398524
+ "Effect": "Allow",
1398525
+ "Action": "organizations:CloseAccount",
1398526
+ "Resource": "arn:aws:organizations::*:account/*"
1398527
+ }
1398528
+ ]
1398529
+ }
1398373
1398530
  }
1398374
1398531
  },
1398375
1398532
  "createdDate": "2026-07-17T21:12:21.000Z",
1398376
- "lastUpdatedDate": "2026-07-17T21:12:21.000Z"
1398533
+ "lastUpdatedDate": "2026-08-07T21:07:17.000Z"
1398377
1398534
  },
1398378
1398535
  "AWSManagedAccountUserEntitlementAccess": {
1398379
1398536
  "arn": "arn:aws:iam::aws:policy/AWSManagedAccountUserEntitlementAccess",
@@ -1398407,8 +1398564,8 @@
1398407
1398564
  },
1398408
1398565
  "AWSBudgetsSpendLimitMemberRolePolicy": {
1398409
1398566
  "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSBudgetsSpendLimitMemberRolePolicy",
1398410
- "latestVersionId": "v1",
1398411
- "versionsCount": 1,
1398567
+ "latestVersionId": "v2",
1398568
+ "versionsCount": 2,
1398412
1398569
  "versions": {
1398413
1398570
  "v1": {
1398414
1398571
  "createdDate": "2026-07-18T00:57:16.000Z",
@@ -1398589,10 +1398746,199 @@
1398589
1398746
  }
1398590
1398747
  ]
1398591
1398748
  }
1398749
+ },
1398750
+ "v2": {
1398751
+ "createdDate": "2026-07-18T00:57:16.000Z",
1398752
+ "document": {
1398753
+ "Version": "2012-10-17",
1398754
+ "Statement": [
1398755
+ {
1398756
+ "Sid": "EC2Actions",
1398757
+ "Effect": "Allow",
1398758
+ "Action": [
1398759
+ "ec2:DescribeInstances",
1398760
+ "ec2:StopInstances",
1398761
+ "ec2:DescribeNatGateways",
1398762
+ "ec2:DescribeVpnGateways",
1398763
+ "ec2:DescribeAddresses",
1398764
+ "ec2:DescribeSnapshots",
1398765
+ "ec2:DescribeInstanceStatus",
1398766
+ "ec2:DescribeVolumes"
1398767
+ ],
1398768
+ "Resource": "*"
1398769
+ },
1398770
+ {
1398771
+ "Sid": "RDSActions",
1398772
+ "Effect": "Allow",
1398773
+ "Action": [
1398774
+ "rds:DescribeDBInstances",
1398775
+ "rds:StopDBInstance",
1398776
+ "rds:DescribeDBClusters",
1398777
+ "rds:StopDBCluster",
1398778
+ "rds:CreateDBClusterSnapshot",
1398779
+ "rds:DescribeDBClusterSnapshots",
1398780
+ "rds:RestoreDBClusterFromSnapshot",
1398781
+ "rds:RestoreDBClusterToPointInTime",
1398782
+ "rds:DescribeIntegrations",
1398783
+ "rds:DescribeDBProxies"
1398784
+ ],
1398785
+ "Resource": "*"
1398786
+ },
1398787
+ {
1398788
+ "Sid": "DSQLActions",
1398789
+ "Effect": "Allow",
1398790
+ "Action": [
1398791
+ "dsql:GetCluster",
1398792
+ "dsql:ListClusters"
1398793
+ ],
1398794
+ "Resource": "*"
1398795
+ },
1398796
+ {
1398797
+ "Sid": "SageMakerActions",
1398798
+ "Effect": "Allow",
1398799
+ "Action": [
1398800
+ "sagemaker:DescribeNotebookInstance",
1398801
+ "sagemaker:ListNotebookInstances",
1398802
+ "sagemaker:StopNotebookInstance",
1398803
+ "sagemaker:StartNotebookInstance",
1398804
+ "sagemaker:DescribeApp",
1398805
+ "sagemaker:ListApps",
1398806
+ "sagemaker:DescribeTrainingJob",
1398807
+ "sagemaker:ListTrainingJobs",
1398808
+ "sagemaker:StopTrainingJob",
1398809
+ "sagemaker:DescribeProcessingJob",
1398810
+ "sagemaker:ListProcessingJobs",
1398811
+ "sagemaker:StopProcessingJob",
1398812
+ "sagemaker:DescribeTransformJob",
1398813
+ "sagemaker:ListTransformJobs",
1398814
+ "sagemaker:StopTransformJob",
1398815
+ "sagemaker:ListEndpoints",
1398816
+ "sagemaker:DescribeEndpointConfig",
1398817
+ "sagemaker:ListEndpointConfigs",
1398818
+ "sagemaker:DescribeCluster",
1398819
+ "sagemaker:ListClusters",
1398820
+ "sagemaker:DescribeClusterNode",
1398821
+ "sagemaker:ListClusterNodes",
1398822
+ "sagemaker:AttachClusterNodeVolume",
1398823
+ "sagemaker:DetachClusterNodeVolume",
1398824
+ "sagemaker:DescribeMlflowTrackingServer",
1398825
+ "sagemaker:ListMlflowTrackingServers",
1398826
+ "sagemaker:StopMlflowTrackingServer",
1398827
+ "sagemaker:StopLabelingJob",
1398828
+ "sagemaker:DescribeUserProfile"
1398829
+ ],
1398830
+ "Resource": "*"
1398831
+ },
1398832
+ {
1398833
+ "Sid": "LambdaActions",
1398834
+ "Effect": "Allow",
1398835
+ "Action": [
1398836
+ "lambda:GetFunctionConfiguration",
1398837
+ "lambda:ListFunctions",
1398838
+ "lambda:GetFunctionConcurrency",
1398839
+ "lambda:PutFunctionConcurrency",
1398840
+ "lambda:DeleteFunctionConcurrency",
1398841
+ "lambda:ListEventSourceMappings",
1398842
+ "lambda:GetEventSourceMapping",
1398843
+ "lambda:GetProvisionedConcurrencyConfig",
1398844
+ "lambda:ListProvisionedConcurrencyConfigs",
1398845
+ "lambda:PutProvisionedConcurrencyConfig",
1398846
+ "lambda:DeleteProvisionedConcurrencyConfig"
1398847
+ ],
1398848
+ "Resource": "*"
1398849
+ },
1398850
+ {
1398851
+ "Sid": "BedrockActions",
1398852
+ "Effect": "Allow",
1398853
+ "Action": [
1398854
+ "bedrock:GetProvisionedModelThroughput",
1398855
+ "bedrock:ListProvisionedModelThroughputs",
1398856
+ "bedrock:UpdateProvisionedModelThroughput",
1398857
+ "bedrock:GetModelInvocationJob",
1398858
+ "bedrock:ListModelInvocationJobs",
1398859
+ "bedrock:StopModelInvocationJob",
1398860
+ "bedrock:GetModelCustomizationJob",
1398861
+ "bedrock:ListModelCustomizationJobs",
1398862
+ "bedrock:StopModelCustomizationJob",
1398863
+ "bedrock:GetEvaluationJob",
1398864
+ "bedrock:ListEvaluationJobs",
1398865
+ "bedrock:StopEvaluationJob"
1398866
+ ],
1398867
+ "Resource": "*"
1398868
+ },
1398869
+ {
1398870
+ "Sid": "SSMAutomation",
1398871
+ "Effect": "Allow",
1398872
+ "Action": [
1398873
+ "ssm:StartAutomationExecution",
1398874
+ "ssm:GetAutomationExecution",
1398875
+ "ssm:DescribeAutomationExecutions",
1398876
+ "ssm:DescribeAutomationStepExecutions",
1398877
+ "ssm:StopAutomationExecution"
1398878
+ ],
1398879
+ "Resource": [
1398880
+ "arn:aws:ssm:*:*:document/AWS-StartEC2Instance",
1398881
+ "arn:aws:ssm:*:*:document/AWS-StopEC2Instance",
1398882
+ "arn:aws:ssm:*:*:document/AWS-StartRdsInstance",
1398883
+ "arn:aws:ssm:*:*:document/AWS-StopRdsInstance",
1398884
+ "arn:aws:ssm:*:*:automation-execution/*",
1398885
+ "arn:aws:ssm:*:*:automation-definition/AWS-StartEC2Instance:*",
1398886
+ "arn:aws:ssm:*:*:automation-definition/AWS-StopEC2Instance:*",
1398887
+ "arn:aws:ssm:*:*:automation-definition/AWS-StartRdsInstance:*",
1398888
+ "arn:aws:ssm:*:*:automation-definition/AWS-StopRdsInstance:*"
1398889
+ ]
1398890
+ },
1398891
+ {
1398892
+ "Sid": "CostOptimizationHubActions",
1398893
+ "Effect": "Allow",
1398894
+ "Action": "cost-optimization-hub:UpdateEnrollmentStatus",
1398895
+ "Resource": "*"
1398896
+ },
1398897
+ {
1398898
+ "Sid": "ComputeOptimizerActions",
1398899
+ "Effect": "Allow",
1398900
+ "Action": [
1398901
+ "compute-optimizer:GetIdleRecommendations",
1398902
+ "compute-optimizer:GetRecommendationSummaries",
1398903
+ "compute-optimizer:GetEnrollmentStatus",
1398904
+ "compute-optimizer:UpdateEnrollmentStatus"
1398905
+ ],
1398906
+ "Resource": "*"
1398907
+ },
1398908
+ {
1398909
+ "Sid": "ComputeOptimizerAutomationActions",
1398910
+ "Effect": "Allow",
1398911
+ "Action": [
1398912
+ "aco-automation:StartAutomationEvent",
1398913
+ "aco-automation:ListRecommendedActions",
1398914
+ "aco-automation:GetAutomationEvent",
1398915
+ "aco-automation:UpdateEnrollmentConfiguration"
1398916
+ ],
1398917
+ "Resource": "*"
1398918
+ },
1398919
+ {
1398920
+ "Sid": "SSOActions",
1398921
+ "Effect": "Allow",
1398922
+ "Action": [
1398923
+ "sso:ListInstances"
1398924
+ ],
1398925
+ "Resource": "*"
1398926
+ },
1398927
+ {
1398928
+ "Sid": "AccountActions",
1398929
+ "Effect": "Allow",
1398930
+ "Action": [
1398931
+ "account:GetAccountInformation",
1398932
+ "account:GetPrimaryEmail"
1398933
+ ],
1398934
+ "Resource": "*"
1398935
+ }
1398936
+ ]
1398937
+ }
1398592
1398938
  }
1398593
1398939
  },
1398594
1398940
  "createdDate": "2026-07-18T00:57:16.000Z",
1398595
- "lastUpdatedDate": "2026-07-18T00:57:16.000Z"
1398941
+ "lastUpdatedDate": "2026-08-07T23:57:21.000Z"
1398596
1398942
  },
1398597
1398943
  "AWSManagedSignUpAdminAccess": {
1398598
1398944
  "arn": "arn:aws:iam::aws:policy/service-role/AWSManagedSignUpAdminAccess",
@@ -1400085,8 +1400431,8 @@
1400085
1400431
  },
1400086
1400432
  "AWSManagedSettingsAdminAccess": {
1400087
1400433
  "arn": "arn:aws:iam::aws:policy/AWSManagedSettingsAdminAccess",
1400088
- "latestVersionId": "v2",
1400089
- "versionsCount": 2,
1400434
+ "latestVersionId": "v4",
1400435
+ "versionsCount": 4,
1400090
1400436
  "versions": {
1400091
1400437
  "v1": {
1400092
1400438
  "createdDate": "2026-07-22T01:27:25.000Z",
@@ -1400795,10 +1401141,743 @@
1400795
1401141
  }
1400796
1401142
  ]
1400797
1401143
  }
1401144
+ },
1401145
+ "v3": {
1401146
+ "createdDate": "2026-07-22T01:27:25.000Z",
1401147
+ "document": {
1401148
+ "Version": "2012-10-17",
1401149
+ "Statement": [
1401150
+ {
1401151
+ "Sid": "ActivateAdvancedUpdateAccountName",
1401152
+ "Effect": "Allow",
1401153
+ "Action": [
1401154
+ "account:PutAccountName"
1401155
+ ],
1401156
+ "Resource": "*",
1401157
+ "Condition": {
1401158
+ "StringEquals": {
1401159
+ "aws:CalledViaLast": "account.amazonaws.com"
1401160
+ }
1401161
+ }
1401162
+ },
1401163
+ {
1401164
+ "Sid": "AWSSettingsAccountAccess",
1401165
+ "Effect": "Allow",
1401166
+ "Action": [
1401167
+ "account:GetAccountInformation",
1401168
+ "account:GetContactInformation",
1401169
+ "account:CloseAccount",
1401170
+ "account:PutAccountName",
1401171
+ "account:PutContactInformation",
1401172
+ "account:StartPrimaryEmailUpdate",
1401173
+ "account:AcceptPrimaryEmailUpdate",
1401174
+ "account:GetPrimaryEmailUpdateStatus"
1401175
+ ],
1401176
+ "Resource": "*"
1401177
+ },
1401178
+ {
1401179
+ "Sid": "AWSSettingsBillingAccess",
1401180
+ "Effect": "Allow",
1401181
+ "Action": [
1401182
+ "billing:GetCredits",
1401183
+ "billing:GetSellerOfRecord",
1401184
+ "billing:RedeemCredits"
1401185
+ ],
1401186
+ "Resource": "*"
1401187
+ },
1401188
+ {
1401189
+ "Sid": "AWSSettingsCostExplorerAccess",
1401190
+ "Effect": "Allow",
1401191
+ "Action": [
1401192
+ "ce:GetCostAndUsage",
1401193
+ "ce:GetCostForecast"
1401194
+ ],
1401195
+ "Resource": "*"
1401196
+ },
1401197
+ {
1401198
+ "Sid": "AWSSettingsBudgetsAccess",
1401199
+ "Effect": "Allow",
1401200
+ "Action": [
1401201
+ "budgets:CreateBudgetAction",
1401202
+ "budgets:DeleteBudgetAction",
1401203
+ "budgets:DescribeBudgetActionsForAccount",
1401204
+ "budgets:DescribeBudgetActionsForBudget",
1401205
+ "budgets:ModifyBudget",
1401206
+ "budgets:ViewBudget",
1401207
+ "budgets:UpdateBudget",
1401208
+ "budgets:CreateBudget",
1401209
+ "budgets:DeleteBudget",
1401210
+ "budgets:DescribeBudgets",
1401211
+ "budgets:DescribeBudget",
1401212
+ "budgets:DescribeBudgetActionHistories"
1401213
+ ],
1401214
+ "Resource": "*"
1401215
+ },
1401216
+ {
1401217
+ "Sid": "AWSSettingsIAMPassRole",
1401218
+ "Effect": "Allow",
1401219
+ "Action": "iam:PassRole",
1401220
+ "Resource": "arn:aws:iam::*:role/managed/AWSManagedBudgetsSpendLimitManagementRole",
1401221
+ "Condition": {
1401222
+ "StringEquals": {
1401223
+ "iam:PassedToService": "budgets.amazonaws.com"
1401224
+ }
1401225
+ }
1401226
+ },
1401227
+ {
1401228
+ "Sid": "AWSSettingsCustomerVerificationAccess",
1401229
+ "Effect": "Allow",
1401230
+ "Action": [
1401231
+ "customer-verification:CreateCustomerVerificationDetails",
1401232
+ "customer-verification:CreateUploadUrls",
1401233
+ "customer-verification:GetCustomerVerificationDetails",
1401234
+ "customer-verification:GetCustomerVerificationEligibility",
1401235
+ "customer-verification:UpdateCustomerVerificationDetails"
1401236
+ ],
1401237
+ "Resource": "*"
1401238
+ },
1401239
+ {
1401240
+ "Sid": "AWSSettingsFreeTierAccess",
1401241
+ "Effect": "Allow",
1401242
+ "Action": [
1401243
+ "freetier:GetAccountPlanState",
1401244
+ "freetier:UpgradeAccountPlan"
1401245
+ ],
1401246
+ "Resource": "*"
1401247
+ },
1401248
+ {
1401249
+ "Sid": "AWSSettingsIdentityStoreAccess",
1401250
+ "Effect": "Allow",
1401251
+ "Action": [
1401252
+ "identitystore:CreateGroup",
1401253
+ "identitystore:CreateGroupMembership",
1401254
+ "identitystore:CreateUser",
1401255
+ "identitystore:DeleteGroup",
1401256
+ "identitystore:DeleteGroupMembership",
1401257
+ "identitystore:DeleteUser",
1401258
+ "identitystore:DescribeGroup",
1401259
+ "identitystore:DescribeUser",
1401260
+ "identitystore:GetGroupId",
1401261
+ "identitystore:GetUserId",
1401262
+ "identitystore:ListGroupMemberships",
1401263
+ "identitystore:UpdateIdentityStore",
1401264
+ "identitystore:ListGroupMembershipsForMember",
1401265
+ "identitystore:ListGroups",
1401266
+ "identitystore:ListUsers",
1401267
+ "identitystore:ReserveUser",
1401268
+ "identitystore:UpdateGroup",
1401269
+ "identitystore:UpdateUser",
1401270
+ "sso-directory:DescribeUsers",
1401271
+ "sso-directory:SearchGroups",
1401272
+ "sso-directory:SearchUsers",
1401273
+ "builderid:CreateInvitation",
1401274
+ "builderid:DeleteInvitation",
1401275
+ "builderid:DisassociateCollaborator",
1401276
+ "builderid:ListInvitations"
1401277
+ ],
1401278
+ "Resource": "*"
1401279
+ },
1401280
+ {
1401281
+ "Sid": "AWSSettingsInvoicingAccess",
1401282
+ "Effect": "Allow",
1401283
+ "Action": [
1401284
+ "invoicing:GetInvoicePDF"
1401285
+ ],
1401286
+ "Resource": "*"
1401287
+ },
1401288
+ {
1401289
+ "Sid": "AWSSettingsOrganizationsAccess",
1401290
+ "Effect": "Allow",
1401291
+ "Action": [
1401292
+ "organizations:CloseAccount",
1401293
+ "organizations:CreatePolicy",
1401294
+ "organizations:DescribeEffectivePolicy",
1401295
+ "organizations:DescribeOrganization",
1401296
+ "organizations:ListAccounts",
1401297
+ "organizations:ListPolicies",
1401298
+ "organizations:ListPoliciesForTarget",
1401299
+ "organizations:ListRoots",
1401300
+ "organizations:CreateBuilderIdOwnedAccount",
1401301
+ "organizations:DescribeCreateAccountStatus",
1401302
+ "organizations:DescribeAccount",
1401303
+ "organizations:InviteAccountToOrganization"
1401304
+ ],
1401305
+ "Resource": "*"
1401306
+ },
1401307
+ {
1401308
+ "Sid": "AWSSettingsOrganizationsAiOptOutPolicyManagement",
1401309
+ "Effect": "Allow",
1401310
+ "Action": [
1401311
+ "organizations:AttachPolicy",
1401312
+ "organizations:DetachPolicy",
1401313
+ "organizations:EnablePolicyType",
1401314
+ "organizations:DisablePolicyType"
1401315
+ ],
1401316
+ "Resource": "*",
1401317
+ "Condition": {
1401318
+ "StringEquals": {
1401319
+ "organizations:PolicyType": "AISERVICES_OPT_OUT_POLICY"
1401320
+ }
1401321
+ }
1401322
+ },
1401323
+ {
1401324
+ "Sid": "AWSSettingsPaymentsAccess",
1401325
+ "Effect": "Allow",
1401326
+ "Action": [
1401327
+ "payments:CreatePaymentInstrument",
1401328
+ "payments:GetPaymentInstrument",
1401329
+ "payments:GetPaymentStatus",
1401330
+ "payments:ListPaymentPreferences",
1401331
+ "payments:MakePayment",
1401332
+ "payments:UpdatePaymentInstrument",
1401333
+ "payments:UpdatePaymentPreferences",
1401334
+ "payments:TagResource",
1401335
+ "payments:UntagResource",
1401336
+ "payments:ListTagsForResource",
1401337
+ "payments:BatchGetPaymentProfiles",
1401338
+ "payments:AcceptTermsAndConditionsForProgramByAccountId",
1401339
+ "payments:CreatePaymentAttempt",
1401340
+ "payments:CreatePaymentProfile",
1401341
+ "payments:Get",
1401342
+ "payments:GetAcceptedTermsAndConditionsForProgramByAccountId",
1401343
+ "payments:GetEligibleCurrencies",
1401344
+ "payments:GetPaymentAttempt",
1401345
+ "payments:GetPaymentPreferences",
1401346
+ "payments:GetPreferredCurrency",
1401347
+ "payments:GetRecommendedTermsAndConditionsForProgram",
1401348
+ "payments:ListPaymentProfiles",
1401349
+ "payments:SearchFinancialRecords",
1401350
+ "payments:SetPreferredCurrency",
1401351
+ "payments:UpdatePaymentProfile",
1401352
+ "payments:GetAccountBalance"
1401353
+ ],
1401354
+ "Resource": "*"
1401355
+ },
1401356
+ {
1401357
+ "Sid": "AWSSettingsSESAccess",
1401358
+ "Effect": "Allow",
1401359
+ "Action": [
1401360
+ "ses:SendEmail"
1401361
+ ],
1401362
+ "Resource": "*"
1401363
+ },
1401364
+ {
1401365
+ "Sid": "AWSSettingsSSOAccess",
1401366
+ "Effect": "Allow",
1401367
+ "Action": [
1401368
+ "sso:DeleteApplicationAssignment",
1401369
+ "sso:DescribeInstance",
1401370
+ "sso:GetApplicationAssignmentConfiguration",
1401371
+ "sso:ListApplicationAssignments",
1401372
+ "sso:CreateApplicationAssignment",
1401373
+ "sso:DescribeApplication",
1401374
+ "sso:ListApplications",
1401375
+ "sso:UpdateInstance"
1401376
+ ],
1401377
+ "Resource": "*"
1401378
+ },
1401379
+ {
1401380
+ "Sid": "AWSSettingsTaxAccess",
1401381
+ "Effect": "Allow",
1401382
+ "Action": [
1401383
+ "tax:BatchPutTaxRegistration",
1401384
+ "tax:DeleteTaxRegistration",
1401385
+ "tax:GetTaxRegistration",
1401386
+ "tax:GetTaxRegistrationDocument",
1401387
+ "tax:ListTaxRegistrations",
1401388
+ "tax:PutTaxRegistration"
1401389
+ ],
1401390
+ "Resource": "*"
1401391
+ },
1401392
+ {
1401393
+ "Sid": "AWSSettingsSupportAccess",
1401394
+ "Effect": "Allow",
1401395
+ "Action": [
1401396
+ "support:CreateCase",
1401397
+ "support:DescribeServices",
1401398
+ "support:DescribeSeverityLevels",
1401399
+ "support:DescribeCases",
1401400
+ "support:AddCommunicationToCase",
1401401
+ "support:ResolveCase"
1401402
+ ],
1401403
+ "Resource": "*"
1401404
+ },
1401405
+ {
1401406
+ "Sid": "ActivateAdvancedProvisioningAccess",
1401407
+ "Effect": "Allow",
1401408
+ "Action": [
1401409
+ "organizations:CreateBuilderIdOwnedAccount",
1401410
+ "organizations:DescribeCreateAccountStatus",
1401411
+ "organizations:ListAccounts",
1401412
+ "sso:ListInstances",
1401413
+ "identitystore:GetUserId",
1401414
+ "sso-directory:ListProvisioningTenants",
1401415
+ "account-access:ListApplications",
1401416
+ "account-access:CreateApplication",
1401417
+ "account-access:CreateEntitlement",
1401418
+ "signin:DeleteConsoleAuthorizationConfiguration"
1401419
+ ],
1401420
+ "Resource": "*",
1401421
+ "Condition": {
1401422
+ "StringEquals": {
1401423
+ "aws:CalledViaLast": "account.amazonaws.com"
1401424
+ }
1401425
+ }
1401426
+ },
1401427
+ {
1401428
+ "Sid": "ActivateAdvancedDelegatedAdminAccess",
1401429
+ "Effect": "Allow",
1401430
+ "Action": [
1401431
+ "organizations:RegisterDelegatedAdministrator",
1401432
+ "organizations:ListDelegatedAdministrators"
1401433
+ ],
1401434
+ "Resource": "*",
1401435
+ "Condition": {
1401436
+ "StringEquals": {
1401437
+ "aws:CalledViaLast": "account.amazonaws.com",
1401438
+ "organizations:ServicePrincipal": [
1401439
+ "sso.amazonaws.com",
1401440
+ "account-access.amazonaws.com"
1401441
+ ]
1401442
+ }
1401443
+ }
1401444
+ },
1401445
+ {
1401446
+ "Sid": "ActivateAdvancedManagedRoleAccess",
1401447
+ "Effect": "Allow",
1401448
+ "Action": [
1401449
+ "iam:GetRole",
1401450
+ "iam:CreateRole",
1401451
+ "iam:AttachRolePolicy",
1401452
+ "iam:DeleteRole",
1401453
+ "iam:ListAttachedRolePolicies",
1401454
+ "iam:DetachRolePolicy",
1401455
+ "iam:ListRolePolicies",
1401456
+ "iam:DeleteRolePolicy"
1401457
+ ],
1401458
+ "Resource": [
1401459
+ "arn:aws:iam::*:role/managed/*",
1401460
+ "arn:aws:iam::*:role/ManagedAccountAdmin",
1401461
+ "arn:aws:iam::*:role/AccountFullAccessRole"
1401462
+ ],
1401463
+ "Condition": {
1401464
+ "StringEquals": {
1401465
+ "aws:CalledViaLast": "account.amazonaws.com"
1401466
+ }
1401467
+ }
1401468
+ },
1401469
+ {
1401470
+ "Sid": "ActivateAdvancedMemberAccountAssume",
1401471
+ "Effect": "Allow",
1401472
+ "Action": "sts:AssumeRole",
1401473
+ "Resource": "arn:aws:iam::*:role/managed/AWSManagedAdvancedFeaturesActivationRole",
1401474
+ "Condition": {
1401475
+ "StringEquals": {
1401476
+ "aws:CalledViaLast": "account.amazonaws.com"
1401477
+ }
1401478
+ }
1401479
+ },
1401480
+ {
1401481
+ "Sid": "ActivateAdvancedBudgetsAccess",
1401482
+ "Effect": "Allow",
1401483
+ "Action": "budgets:ModifyBudget",
1401484
+ "Resource": "arn:aws:budgets::*:budget/sla-*",
1401485
+ "Condition": {
1401486
+ "StringEquals": {
1401487
+ "aws:CalledViaLast": "account.amazonaws.com"
1401488
+ }
1401489
+ }
1401490
+ },
1401491
+ {
1401492
+ "Sid": "ActivateAdvancedSCPCleanupAccess",
1401493
+ "Effect": "Allow",
1401494
+ "Action": [
1401495
+ "organizations:DeletePolicy",
1401496
+ "organizations:DetachPolicy",
1401497
+ "organizations:ListPolicies",
1401498
+ "organizations:ListRoots"
1401499
+ ],
1401500
+ "Resource": "*",
1401501
+ "Condition": {
1401502
+ "StringEquals": {
1401503
+ "aws:CalledViaLast": "account.amazonaws.com"
1401504
+ }
1401505
+ }
1401506
+ }
1401507
+ ]
1401508
+ }
1401509
+ },
1401510
+ "v4": {
1401511
+ "createdDate": "2026-07-22T01:27:25.000Z",
1401512
+ "document": {
1401513
+ "Version": "2012-10-17",
1401514
+ "Statement": [
1401515
+ {
1401516
+ "Sid": "ActivateAdvancedUpdateAccountName",
1401517
+ "Effect": "Allow",
1401518
+ "Action": [
1401519
+ "account:PutAccountName"
1401520
+ ],
1401521
+ "Resource": "*",
1401522
+ "Condition": {
1401523
+ "StringEquals": {
1401524
+ "aws:CalledViaLast": "account.amazonaws.com"
1401525
+ }
1401526
+ }
1401527
+ },
1401528
+ {
1401529
+ "Sid": "AWSSettingsAccountAccess",
1401530
+ "Effect": "Allow",
1401531
+ "Action": [
1401532
+ "account:GetAccountInformation",
1401533
+ "account:GetContactInformation",
1401534
+ "account:CloseAccount",
1401535
+ "account:PutAccountName",
1401536
+ "account:PutContactInformation",
1401537
+ "account:StartPrimaryEmailUpdate",
1401538
+ "account:AcceptPrimaryEmailUpdate",
1401539
+ "account:GetPrimaryEmailUpdateStatus"
1401540
+ ],
1401541
+ "Resource": "*"
1401542
+ },
1401543
+ {
1401544
+ "Sid": "AWSSettingsBillingAccess",
1401545
+ "Effect": "Allow",
1401546
+ "Action": [
1401547
+ "billing:GetCredits",
1401548
+ "billing:GetSellerOfRecord",
1401549
+ "billing:RedeemCredits"
1401550
+ ],
1401551
+ "Resource": "*"
1401552
+ },
1401553
+ {
1401554
+ "Sid": "AWSSettingsCostExplorerAccess",
1401555
+ "Effect": "Allow",
1401556
+ "Action": [
1401557
+ "ce:GetCostAndUsage",
1401558
+ "ce:GetCostForecast"
1401559
+ ],
1401560
+ "Resource": "*"
1401561
+ },
1401562
+ {
1401563
+ "Sid": "AWSSettingsBudgetsAccess",
1401564
+ "Effect": "Allow",
1401565
+ "Action": [
1401566
+ "budgets:CreateBudgetAction",
1401567
+ "budgets:DeleteBudgetAction",
1401568
+ "budgets:DescribeBudgetActionsForAccount",
1401569
+ "budgets:DescribeBudgetActionsForBudget",
1401570
+ "budgets:ModifyBudget",
1401571
+ "budgets:ViewBudget",
1401572
+ "budgets:UpdateBudget",
1401573
+ "budgets:CreateBudget",
1401574
+ "budgets:DeleteBudget",
1401575
+ "budgets:DescribeBudgets",
1401576
+ "budgets:DescribeBudget",
1401577
+ "budgets:DescribeBudgetActionHistories"
1401578
+ ],
1401579
+ "Resource": "*"
1401580
+ },
1401581
+ {
1401582
+ "Sid": "AWSSettingsIAMPassRole",
1401583
+ "Effect": "Allow",
1401584
+ "Action": "iam:PassRole",
1401585
+ "Resource": "arn:aws:iam::*:role/managed/AWSManagedBudgetsSpendLimitManagementRole",
1401586
+ "Condition": {
1401587
+ "StringEquals": {
1401588
+ "iam:PassedToService": "budgets.amazonaws.com"
1401589
+ }
1401590
+ }
1401591
+ },
1401592
+ {
1401593
+ "Sid": "AWSSettingsCustomerVerificationAccess",
1401594
+ "Effect": "Allow",
1401595
+ "Action": [
1401596
+ "customer-verification:CreateCustomerVerificationDetails",
1401597
+ "customer-verification:CreateUploadUrls",
1401598
+ "customer-verification:GetCustomerVerificationDetails",
1401599
+ "customer-verification:GetCustomerVerificationEligibility",
1401600
+ "customer-verification:UpdateCustomerVerificationDetails"
1401601
+ ],
1401602
+ "Resource": "*"
1401603
+ },
1401604
+ {
1401605
+ "Sid": "AWSSettingsFreeTierAccess",
1401606
+ "Effect": "Allow",
1401607
+ "Action": [
1401608
+ "freetier:GetAccountPlanState",
1401609
+ "freetier:UpgradeAccountPlan"
1401610
+ ],
1401611
+ "Resource": "*"
1401612
+ },
1401613
+ {
1401614
+ "Sid": "AWSSettingsIdentityStoreAccess",
1401615
+ "Effect": "Allow",
1401616
+ "Action": [
1401617
+ "identitystore:CreateGroup",
1401618
+ "identitystore:CreateGroupMembership",
1401619
+ "identitystore:CreateUser",
1401620
+ "identitystore:DeleteGroup",
1401621
+ "identitystore:DeleteGroupMembership",
1401622
+ "identitystore:DeleteUser",
1401623
+ "identitystore:DescribeGroup",
1401624
+ "identitystore:DescribeUser",
1401625
+ "identitystore:GetGroupId",
1401626
+ "identitystore:GetUserId",
1401627
+ "identitystore:ListGroupMemberships",
1401628
+ "identitystore:UpdateIdentityStore",
1401629
+ "identitystore:ListGroupMembershipsForMember",
1401630
+ "identitystore:ListGroups",
1401631
+ "identitystore:ListUsers",
1401632
+ "identitystore:ReserveUser",
1401633
+ "identitystore:UpdateGroup",
1401634
+ "identitystore:UpdateUser",
1401635
+ "sso-directory:DescribeUsers",
1401636
+ "sso-directory:SearchGroups",
1401637
+ "sso-directory:SearchUsers",
1401638
+ "builderid:CreateInvitation",
1401639
+ "builderid:DeleteInvitation",
1401640
+ "builderid:DisassociateCollaborator",
1401641
+ "builderid:ListInvitations"
1401642
+ ],
1401643
+ "Resource": "*"
1401644
+ },
1401645
+ {
1401646
+ "Sid": "AWSSettingsInvoicingAccess",
1401647
+ "Effect": "Allow",
1401648
+ "Action": [
1401649
+ "invoicing:GetInvoicePDF"
1401650
+ ],
1401651
+ "Resource": "*"
1401652
+ },
1401653
+ {
1401654
+ "Sid": "AWSSettingsOrganizationsAccess",
1401655
+ "Effect": "Allow",
1401656
+ "Action": [
1401657
+ "organizations:CloseAccount",
1401658
+ "organizations:CreatePolicy",
1401659
+ "organizations:DescribeEffectivePolicy",
1401660
+ "organizations:DescribeOrganization",
1401661
+ "organizations:ListAccounts",
1401662
+ "organizations:ListPolicies",
1401663
+ "organizations:ListPoliciesForTarget",
1401664
+ "organizations:ListRoots",
1401665
+ "organizations:CreateBuilderIdOwnedAccount",
1401666
+ "organizations:DescribeCreateAccountStatus",
1401667
+ "organizations:DescribeAccount",
1401668
+ "organizations:InviteAccountToOrganization"
1401669
+ ],
1401670
+ "Resource": "*"
1401671
+ },
1401672
+ {
1401673
+ "Sid": "AWSSettingsOrganizationsAiOptOutPolicyManagement",
1401674
+ "Effect": "Allow",
1401675
+ "Action": [
1401676
+ "organizations:AttachPolicy",
1401677
+ "organizations:DetachPolicy",
1401678
+ "organizations:EnablePolicyType",
1401679
+ "organizations:DisablePolicyType"
1401680
+ ],
1401681
+ "Resource": "*",
1401682
+ "Condition": {
1401683
+ "StringEquals": {
1401684
+ "organizations:PolicyType": "AISERVICES_OPT_OUT_POLICY"
1401685
+ }
1401686
+ }
1401687
+ },
1401688
+ {
1401689
+ "Sid": "AWSSettingsPaymentsAccess",
1401690
+ "Effect": "Allow",
1401691
+ "Action": [
1401692
+ "payments:CreatePaymentInstrument",
1401693
+ "payments:GetPaymentInstrument",
1401694
+ "payments:GetPaymentStatus",
1401695
+ "payments:ListPaymentPreferences",
1401696
+ "payments:MakePayment",
1401697
+ "payments:UpdatePaymentInstrument",
1401698
+ "payments:UpdatePaymentPreferences",
1401699
+ "payments:TagResource",
1401700
+ "payments:UntagResource",
1401701
+ "payments:ListTagsForResource",
1401702
+ "payments:BatchGetPaymentProfiles",
1401703
+ "payments:AcceptTermsAndConditionsForProgramByAccountId",
1401704
+ "payments:CreatePaymentAttempt",
1401705
+ "payments:CreatePaymentProfile",
1401706
+ "payments:Get",
1401707
+ "payments:GetAcceptedTermsAndConditionsForProgramByAccountId",
1401708
+ "payments:GetEligibleCurrencies",
1401709
+ "payments:GetPaymentAttempt",
1401710
+ "payments:GetPaymentPreferences",
1401711
+ "payments:GetPreferredCurrency",
1401712
+ "payments:GetRecommendedTermsAndConditionsForProgram",
1401713
+ "payments:ListPaymentProfiles",
1401714
+ "payments:SearchFinancialRecords",
1401715
+ "payments:SetPreferredCurrency",
1401716
+ "payments:UpdatePaymentProfile",
1401717
+ "payments:GetAccountBalance"
1401718
+ ],
1401719
+ "Resource": "*"
1401720
+ },
1401721
+ {
1401722
+ "Sid": "AWSSettingsSESAccess",
1401723
+ "Effect": "Allow",
1401724
+ "Action": [
1401725
+ "ses:SendEmail"
1401726
+ ],
1401727
+ "Resource": "*"
1401728
+ },
1401729
+ {
1401730
+ "Sid": "AWSSettingsSSOAccess",
1401731
+ "Effect": "Allow",
1401732
+ "Action": [
1401733
+ "sso:DeleteApplicationAssignment",
1401734
+ "sso:DescribeInstance",
1401735
+ "sso:GetApplicationAssignmentConfiguration",
1401736
+ "sso:ListApplicationAssignments",
1401737
+ "sso:CreateApplicationAssignment",
1401738
+ "sso:DescribeApplication",
1401739
+ "sso:ListApplications",
1401740
+ "sso:UpdateInstance"
1401741
+ ],
1401742
+ "Resource": "*"
1401743
+ },
1401744
+ {
1401745
+ "Sid": "AWSSettingsTaxAccess",
1401746
+ "Effect": "Allow",
1401747
+ "Action": [
1401748
+ "tax:BatchPutTaxRegistration",
1401749
+ "tax:DeleteTaxRegistration",
1401750
+ "tax:GetTaxRegistration",
1401751
+ "tax:GetTaxRegistrationDocument",
1401752
+ "tax:ListTaxRegistrations",
1401753
+ "tax:PutTaxRegistration"
1401754
+ ],
1401755
+ "Resource": "*"
1401756
+ },
1401757
+ {
1401758
+ "Sid": "AWSSettingsSupportAccess",
1401759
+ "Effect": "Allow",
1401760
+ "Action": [
1401761
+ "support:CreateCase",
1401762
+ "support:DescribeServices",
1401763
+ "support:DescribeSeverityLevels",
1401764
+ "support:DescribeCases",
1401765
+ "support:AddCommunicationToCase",
1401766
+ "support:ResolveCase",
1401767
+ "supportplans:GetSupportPlan",
1401768
+ "supportplans:StartSupportPlanUpdate",
1401769
+ "supportplans:GetSupportPlanUpdateStatus"
1401770
+ ],
1401771
+ "Resource": "*"
1401772
+ },
1401773
+ {
1401774
+ "Sid": "ActivateAdvancedProvisioningAccess",
1401775
+ "Effect": "Allow",
1401776
+ "Action": [
1401777
+ "organizations:CreateBuilderIdOwnedAccount",
1401778
+ "organizations:DescribeCreateAccountStatus",
1401779
+ "organizations:ListAccounts",
1401780
+ "sso:ListInstances",
1401781
+ "identitystore:GetUserId",
1401782
+ "sso-directory:ListProvisioningTenants",
1401783
+ "account-access:ListApplications",
1401784
+ "account-access:CreateApplication",
1401785
+ "account-access:CreateEntitlement",
1401786
+ "signin:DeleteConsoleAuthorizationConfiguration"
1401787
+ ],
1401788
+ "Resource": "*",
1401789
+ "Condition": {
1401790
+ "StringEquals": {
1401791
+ "aws:CalledViaLast": "account.amazonaws.com"
1401792
+ }
1401793
+ }
1401794
+ },
1401795
+ {
1401796
+ "Sid": "ActivateAdvancedDelegatedAdminAccess",
1401797
+ "Effect": "Allow",
1401798
+ "Action": [
1401799
+ "organizations:RegisterDelegatedAdministrator",
1401800
+ "organizations:ListDelegatedAdministrators"
1401801
+ ],
1401802
+ "Resource": "*",
1401803
+ "Condition": {
1401804
+ "StringEquals": {
1401805
+ "aws:CalledViaLast": "account.amazonaws.com",
1401806
+ "organizations:ServicePrincipal": [
1401807
+ "sso.amazonaws.com",
1401808
+ "account-access.amazonaws.com"
1401809
+ ]
1401810
+ }
1401811
+ }
1401812
+ },
1401813
+ {
1401814
+ "Sid": "ActivateAdvancedManagedRoleAccess",
1401815
+ "Effect": "Allow",
1401816
+ "Action": [
1401817
+ "iam:GetRole",
1401818
+ "iam:CreateRole",
1401819
+ "iam:AttachRolePolicy",
1401820
+ "iam:DeleteRole",
1401821
+ "iam:ListAttachedRolePolicies",
1401822
+ "iam:DetachRolePolicy",
1401823
+ "iam:ListRolePolicies",
1401824
+ "iam:DeleteRolePolicy"
1401825
+ ],
1401826
+ "Resource": [
1401827
+ "arn:aws:iam::*:role/managed/*",
1401828
+ "arn:aws:iam::*:role/ManagedAccountAdmin",
1401829
+ "arn:aws:iam::*:role/AccountFullAccessRole"
1401830
+ ],
1401831
+ "Condition": {
1401832
+ "StringEquals": {
1401833
+ "aws:CalledViaLast": "account.amazonaws.com"
1401834
+ }
1401835
+ }
1401836
+ },
1401837
+ {
1401838
+ "Sid": "ActivateAdvancedMemberAccountAssume",
1401839
+ "Effect": "Allow",
1401840
+ "Action": "sts:AssumeRole",
1401841
+ "Resource": "arn:aws:iam::*:role/managed/AWSManagedAdvancedFeaturesActivationRole",
1401842
+ "Condition": {
1401843
+ "StringEquals": {
1401844
+ "aws:CalledViaLast": "account.amazonaws.com"
1401845
+ }
1401846
+ }
1401847
+ },
1401848
+ {
1401849
+ "Sid": "ActivateAdvancedBudgetsAccess",
1401850
+ "Effect": "Allow",
1401851
+ "Action": "budgets:ModifyBudget",
1401852
+ "Resource": "arn:aws:budgets::*:budget/sla-*",
1401853
+ "Condition": {
1401854
+ "StringEquals": {
1401855
+ "aws:CalledViaLast": "account.amazonaws.com"
1401856
+ }
1401857
+ }
1401858
+ },
1401859
+ {
1401860
+ "Sid": "ActivateAdvancedSCPCleanupAccess",
1401861
+ "Effect": "Allow",
1401862
+ "Action": [
1401863
+ "organizations:DeletePolicy",
1401864
+ "organizations:DetachPolicy",
1401865
+ "organizations:ListPolicies",
1401866
+ "organizations:ListRoots"
1401867
+ ],
1401868
+ "Resource": "*",
1401869
+ "Condition": {
1401870
+ "StringEquals": {
1401871
+ "aws:CalledViaLast": "account.amazonaws.com"
1401872
+ }
1401873
+ }
1401874
+ }
1401875
+ ]
1401876
+ }
1400798
1401877
  }
1400799
1401878
  },
1400800
1401879
  "createdDate": "2026-07-22T01:27:25.000Z",
1400801
- "lastUpdatedDate": "2026-07-23T00:42:22.000Z"
1401880
+ "lastUpdatedDate": "2026-08-07T23:47:14.000Z"
1400802
1401881
  },
1400803
1401882
  "AmazonODBFullAccess": {
1400804
1401883
  "arn": "arn:aws:iam::aws:policy/AmazonODBFullAccess",
@@ -1403571,8 +1404650,8 @@
1403571
1404650
  },
1403572
1404651
  "BedrockAgentCoreRuntimeInstancesOperatorRolePolicy": {
1403573
1404652
  "arn": "arn:aws:iam::aws:policy/BedrockAgentCoreRuntimeInstancesOperatorRolePolicy",
1403574
- "latestVersionId": "v1",
1403575
- "versionsCount": 1,
1404653
+ "latestVersionId": "v2",
1404654
+ "versionsCount": 2,
1403576
1404655
  "versions": {
1403577
1404656
  "v1": {
1403578
1404657
  "createdDate": "2026-08-05T11:27:19.000Z",
@@ -1403876,10 +1404955,314 @@
1403876
1404955
  }
1403877
1404956
  ]
1403878
1404957
  }
1404958
+ },
1404959
+ "v2": {
1404960
+ "createdDate": "2026-08-05T11:27:19.000Z",
1404961
+ "document": {
1404962
+ "Version": "2012-10-17",
1404963
+ "Statement": [
1404964
+ {
1404965
+ "Sid": "DescribeComputeResources",
1404966
+ "Effect": "Allow",
1404967
+ "Action": [
1404968
+ "ec2:DescribeAvailabilityZones",
1404969
+ "ec2:DescribeCapacityReservations",
1404970
+ "ec2:DescribeInstances",
1404971
+ "ec2:DescribeInstanceStatus",
1404972
+ "ec2:DescribeInstanceTypeOfferings",
1404973
+ "ec2:DescribeInstanceTypes",
1404974
+ "ec2:DescribeSecurityGroups",
1404975
+ "ec2:DescribeSubnets",
1404976
+ "ec2:DescribeVolumes",
1404977
+ "ec2:DescribeLaunchTemplateVersions",
1404978
+ "ec2:DescribeNetworkInterfaces",
1404979
+ "autoscaling:DescribeAutoScalingInstances",
1404980
+ "autoscaling:DescribeAutoScalingGroups"
1404981
+ ],
1404982
+ "Resource": "*"
1404983
+ },
1404984
+ {
1404985
+ "Sid": "DescribeEventBridgeRule",
1404986
+ "Effect": "Allow",
1404987
+ "Action": [
1404988
+ "events:DescribeRule"
1404989
+ ],
1404990
+ "Resource": "arn:*:events:*:*:rule/agentcore-lifecycle-events-*"
1404991
+ },
1404992
+ {
1404993
+ "Sid": "CreateVolumeForManagedInstances",
1404994
+ "Effect": "Allow",
1404995
+ "Action": [
1404996
+ "ec2:CreateVolume"
1404997
+ ],
1404998
+ "Resource": [
1404999
+ "arn:aws:ec2:*:*:volume/*"
1405000
+ ],
1405001
+ "Condition": {
1405002
+ "Null": {
1405003
+ "aws:RequestTag/bedrock-agentcore:capacity-provider-id": "false"
1405004
+ }
1405005
+ }
1405006
+ },
1405007
+ {
1405008
+ "Sid": "AttachVolumeForManagedInstances",
1405009
+ "Effect": "Allow",
1405010
+ "Action": [
1405011
+ "ec2:AttachVolume"
1405012
+ ],
1405013
+ "Resource": [
1405014
+ "arn:aws:ec2:*:*:volume/*",
1405015
+ "arn:aws:ec2:*:*:instance/*"
1405016
+ ],
1405017
+ "Condition": {
1405018
+ "StringEquals": {
1405019
+ "ec2:ManagedResourceOperator": "bedrock-agentcore.amazonaws.com"
1405020
+ }
1405021
+ }
1405022
+ },
1405023
+ {
1405024
+ "Sid": "CreateLaunchTemplateForManagedInstances",
1405025
+ "Effect": "Allow",
1405026
+ "Action": [
1405027
+ "ec2:CreateLaunchTemplate"
1405028
+ ],
1405029
+ "Resource": [
1405030
+ "arn:aws:ec2:*:*:launch-template/*"
1405031
+ ],
1405032
+ "Condition": {
1405033
+ "Null": {
1405034
+ "aws:RequestTag/bedrock-agentcore:capacity-provider-id": "false"
1405035
+ }
1405036
+ }
1405037
+ },
1405038
+ {
1405039
+ "Sid": "ModifyLaunchTemplateForManagedInstances",
1405040
+ "Effect": "Allow",
1405041
+ "Action": [
1405042
+ "ec2:CreateLaunchTemplateVersion",
1405043
+ "ec2:ModifyLaunchTemplate"
1405044
+ ],
1405045
+ "Resource": [
1405046
+ "arn:aws:ec2:*:*:launch-template/*"
1405047
+ ],
1405048
+ "Condition": {
1405049
+ "StringEquals": {
1405050
+ "ec2:ManagedResourceOperator": "bedrock-agentcore.amazonaws.com"
1405051
+ }
1405052
+ }
1405053
+ },
1405054
+ {
1405055
+ "Sid": "CreateAutoScalingForManagedInstances",
1405056
+ "Effect": "Allow",
1405057
+ "Action": [
1405058
+ "autoscaling:CreateAutoScalingGroup"
1405059
+ ],
1405060
+ "Resource": "arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/agentcore-managed-instances-*",
1405061
+ "Condition": {
1405062
+ "Null": {
1405063
+ "aws:RequestTag/bedrock-agentcore:capacity-provider-id": "false"
1405064
+ }
1405065
+ }
1405066
+ },
1405067
+ {
1405068
+ "Sid": "UpdateAndLaunchAutoScaling",
1405069
+ "Effect": "Allow",
1405070
+ "Action": [
1405071
+ "autoscaling:UpdateAutoScalingGroup",
1405072
+ "autoscaling:PutLifecycleHook",
1405073
+ "autoscaling:CompleteLifecycleAction",
1405074
+ "autoscaling:LaunchInstances"
1405075
+ ],
1405076
+ "Resource": "arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/agentcore-managed-instances-*",
1405077
+ "Condition": {
1405078
+ "Null": {
1405079
+ "aws:ResourceTag/bedrock-agentcore:capacity-provider-id": "false"
1405080
+ }
1405081
+ }
1405082
+ },
1405083
+ {
1405084
+ "Sid": "NetworkingAccessForManagedInstances",
1405085
+ "Effect": "Allow",
1405086
+ "Action": [
1405087
+ "ec2:RunInstances",
1405088
+ "ec2:CreateNetworkInterface",
1405089
+ "ec2:CreateFleet"
1405090
+ ],
1405091
+ "Resource": [
1405092
+ "arn:aws:ec2:*:*:subnet/*",
1405093
+ "arn:aws:ec2:*:*:security-group/*"
1405094
+ ]
1405095
+ },
1405096
+ {
1405097
+ "Sid": "AmazonAMIsAccessForManagedInstances",
1405098
+ "Effect": "Allow",
1405099
+ "Action": [
1405100
+ "ec2:RunInstances",
1405101
+ "ec2:CreateFleet"
1405102
+ ],
1405103
+ "Resource": [
1405104
+ "arn:aws:ec2:*:*:image/*"
1405105
+ ],
1405106
+ "Condition": {
1405107
+ "StringEquals": {
1405108
+ "ec2:Owner": "amazon"
1405109
+ }
1405110
+ }
1405111
+ },
1405112
+ {
1405113
+ "Sid": "CreateFleetAccess",
1405114
+ "Effect": "Allow",
1405115
+ "Action": [
1405116
+ "ec2:CreateFleet"
1405117
+ ],
1405118
+ "Resource": [
1405119
+ "arn:aws:ec2:*:*:fleet/*"
1405120
+ ]
1405121
+ },
1405122
+ {
1405123
+ "Sid": "LaunchWithManagedLaunchTemplate",
1405124
+ "Effect": "Allow",
1405125
+ "Action": [
1405126
+ "ec2:CreateFleet",
1405127
+ "ec2:RunInstances"
1405128
+ ],
1405129
+ "Resource": [
1405130
+ "arn:aws:ec2:*:*:launch-template/*"
1405131
+ ],
1405132
+ "Condition": {
1405133
+ "Null": {
1405134
+ "aws:ResourceTag/bedrock-agentcore:capacity-provider-id": "false"
1405135
+ }
1405136
+ }
1405137
+ },
1405138
+ {
1405139
+ "Sid": "ProvisionEC2InstancesForManagedInstances",
1405140
+ "Effect": "Allow",
1405141
+ "Action": [
1405142
+ "ec2:CreateFleet",
1405143
+ "ec2:RunInstances"
1405144
+ ],
1405145
+ "Resource": [
1405146
+ "arn:aws:ec2:*:*:instance/*",
1405147
+ "arn:aws:ec2:*:*:network-interface/*",
1405148
+ "arn:aws:ec2:*:*:volume/*"
1405149
+ ],
1405150
+ "Condition": {
1405151
+ "Null": {
1405152
+ "aws:RequestTag/bedrock-agentcore:capacity-provider-id": "false"
1405153
+ }
1405154
+ }
1405155
+ },
1405156
+ {
1405157
+ "Sid": "TagOnCreateManagedResources",
1405158
+ "Effect": "Allow",
1405159
+ "Action": [
1405160
+ "ec2:CreateTags"
1405161
+ ],
1405162
+ "Resource": [
1405163
+ "arn:aws:ec2:*:*:fleet/*",
1405164
+ "arn:aws:ec2:*:*:instance/*",
1405165
+ "arn:aws:ec2:*:*:network-interface/*",
1405166
+ "arn:aws:ec2:*:*:volume/*",
1405167
+ "arn:aws:ec2:*:*:launch-template/*"
1405168
+ ],
1405169
+ "Condition": {
1405170
+ "StringEquals": {
1405171
+ "ec2:CreateAction": [
1405172
+ "CreateFleet",
1405173
+ "CreateLaunchTemplate",
1405174
+ "RunInstances",
1405175
+ "CreateVolume",
1405176
+ "CreateNetworkInterface"
1405177
+ ]
1405178
+ }
1405179
+ }
1405180
+ },
1405181
+ {
1405182
+ "Sid": "TagAfterCreateManagedResources",
1405183
+ "Effect": "Allow",
1405184
+ "Action": [
1405185
+ "ec2:CreateTags"
1405186
+ ],
1405187
+ "Resource": [
1405188
+ "arn:aws:ec2:*:*:fleet/*",
1405189
+ "arn:aws:ec2:*:*:instance/*",
1405190
+ "arn:aws:ec2:*:*:network-interface/*",
1405191
+ "arn:aws:ec2:*:*:volume/*",
1405192
+ "arn:aws:ec2:*:*:launch-template/*"
1405193
+ ],
1405194
+ "Condition": {
1405195
+ "StringEquals": {
1405196
+ "ec2:ManagedResourceOperator": "bedrock-agentcore.amazonaws.com"
1405197
+ },
1405198
+ "ForAllValues:StringLike": {
1405199
+ "aws:TagKeys": "bedrock-agentcore:*"
1405200
+ }
1405201
+ }
1405202
+ },
1405203
+ {
1405204
+ "Sid": "AttachNetworkInterfaceToManagedInstance",
1405205
+ "Effect": "Allow",
1405206
+ "Action": [
1405207
+ "ec2:AttachNetworkInterface"
1405208
+ ],
1405209
+ "Resource": [
1405210
+ "arn:aws:ec2:*:*:instance/*",
1405211
+ "arn:aws:ec2:*:*:network-interface/*"
1405212
+ ],
1405213
+ "Condition": {
1405214
+ "StringEquals": {
1405215
+ "ec2:ManagedResourceOperator": "bedrock-agentcore.amazonaws.com"
1405216
+ }
1405217
+ }
1405218
+ },
1405219
+ {
1405220
+ "Sid": "EventBridgeAccessForManagedRule",
1405221
+ "Effect": "Allow",
1405222
+ "Action": [
1405223
+ "events:PutRule",
1405224
+ "events:PutTargets",
1405225
+ "events:RemoveTargets"
1405226
+ ],
1405227
+ "Resource": "arn:*:events:*:*:rule/agentcore-lifecycle-events-*",
1405228
+ "Condition": {
1405229
+ "StringEquals": {
1405230
+ "events:ManagedBy": "bedrock-agentcore.amazonaws.com"
1405231
+ }
1405232
+ }
1405233
+ },
1405234
+ {
1405235
+ "Sid": "ServiceLinkedRoleAccessForAutoScaling",
1405236
+ "Effect": "Allow",
1405237
+ "Action": [
1405238
+ "iam:CreateServiceLinkedRole"
1405239
+ ],
1405240
+ "Resource": [
1405241
+ "arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
1405242
+ ]
1405243
+ },
1405244
+ {
1405245
+ "Sid": "PassRoleToManagedInstances",
1405246
+ "Effect": "Allow",
1405247
+ "Action": [
1405248
+ "iam:PassRole"
1405249
+ ],
1405250
+ "Resource": [
1405251
+ "arn:aws:iam::*:role/AmazonBedrockAgentCoreCapacityProviderDefaultInstanceRole*",
1405252
+ "arn:aws:iam::*:role/service-role/AmazonBedrockAgentCoreCapacityProviderDefaultInstanceRole*"
1405253
+ ],
1405254
+ "Condition": {
1405255
+ "StringLike": {
1405256
+ "iam:PassedToService": "ec2.*"
1405257
+ }
1405258
+ }
1405259
+ }
1405260
+ ]
1405261
+ }
1403879
1405262
  }
1403880
1405263
  },
1403881
1405264
  "createdDate": "2026-08-05T11:27:19.000Z",
1403882
- "lastUpdatedDate": "2026-08-05T11:27:19.000Z"
1405265
+ "lastUpdatedDate": "2026-08-06T10:12:23.000Z"
1403883
1405266
  },
1403884
1405267
  "BedrockAgentCoreRuntimeInstancesInstanceRolePolicy": {
1403885
1405268
  "arn": "arn:aws:iam::aws:policy/BedrockAgentCoreRuntimeInstancesInstanceRolePolicy",
@@ -1403940,5 +1405323,3018 @@
1403940
1405323
  },
1403941
1405324
  "createdDate": "2026-08-05T16:27:17.000Z",
1403942
1405325
  "lastUpdatedDate": "2026-08-05T16:27:17.000Z"
1405326
+ },
1405327
+ "AWSAgentRegistryServiceRolePolicy": {
1405328
+ "arn": "arn:aws:iam::aws:policy/aws-service-role/AWSAgentRegistryServiceRolePolicy",
1405329
+ "latestVersionId": "v1",
1405330
+ "versionsCount": 1,
1405331
+ "versions": {
1405332
+ "v1": {
1405333
+ "createdDate": "2026-08-06T14:27:17.000Z",
1405334
+ "document": {
1405335
+ "Version": "2012-10-17",
1405336
+ "Statement": [
1405337
+ {
1405338
+ "Sid": "AllowPublishCloudWatchMetrics",
1405339
+ "Effect": "Allow",
1405340
+ "Action": [
1405341
+ "cloudwatch:PutMetricData"
1405342
+ ],
1405343
+ "Resource": "*",
1405344
+ "Condition": {
1405345
+ "StringEquals": {
1405346
+ "cloudwatch:namespace": [
1405347
+ "AWS/AgentRegistry",
1405348
+ "AWS/Usage"
1405349
+ ],
1405350
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405351
+ }
1405352
+ }
1405353
+ }
1405354
+ ]
1405355
+ }
1405356
+ }
1405357
+ },
1405358
+ "createdDate": "2026-08-06T14:27:17.000Z",
1405359
+ "lastUpdatedDate": "2026-08-06T14:27:17.000Z"
1405360
+ },
1405361
+ "AWSTransformLandingZoneAgentPolicy": {
1405362
+ "arn": "arn:aws:iam::aws:policy/AWSTransformLandingZoneAgentPolicy",
1405363
+ "latestVersionId": "v1",
1405364
+ "versionsCount": 1,
1405365
+ "versions": {
1405366
+ "v1": {
1405367
+ "createdDate": "2026-08-06T15:12:26.000Z",
1405368
+ "document": {
1405369
+ "Version": "2012-10-17",
1405370
+ "Statement": [
1405371
+ {
1405372
+ "Sid": "S3LandingZoneBucketAndObjectOperations",
1405373
+ "Effect": "Allow",
1405374
+ "Action": [
1405375
+ "s3:AbortMultipartUpload",
1405376
+ "s3:CreateBucket",
1405377
+ "s3:DeleteObject",
1405378
+ "s3:GetBucketLocation",
1405379
+ "s3:GetBucketPublicAccessBlock",
1405380
+ "s3:GetBucketTagging",
1405381
+ "s3:GetObject",
1405382
+ "s3:GetObjectAttributes",
1405383
+ "s3:GetObjectVersion",
1405384
+ "s3:ListBucket",
1405385
+ "s3:ListBucketMultipartUploads",
1405386
+ "s3:ListMultipartUploadParts",
1405387
+ "s3:PutBucketTagging",
1405388
+ "s3:PutEncryptionConfiguration",
1405389
+ "s3:PutObject"
1405390
+ ],
1405391
+ "Resource": "arn:aws:s3:::transform-vmware-landing-zone-*",
1405392
+ "Condition": {
1405393
+ "StringEquals": {
1405394
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405395
+ }
1405396
+ }
1405397
+ },
1405398
+ {
1405399
+ "Sid": "CfnLandingZoneStackCreate",
1405400
+ "Effect": "Allow",
1405401
+ "Action": [
1405402
+ "cloudformation:CreateStack",
1405403
+ "cloudformation:TagResource"
1405404
+ ],
1405405
+ "Resource": "arn:aws:cloudformation:*:*:stack/AtxLz*",
1405406
+ "Condition": {
1405407
+ "StringEquals": {
1405408
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1405409
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405410
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405411
+ }
1405412
+ }
1405413
+ },
1405414
+ {
1405415
+ "Sid": "CfnLandingZoneStackUpdate",
1405416
+ "Effect": "Allow",
1405417
+ "Action": [
1405418
+ "cloudformation:UpdateStack"
1405419
+ ],
1405420
+ "Resource": "arn:aws:cloudformation:*:*:stack/AtxLz*",
1405421
+ "Condition": {
1405422
+ "StringEquals": {
1405423
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1405424
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405425
+ "aws:ResourceTag/CreatedBy": "AWSTransform",
1405426
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405427
+ }
1405428
+ }
1405429
+ },
1405430
+ {
1405431
+ "Sid": "CfnLandingZoneStackOperationsAndChangeSets",
1405432
+ "Effect": "Allow",
1405433
+ "Action": [
1405434
+ "cloudformation:CreateChangeSet",
1405435
+ "cloudformation:DescribeChangeSet",
1405436
+ "cloudformation:DescribeStackEvents",
1405437
+ "cloudformation:DescribeStacks",
1405438
+ "cloudformation:ExecuteChangeSet",
1405439
+ "cloudformation:GetTemplate",
1405440
+ "cloudformation:ListChangeSets"
1405441
+ ],
1405442
+ "Resource": "arn:aws:cloudformation:*:*:stack/AtxLz*",
1405443
+ "Condition": {
1405444
+ "StringEquals": {
1405445
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405446
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405447
+ }
1405448
+ }
1405449
+ },
1405450
+ {
1405451
+ "Sid": "ControlTowerAndOrganizationsOperationsReadOnly",
1405452
+ "Effect": "Allow",
1405453
+ "Action": [
1405454
+ "controltower:GetBaselineOperation",
1405455
+ "controltower:GetControlOperation",
1405456
+ "controltower:ListBaselines",
1405457
+ "controltower:ListEnabledBaselines",
1405458
+ "controltower:ListEnabledControls",
1405459
+ "controltower:ListLandingZones",
1405460
+ "organizations:DescribeCreateAccountStatus",
1405461
+ "organizations:DescribeOrganization",
1405462
+ "organizations:ListPolicies",
1405463
+ "organizations:ListRoots"
1405464
+ ],
1405465
+ "Resource": "*"
1405466
+ },
1405467
+ {
1405468
+ "Sid": "ControlTowerResourceOperationsReadOnly",
1405469
+ "Effect": "Allow",
1405470
+ "Action": [
1405471
+ "controltower:GetEnabledBaseline",
1405472
+ "controltower:GetEnabledControl",
1405473
+ "controltower:GetLandingZone",
1405474
+ "controltower:ListTagsForResource"
1405475
+ ],
1405476
+ "Resource": [
1405477
+ "arn:aws:controltower:*:*:enabledbaseline/*",
1405478
+ "arn:aws:controltower:*:*:enabledcontrol/*",
1405479
+ "arn:aws:controltower:*:*:landingzone/*"
1405480
+ ],
1405481
+ "Condition": {
1405482
+ "StringEquals": {
1405483
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405484
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405485
+ }
1405486
+ }
1405487
+ },
1405488
+ {
1405489
+ "Sid": "ControlTowerBaselineOperationsReadOnly",
1405490
+ "Effect": "Allow",
1405491
+ "Action": [
1405492
+ "controltower:GetBaseline"
1405493
+ ],
1405494
+ "Resource": "arn:aws:controltower:*::baseline/*",
1405495
+ "Condition": {
1405496
+ "StringEquals": {
1405497
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1405498
+ }
1405499
+ }
1405500
+ },
1405501
+ {
1405502
+ "Sid": "ControlTowerEnableControlWithRequestTag",
1405503
+ "Effect": "Allow",
1405504
+ "Action": [
1405505
+ "controltower:EnableControl"
1405506
+ ],
1405507
+ "Resource": "arn:aws:controltower:*:*:enabledcontrol/*",
1405508
+ "Condition": {
1405509
+ "StringEquals": {
1405510
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1405511
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1405512
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405513
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405514
+ }
1405515
+ }
1405516
+ },
1405517
+ {
1405518
+ "Sid": "ControlTowerEnableBaselineAndOrganizationsAccountCreate",
1405519
+ "Effect": "Allow",
1405520
+ "Action": [
1405521
+ "controltower:EnableBaseline",
1405522
+ "controltower:TagResource",
1405523
+ "organizations:CreateAccount"
1405524
+ ],
1405525
+ "Resource": "*",
1405526
+ "Condition": {
1405527
+ "StringEquals": {
1405528
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1405529
+ "aws:RequestTag/CreatedBy": "AWSTransform"
1405530
+ }
1405531
+ }
1405532
+ },
1405533
+ {
1405534
+ "Sid": "OrganizationsTagAndCreateOrganizationalUnit",
1405535
+ "Effect": "Allow",
1405536
+ "Action": [
1405537
+ "organizations:CreateOrganizationalUnit",
1405538
+ "organizations:TagResource"
1405539
+ ],
1405540
+ "Resource": [
1405541
+ "arn:aws:organizations::*:account/o-*/*",
1405542
+ "arn:aws:organizations::*:ou/o-*/*",
1405543
+ "arn:aws:organizations::*:policy/o-*/*",
1405544
+ "arn:aws:organizations::*:root/o-*/*"
1405545
+ ],
1405546
+ "Condition": {
1405547
+ "StringEquals": {
1405548
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1405549
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1405550
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405551
+ }
1405552
+ }
1405553
+ },
1405554
+ {
1405555
+ "Sid": "OrganizationsResourceDescribeReadOnly",
1405556
+ "Effect": "Allow",
1405557
+ "Action": [
1405558
+ "organizations:DescribeAccount",
1405559
+ "organizations:DescribeOrganizationalUnit",
1405560
+ "organizations:DescribePolicy"
1405561
+ ],
1405562
+ "Resource": [
1405563
+ "arn:aws:organizations::*:account/*",
1405564
+ "arn:aws:organizations::*:ou/*",
1405565
+ "arn:aws:organizations::*:policy/*"
1405566
+ ],
1405567
+ "Condition": {
1405568
+ "StringEquals": {
1405569
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405570
+ }
1405571
+ }
1405572
+ },
1405573
+ {
1405574
+ "Sid": "OrganizationsPolicyUpdateViaControlTower",
1405575
+ "Effect": "Allow",
1405576
+ "Action": [
1405577
+ "organizations:UpdatePolicy"
1405578
+ ],
1405579
+ "Resource": "arn:aws:organizations::*:policy/*",
1405580
+ "Condition": {
1405581
+ "ForAnyValue:StringEquals": {
1405582
+ "aws:CalledVia": "controltower.amazonaws.com"
1405583
+ },
1405584
+ "StringEquals": {
1405585
+ "organizations:PolicyType": "SERVICE_CONTROL_POLICY",
1405586
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405587
+ }
1405588
+ }
1405589
+ },
1405590
+ {
1405591
+ "Sid": "OrganizationsHierarchyOperationsReadOnly",
1405592
+ "Effect": "Allow",
1405593
+ "Action": [
1405594
+ "organizations:ListAccountsForParent",
1405595
+ "organizations:ListOrganizationalUnitsForParent",
1405596
+ "organizations:ListParents"
1405597
+ ],
1405598
+ "Resource": [
1405599
+ "arn:aws:organizations::*:account/*",
1405600
+ "arn:aws:organizations::*:ou/*",
1405601
+ "arn:aws:organizations::*:root/*"
1405602
+ ],
1405603
+ "Condition": {
1405604
+ "StringEquals": {
1405605
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405606
+ }
1405607
+ }
1405608
+ },
1405609
+ {
1405610
+ "Sid": "OrganizationsMoveAccountWithResourceTag",
1405611
+ "Effect": "Allow",
1405612
+ "Action": [
1405613
+ "organizations:MoveAccount"
1405614
+ ],
1405615
+ "Resource": [
1405616
+ "arn:aws:organizations::*:account/*",
1405617
+ "arn:aws:organizations::*:ou/*",
1405618
+ "arn:aws:organizations::*:root/*"
1405619
+ ],
1405620
+ "Condition": {
1405621
+ "StringEquals": {
1405622
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1405623
+ "aws:ResourceTag/CreatedBy": "AWSTransform",
1405624
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405625
+ }
1405626
+ }
1405627
+ },
1405628
+ {
1405629
+ "Sid": "OrganizationsListTagsForResource",
1405630
+ "Effect": "Allow",
1405631
+ "Action": [
1405632
+ "organizations:ListTagsForResource"
1405633
+ ],
1405634
+ "Resource": [
1405635
+ "arn:aws:organizations::*:account/o-*/*",
1405636
+ "arn:aws:organizations::*:ou/o-*/*",
1405637
+ "arn:aws:organizations::*:policy/o-*/*",
1405638
+ "arn:aws:organizations::*:root/o-*/*"
1405639
+ ],
1405640
+ "Condition": {
1405641
+ "StringEquals": {
1405642
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405643
+ }
1405644
+ }
1405645
+ },
1405646
+ {
1405647
+ "Sid": "OrganizationsServiceControlPolicyCreateViaControlTower",
1405648
+ "Effect": "Allow",
1405649
+ "Action": [
1405650
+ "organizations:CreatePolicy"
1405651
+ ],
1405652
+ "Resource": "*",
1405653
+ "Condition": {
1405654
+ "ForAnyValue:StringEquals": {
1405655
+ "aws:CalledVia": "controltower.amazonaws.com"
1405656
+ },
1405657
+ "StringEquals": {
1405658
+ "organizations:PolicyType": "SERVICE_CONTROL_POLICY"
1405659
+ }
1405660
+ }
1405661
+ },
1405662
+ {
1405663
+ "Sid": "OrganizationsServiceControlPolicyAttachViaControlTower",
1405664
+ "Effect": "Allow",
1405665
+ "Action": [
1405666
+ "organizations:AttachPolicy"
1405667
+ ],
1405668
+ "Resource": [
1405669
+ "arn:aws:organizations::*:account/o-*/*",
1405670
+ "arn:aws:organizations::*:ou/o-*/*",
1405671
+ "arn:aws:organizations::*:policy/o-*/*",
1405672
+ "arn:aws:organizations::*:root/o-*/*"
1405673
+ ],
1405674
+ "Condition": {
1405675
+ "ForAnyValue:StringEquals": {
1405676
+ "aws:CalledVia": "controltower.amazonaws.com"
1405677
+ },
1405678
+ "StringEquals": {
1405679
+ "organizations:PolicyType": "SERVICE_CONTROL_POLICY",
1405680
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405681
+ }
1405682
+ }
1405683
+ },
1405684
+ {
1405685
+ "Sid": "ServiceCatalogProvisioningArtifactOperations",
1405686
+ "Effect": "Allow",
1405687
+ "Action": [
1405688
+ "servicecatalog:CreateProvisioningArtifact",
1405689
+ "servicecatalog:DeleteProvisioningArtifact",
1405690
+ "servicecatalog:ListProvisioningArtifacts",
1405691
+ "servicecatalog:UpdateProvisioningArtifact"
1405692
+ ],
1405693
+ "Resource": "arn:aws:catalog:*:*:product/*",
1405694
+ "Condition": {
1405695
+ "StringEquals": {
1405696
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405697
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405698
+ }
1405699
+ }
1405700
+ }
1405701
+ ]
1405702
+ }
1405703
+ }
1405704
+ },
1405705
+ "createdDate": "2026-08-06T15:12:26.000Z",
1405706
+ "lastUpdatedDate": "2026-08-06T15:12:26.000Z"
1405707
+ },
1405708
+ "AWSTransformServerMigrationAgentPolicy": {
1405709
+ "arn": "arn:aws:iam::aws:policy/AWSTransformServerMigrationAgentPolicy",
1405710
+ "latestVersionId": "v1",
1405711
+ "versionsCount": 1,
1405712
+ "versions": {
1405713
+ "v1": {
1405714
+ "createdDate": "2026-08-06T15:27:14.000Z",
1405715
+ "document": {
1405716
+ "Version": "2012-10-17",
1405717
+ "Statement": [
1405718
+ {
1405719
+ "Sid": "Ec2LaunchTemplateOperationsWrite",
1405720
+ "Effect": "Allow",
1405721
+ "Action": [
1405722
+ "ec2:CreateLaunchTemplateVersion",
1405723
+ "ec2:ModifyLaunchTemplate"
1405724
+ ],
1405725
+ "Resource": "*",
1405726
+ "Condition": {
1405727
+ "Null": {
1405728
+ "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
1405729
+ },
1405730
+ "StringEquals": {
1405731
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1405732
+ }
1405733
+ }
1405734
+ },
1405735
+ {
1405736
+ "Sid": "Ec2OperationsReadOnly",
1405737
+ "Effect": "Allow",
1405738
+ "Action": [
1405739
+ "ec2:DescribeVpcs",
1405740
+ "ec2:DescribeSubnets",
1405741
+ "ec2:DescribeInstanceTypes",
1405742
+ "ec2:DescribeSecurityGroups",
1405743
+ "ec2:DescribeLaunchTemplateVersions"
1405744
+ ],
1405745
+ "Resource": "*",
1405746
+ "Condition": {
1405747
+ "StringEquals": {
1405748
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1405749
+ }
1405750
+ }
1405751
+ },
1405752
+ {
1405753
+ "Sid": "Ec2TagOnCreateServerMigration",
1405754
+ "Effect": "Allow",
1405755
+ "Action": [
1405756
+ "ec2:CreateTags"
1405757
+ ],
1405758
+ "Resource": [
1405759
+ "arn:aws:ec2:*:*:launch-template/*",
1405760
+ "arn:aws:ec2:*:*:security-group/*",
1405761
+ "arn:aws:ec2:*:*:security-group-rule/*"
1405762
+ ],
1405763
+ "Condition": {
1405764
+ "StringEquals": {
1405765
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1405766
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405767
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1405768
+ "ec2:CreateAction": [
1405769
+ "CreateLaunchTemplate",
1405770
+ "CreateSecurityGroup"
1405771
+ ]
1405772
+ }
1405773
+ }
1405774
+ },
1405775
+ {
1405776
+ "Sid": "Ec2ViaMgnInstanceLifecycleOperationsWrite",
1405777
+ "Effect": "Allow",
1405778
+ "Action": [
1405779
+ "ec2:AttachVolume",
1405780
+ "ec2:AuthorizeSecurityGroupEgress",
1405781
+ "ec2:CreateSnapshot",
1405782
+ "ec2:DeleteLaunchTemplateVersions",
1405783
+ "ec2:DeleteVolume",
1405784
+ "ec2:DetachVolume",
1405785
+ "ec2:ModifyInstanceAttribute",
1405786
+ "ec2:RevokeSecurityGroupEgress",
1405787
+ "ec2:RunInstances",
1405788
+ "ec2:StartInstances",
1405789
+ "ec2:StopInstances",
1405790
+ "ec2:TerminateInstances"
1405791
+ ],
1405792
+ "Resource": [
1405793
+ "arn:aws:ec2:*:*:instance/*",
1405794
+ "arn:aws:ec2:*:*:launch-template/*",
1405795
+ "arn:aws:ec2:*:*:security-group/*",
1405796
+ "arn:aws:ec2:*:*:volume/*"
1405797
+ ],
1405798
+ "Condition": {
1405799
+ "ForAnyValue:StringEquals": {
1405800
+ "aws:CalledVia": [
1405801
+ "mgn.amazonaws.com"
1405802
+ ]
1405803
+ },
1405804
+ "StringEquals": {
1405805
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405806
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1405807
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1405808
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1405809
+ }
1405810
+ }
1405811
+ },
1405812
+ {
1405813
+ "Sid": "Ec2ViaMgnInstanceProvisionCreateWithRequestTag",
1405814
+ "Effect": "Allow",
1405815
+ "Action": [
1405816
+ "ec2:CreateSecurityGroup",
1405817
+ "ec2:CreateSnapshot",
1405818
+ "ec2:CreateVolume",
1405819
+ "ec2:RunInstances"
1405820
+ ],
1405821
+ "Resource": [
1405822
+ "arn:aws:ec2:*:*:instance/*",
1405823
+ "arn:aws:ec2:*:*:network-interface/*",
1405824
+ "arn:aws:ec2:*:*:security-group/*",
1405825
+ "arn:aws:ec2:*:*:volume/*",
1405826
+ "arn:aws:ec2:*::snapshot/*"
1405827
+ ],
1405828
+ "Condition": {
1405829
+ "ForAnyValue:StringEquals": {
1405830
+ "aws:CalledVia": [
1405831
+ "mgn.amazonaws.com"
1405832
+ ]
1405833
+ },
1405834
+ "StringEquals": {
1405835
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1405836
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1405837
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405838
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405839
+ }
1405840
+ }
1405841
+ },
1405842
+ {
1405843
+ "Sid": "Ec2ViaMgnLaunchOnWorkspaceVpc",
1405844
+ "Effect": "Allow",
1405845
+ "Action": [
1405846
+ "ec2:CreateSecurityGroup",
1405847
+ "ec2:RunInstances"
1405848
+ ],
1405849
+ "Resource": [
1405850
+ "arn:aws:ec2:*:*:subnet/*",
1405851
+ "arn:aws:ec2:*:*:network-interface/*",
1405852
+ "arn:aws:ec2:*:*:vpc/*"
1405853
+ ],
1405854
+ "Condition": {
1405855
+ "ForAnyValue:StringEquals": {
1405856
+ "aws:CalledVia": [
1405857
+ "mgn.amazonaws.com"
1405858
+ ]
1405859
+ },
1405860
+ "StringEquals": {
1405861
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405862
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1405863
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1405864
+ "aws:ResourceTag/CreatedFor": "AWSTransform"
1405865
+ }
1405866
+ }
1405867
+ },
1405868
+ {
1405869
+ "Sid": "Ec2ViaMgnOperationsReadOnly",
1405870
+ "Effect": "Allow",
1405871
+ "Action": [
1405872
+ "ec2:DescribeAccountAttributes",
1405873
+ "ec2:DescribeAvailabilityZones",
1405874
+ "ec2:DescribeImages",
1405875
+ "ec2:DescribeInstanceStatus",
1405876
+ "ec2:DescribeInstances",
1405877
+ "ec2:DescribeLaunchTemplates",
1405878
+ "ec2:DescribeSnapshots",
1405879
+ "ec2:DescribeSubnets",
1405880
+ "ec2:GetSubnetCidrReservations",
1405881
+ "ec2:DescribeVolumes",
1405882
+ "ec2:GetEbsEncryptionByDefault",
1405883
+ "ec2:GetEbsDefaultKmsKeyId"
1405884
+ ],
1405885
+ "Resource": "*",
1405886
+ "Condition": {
1405887
+ "ForAnyValue:StringEquals": {
1405888
+ "aws:CalledVia": [
1405889
+ "mgn.amazonaws.com"
1405890
+ ]
1405891
+ },
1405892
+ "StringEquals": {
1405893
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1405894
+ }
1405895
+ }
1405896
+ },
1405897
+ {
1405898
+ "Sid": "Ec2ViaMgnRunInstancesOnAmsSubnet",
1405899
+ "Effect": "Allow",
1405900
+ "Action": [
1405901
+ "ec2:RunInstances"
1405902
+ ],
1405903
+ "Resource": [
1405904
+ "arn:aws:ec2:*:*:subnet/*",
1405905
+ "arn:aws:ec2:*:*:network-interface/*"
1405906
+ ],
1405907
+ "Condition": {
1405908
+ "ForAnyValue:StringEquals": {
1405909
+ "aws:CalledVia": [
1405910
+ "mgn.amazonaws.com"
1405911
+ ]
1405912
+ },
1405913
+ "StringEquals": {
1405914
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405915
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1405916
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1405917
+ }
1405918
+ }
1405919
+ },
1405920
+ {
1405921
+ "Sid": "Ec2ViaMgnRunInstancesOnImage",
1405922
+ "Effect": "Allow",
1405923
+ "Action": [
1405924
+ "ec2:RunInstances"
1405925
+ ],
1405926
+ "Resource": "arn:aws:ec2:*::image/*",
1405927
+ "Condition": {
1405928
+ "ForAnyValue:StringEquals": {
1405929
+ "aws:CalledVia": [
1405930
+ "mgn.amazonaws.com"
1405931
+ ]
1405932
+ },
1405933
+ "StringEquals": {
1405934
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1405935
+ }
1405936
+ }
1405937
+ },
1405938
+ {
1405939
+ "Sid": "Ec2ViaMgnRunInstancesOnSg",
1405940
+ "Effect": "Allow",
1405941
+ "Action": [
1405942
+ "ec2:RunInstances"
1405943
+ ],
1405944
+ "Resource": "arn:aws:ec2:*:*:security-group/*",
1405945
+ "Condition": {
1405946
+ "ForAnyValue:StringEquals": {
1405947
+ "aws:CalledVia": [
1405948
+ "mgn.amazonaws.com"
1405949
+ ]
1405950
+ },
1405951
+ "StringEquals": {
1405952
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405953
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405954
+ }
1405955
+ }
1405956
+ },
1405957
+ {
1405958
+ "Sid": "Ec2ViaMgnSecurityGroupCreate",
1405959
+ "Effect": "Allow",
1405960
+ "Action": [
1405961
+ "ec2:CreateSecurityGroup"
1405962
+ ],
1405963
+ "Resource": "arn:aws:ec2:*:*:security-group/*",
1405964
+ "Condition": {
1405965
+ "ForAnyValue:StringEquals": {
1405966
+ "aws:CalledVia": [
1405967
+ "mgn.amazonaws.com"
1405968
+ ]
1405969
+ },
1405970
+ "Null": {
1405971
+ "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
1405972
+ },
1405973
+ "StringEquals": {
1405974
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405975
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1405976
+ }
1405977
+ }
1405978
+ },
1405979
+ {
1405980
+ "Sid": "Ec2ViaMgnTagOnCreateSecurityGroup",
1405981
+ "Effect": "Allow",
1405982
+ "Action": [
1405983
+ "ec2:CreateTags"
1405984
+ ],
1405985
+ "Resource": "arn:aws:ec2:*:*:security-group/*",
1405986
+ "Condition": {
1405987
+ "ForAnyValue:StringEquals": {
1405988
+ "aws:CalledVia": [
1405989
+ "mgn.amazonaws.com"
1405990
+ ]
1405991
+ },
1405992
+ "Null": {
1405993
+ "aws:RequestTag/AWSApplicationMigrationServiceManaged": "false"
1405994
+ },
1405995
+ "StringEquals": {
1405996
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1405997
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1405998
+ "ec2:CreateAction": "CreateSecurityGroup"
1405999
+ }
1406000
+ }
1406001
+ },
1406002
+ {
1406003
+ "Sid": "Ec2ViaMgnTagOnCreate",
1406004
+ "Effect": "Allow",
1406005
+ "Action": [
1406006
+ "ec2:CreateTags"
1406007
+ ],
1406008
+ "Resource": [
1406009
+ "arn:aws:ec2:*:*:instance/*",
1406010
+ "arn:aws:ec2:*:*:network-interface/*",
1406011
+ "arn:aws:ec2:*:*:security-group/*",
1406012
+ "arn:aws:ec2:*:*:volume/*",
1406013
+ "arn:aws:ec2:*::snapshot/*"
1406014
+ ],
1406015
+ "Condition": {
1406016
+ "ForAnyValue:StringEquals": {
1406017
+ "aws:CalledVia": [
1406018
+ "mgn.amazonaws.com"
1406019
+ ]
1406020
+ },
1406021
+ "StringEquals": {
1406022
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406023
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1406024
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406025
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406026
+ "ec2:CreateAction": [
1406027
+ "CreateSecurityGroup",
1406028
+ "CreateSnapshot",
1406029
+ "CreateVolume",
1406030
+ "RunInstances"
1406031
+ ]
1406032
+ }
1406033
+ }
1406034
+ },
1406035
+ {
1406036
+ "Sid": "Ec2ViaMgnVolumeFromSnapshotCreate",
1406037
+ "Effect": "Allow",
1406038
+ "Action": [
1406039
+ "ec2:CreateVolume"
1406040
+ ],
1406041
+ "Resource": "arn:aws:ec2:*::snapshot/*",
1406042
+ "Condition": {
1406043
+ "ForAnyValue:StringEquals": {
1406044
+ "aws:CalledVia": [
1406045
+ "mgn.amazonaws.com"
1406046
+ ]
1406047
+ },
1406048
+ "StringEquals": {
1406049
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406050
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406051
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406052
+ "aws:ResourceTag/CreatedBy": "AWSTransform",
1406053
+ "ec2:Owner": "${aws:PrincipalAccount}"
1406054
+ }
1406055
+ }
1406056
+ },
1406057
+ {
1406058
+ "Sid": "FsxStorageVmOperationsReadOnly",
1406059
+ "Effect": "Allow",
1406060
+ "Action": [
1406061
+ "fsx:DescribeStorageVirtualMachines"
1406062
+ ],
1406063
+ "Resource": "*",
1406064
+ "Condition": {
1406065
+ "StringEquals": {
1406066
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406067
+ }
1406068
+ }
1406069
+ },
1406070
+ {
1406071
+ "Sid": "IamViaMgnEc2PassRole",
1406072
+ "Effect": "Allow",
1406073
+ "Action": [
1406074
+ "iam:PassRole"
1406075
+ ],
1406076
+ "Resource": [
1406077
+ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationConversionServerRole",
1406078
+ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithDrsRole",
1406079
+ "arn:aws:iam::*:role/service-role/AWSApplicationMigrationLaunchInstanceWithSsmRole"
1406080
+ ],
1406081
+ "Condition": {
1406082
+ "ForAnyValue:StringEquals": {
1406083
+ "aws:CalledVia": [
1406084
+ "mgn.amazonaws.com"
1406085
+ ]
1406086
+ },
1406087
+ "StringEquals": {
1406088
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406089
+ "iam:PassedToService": "ec2.amazonaws.com"
1406090
+ }
1406091
+ }
1406092
+ },
1406093
+ {
1406094
+ "Sid": "KmsS3EncryptionOperationsServerMigration",
1406095
+ "Effect": "Allow",
1406096
+ "Action": [
1406097
+ "kms:Decrypt",
1406098
+ "kms:DescribeKey",
1406099
+ "kms:GenerateDataKey"
1406100
+ ],
1406101
+ "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
1406102
+ "Condition": {
1406103
+ "StringLike": {
1406104
+ "kms:ViaService": "s3.*.amazonaws.com"
1406105
+ }
1406106
+ }
1406107
+ },
1406108
+ {
1406109
+ "Sid": "MgnAccountSettingsOperations",
1406110
+ "Effect": "Allow",
1406111
+ "Action": [
1406112
+ "mgn:GetAccountSettings",
1406113
+ "mgn:RegisterAgentForMgn",
1406114
+ "mgn:UpdateAccountSettings"
1406115
+ ],
1406116
+ "Resource": "*",
1406117
+ "Condition": {
1406118
+ "StringEquals": {
1406119
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406120
+ }
1406121
+ }
1406122
+ },
1406123
+ {
1406124
+ "Sid": "MgnAppWaveCreate",
1406125
+ "Effect": "Allow",
1406126
+ "Action": [
1406127
+ "mgn:CreateApplication",
1406128
+ "mgn:CreateWave"
1406129
+ ],
1406130
+ "Resource": "*",
1406131
+ "Condition": {
1406132
+ "StringEquals": {
1406133
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406134
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1406135
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406136
+ }
1406137
+ }
1406138
+ },
1406139
+ {
1406140
+ "Sid": "MgnAppWaveServerTagOperationsWrite",
1406141
+ "Effect": "Allow",
1406142
+ "Action": [
1406143
+ "mgn:TagResource"
1406144
+ ],
1406145
+ "Resource": [
1406146
+ "arn:aws:mgn:*:*:application/*",
1406147
+ "arn:aws:mgn:*:*:source-server/*",
1406148
+ "arn:aws:mgn:*:*:wave/*"
1406149
+ ],
1406150
+ "Condition": {
1406151
+ "StringEquals": {
1406152
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406153
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1406154
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406155
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406156
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1406157
+ }
1406158
+ }
1406159
+ },
1406160
+ {
1406161
+ "Sid": "MgnImportExportOperationWrite",
1406162
+ "Effect": "Allow",
1406163
+ "Action": [
1406164
+ "mgn:StartExport",
1406165
+ "mgn:StartImport",
1406166
+ "mgn:StartImportFileEnrichment"
1406167
+ ],
1406168
+ "Resource": "*",
1406169
+ "Condition": {
1406170
+ "StringEquals": {
1406171
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406172
+ }
1406173
+ }
1406174
+ },
1406175
+ {
1406176
+ "Sid": "MgnImportExportTagOperationsWrite",
1406177
+ "Effect": "Allow",
1406178
+ "Action": [
1406179
+ "mgn:TagResource"
1406180
+ ],
1406181
+ "Resource": [
1406182
+ "arn:aws:mgn:*:*:export/*",
1406183
+ "arn:aws:mgn:*:*:import/*"
1406184
+ ],
1406185
+ "Condition": {
1406186
+ "StringEquals": {
1406187
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406188
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1406189
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406190
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406191
+ "mgn:CreateAction": [
1406192
+ "StartExport",
1406193
+ "StartImport"
1406194
+ ]
1406195
+ }
1406196
+ }
1406197
+ },
1406198
+ {
1406199
+ "Sid": "MgnJobAndErrorOperationsReadOnly",
1406200
+ "Effect": "Allow",
1406201
+ "Action": [
1406202
+ "mgn:DescribeJobLogItems",
1406203
+ "mgn:ListExportErrors",
1406204
+ "mgn:ListImportErrors"
1406205
+ ],
1406206
+ "Resource": [
1406207
+ "arn:aws:mgn:*:*:export/*",
1406208
+ "arn:aws:mgn:*:*:import/*",
1406209
+ "arn:aws:mgn:*:*:job/*"
1406210
+ ],
1406211
+ "Condition": {
1406212
+ "StringEquals": {
1406213
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406214
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406215
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406216
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1406217
+ }
1406218
+ }
1406219
+ },
1406220
+ {
1406221
+ "Sid": "MgnJobTagOperationsWrite",
1406222
+ "Effect": "Allow",
1406223
+ "Action": [
1406224
+ "mgn:TagResource"
1406225
+ ],
1406226
+ "Resource": "arn:aws:mgn:*:*:job/*",
1406227
+ "Condition": {
1406228
+ "StringEquals": {
1406229
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406230
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406231
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406232
+ "aws:ResourceTag/CreatedBy": "AWSTransform",
1406233
+ "mgn:CreateAction": [
1406234
+ "StartCutover",
1406235
+ "StartTest",
1406236
+ "TerminateTargetInstances"
1406237
+ ]
1406238
+ }
1406239
+ }
1406240
+ },
1406241
+ {
1406242
+ "Sid": "MgnSourceServerLifecycleOperations",
1406243
+ "Effect": "Allow",
1406244
+ "Action": [
1406245
+ "mgn:ChangeServerLifecycleState",
1406246
+ "mgn:FinalizeCutover",
1406247
+ "mgn:GetReplicationConfiguration",
1406248
+ "mgn:ListSourceServerActions",
1406249
+ "mgn:ListTagsForResource",
1406250
+ "mgn:MarkAsArchived",
1406251
+ "mgn:PauseReplication",
1406252
+ "mgn:PutSourceServerAction",
1406253
+ "mgn:RemoveSourceServerAction",
1406254
+ "mgn:ResumeReplication",
1406255
+ "mgn:StartCutover",
1406256
+ "mgn:StartReplication",
1406257
+ "mgn:StartTest",
1406258
+ "mgn:StopReplication",
1406259
+ "mgn:UpdateReplicationConfiguration",
1406260
+ "mgn:UpdateSourceServer"
1406261
+ ],
1406262
+ "Resource": "arn:aws:mgn:*:*:source-server/*",
1406263
+ "Condition": {
1406264
+ "StringEquals": {
1406265
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406266
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406267
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406268
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1406269
+ }
1406270
+ }
1406271
+ },
1406272
+ {
1406273
+ "Sid": "OrganizationsOperationsReadOnlyServerMigration",
1406274
+ "Effect": "Allow",
1406275
+ "Action": [
1406276
+ "organizations:ListAccounts"
1406277
+ ],
1406278
+ "Resource": "*"
1406279
+ },
1406280
+ {
1406281
+ "Sid": "S3AgentSignatureOperationsReadOnly",
1406282
+ "Effect": "Allow",
1406283
+ "Action": [
1406284
+ "s3:GetObject"
1406285
+ ],
1406286
+ "Resource": "arn:aws:s3:::aws-application-migration-service-*/latest/source-automation-client/linux/ssaf-client/ssaf_client.sig"
1406287
+ },
1406288
+ {
1406289
+ "Sid": "S3TargetBucketOperationsServerMigration",
1406290
+ "Effect": "Allow",
1406291
+ "Action": [
1406292
+ "s3:CreateBucket",
1406293
+ "s3:GetBucketLocation",
1406294
+ "s3:GetBucketPublicAccessBlock",
1406295
+ "s3:GetBucketTagging",
1406296
+ "s3:ListBucket",
1406297
+ "s3:PutBucketTagging",
1406298
+ "s3:PutEncryptionConfiguration"
1406299
+ ],
1406300
+ "Resource": "arn:aws:s3:::transform-vmware-target-*",
1406301
+ "Condition": {
1406302
+ "StringEquals": {
1406303
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406304
+ }
1406305
+ }
1406306
+ },
1406307
+ {
1406308
+ "Sid": "S3TargetObjectOperationsServerMigration",
1406309
+ "Effect": "Allow",
1406310
+ "Action": [
1406311
+ "s3:AbortMultipartUpload",
1406312
+ "s3:DeleteObject",
1406313
+ "s3:GetObject",
1406314
+ "s3:GetObjectAttributes",
1406315
+ "s3:GetObjectVersion",
1406316
+ "s3:ListBucketMultipartUploads",
1406317
+ "s3:ListMultipartUploadParts",
1406318
+ "s3:PutObject"
1406319
+ ],
1406320
+ "Resource": "arn:aws:s3:::transform-vmware-target-*/*",
1406321
+ "Condition": {
1406322
+ "StringEquals": {
1406323
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406324
+ }
1406325
+ }
1406326
+ },
1406327
+ {
1406328
+ "Sid": "SecretsManagerOperationsReadOnly",
1406329
+ "Effect": "Allow",
1406330
+ "Action": [
1406331
+ "secretsmanager:ListSecrets"
1406332
+ ],
1406333
+ "Resource": "*",
1406334
+ "Condition": {
1406335
+ "StringEquals": {
1406336
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406337
+ }
1406338
+ }
1406339
+ },
1406340
+ {
1406341
+ "Sid": "ServerMigrationOperationsReadOnly",
1406342
+ "Effect": "Allow",
1406343
+ "Action": [
1406344
+ "mgn:DescribeJobs",
1406345
+ "mgn:DescribeLaunchConfigurationTemplates",
1406346
+ "mgn:DescribeReplicationConfigurationTemplates",
1406347
+ "mgn:DescribeReplicationServerAssociationsForMgn",
1406348
+ "mgn:DescribeSourceServers",
1406349
+ "mgn:DescribeVcenterClients",
1406350
+ "mgn:GetLaunchConfiguration",
1406351
+ "mgn:ListApplications",
1406352
+ "mgn:ListConnectors",
1406353
+ "mgn:ListExports",
1406354
+ "mgn:ListImportFileEnrichments",
1406355
+ "mgn:ListImports",
1406356
+ "mgn:ListTemplateActions",
1406357
+ "mgn:ListWaves"
1406358
+ ],
1406359
+ "Resource": "*",
1406360
+ "Condition": {
1406361
+ "StringEquals": {
1406362
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406363
+ }
1406364
+ }
1406365
+ },
1406366
+ {
1406367
+ "Sid": "ServerMigrationOperationsWrite",
1406368
+ "Effect": "Allow",
1406369
+ "Action": [
1406370
+ "mgn:AssociateApplications",
1406371
+ "mgn:AssociateSourceServers",
1406372
+ "mgn:DeleteApplication",
1406373
+ "mgn:DeleteWave",
1406374
+ "mgn:DisassociateApplications",
1406375
+ "mgn:DisassociateSourceServers",
1406376
+ "mgn:TerminateTargetInstances",
1406377
+ "mgn:UpdateApplication",
1406378
+ "mgn:UpdateLaunchConfiguration",
1406379
+ "mgn:UpdateWave"
1406380
+ ],
1406381
+ "Resource": "*",
1406382
+ "Condition": {
1406383
+ "StringEquals": {
1406384
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406385
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406386
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1406387
+ }
1406388
+ }
1406389
+ },
1406390
+ {
1406391
+ "Sid": "ServerMigrationTemplateOperationsWrite",
1406392
+ "Effect": "Allow",
1406393
+ "Action": [
1406394
+ "mgn:PutTemplateAction",
1406395
+ "mgn:RemoveTemplateAction",
1406396
+ "mgn:UpdateLaunchConfigurationTemplate",
1406397
+ "mgn:UpdateReplicationConfigurationTemplate"
1406398
+ ],
1406399
+ "Resource": "*",
1406400
+ "Condition": {
1406401
+ "StringEquals": {
1406402
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406403
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406404
+ }
1406405
+ }
1406406
+ },
1406407
+ {
1406408
+ "Sid": "ServiceQuotasViaMgnOperationsReadOnly",
1406409
+ "Effect": "Allow",
1406410
+ "Action": [
1406411
+ "servicequotas:GetServiceQuota"
1406412
+ ],
1406413
+ "Resource": "arn:aws:servicequotas:*:*:vpc/L-2AFB9258",
1406414
+ "Condition": {
1406415
+ "ForAnyValue:StringEquals": {
1406416
+ "aws:CalledVia": [
1406417
+ "mgn.amazonaws.com"
1406418
+ ]
1406419
+ },
1406420
+ "StringEquals": {
1406421
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406422
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406423
+ }
1406424
+ }
1406425
+ },
1406426
+ {
1406427
+ "Sid": "SsmAgentCommandOperationsReadOnly",
1406428
+ "Effect": "Allow",
1406429
+ "Action": [
1406430
+ "ssm:DescribeInstanceInformation",
1406431
+ "ssm:GetCommandInvocation",
1406432
+ "ssm:ListCommandInvocations",
1406433
+ "ssm:ListCommands"
1406434
+ ],
1406435
+ "Resource": "*",
1406436
+ "Condition": {
1406437
+ "StringEquals": {
1406438
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406439
+ }
1406440
+ }
1406441
+ },
1406442
+ {
1406443
+ "Sid": "SsmAgentCommandOperationsWrite",
1406444
+ "Effect": "Allow",
1406445
+ "Action": [
1406446
+ "ssm:SendCommand"
1406447
+ ],
1406448
+ "Resource": "arn:aws:ssm:*:*:managed-instance/*",
1406449
+ "Condition": {
1406450
+ "StringEquals": {
1406451
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406452
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406453
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406454
+ "aws:ResourceTag/CreatedFor": "AWSTransform"
1406455
+ }
1406456
+ }
1406457
+ },
1406458
+ {
1406459
+ "Sid": "SsmMigrationDocumentOperations",
1406460
+ "Effect": "Allow",
1406461
+ "Action": [
1406462
+ "ssm:GetDocument",
1406463
+ "ssm:SendCommand"
1406464
+ ],
1406465
+ "Resource": "arn:aws:ssm:*::document/AWSMigration-RunSourceServerAction",
1406466
+ "Condition": {
1406467
+ "StringEquals": {
1406468
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406469
+ }
1406470
+ }
1406471
+ },
1406472
+ {
1406473
+ "Sid": "SsmParameterServerMigrationOperationsWrite",
1406474
+ "Effect": "Allow",
1406475
+ "Action": [
1406476
+ "ssm:DeleteParameters",
1406477
+ "ssm:GetParameters",
1406478
+ "ssm:PutParameter"
1406479
+ ],
1406480
+ "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSApplicationMigrationService-*",
1406481
+ "Condition": {
1406482
+ "StringEquals": {
1406483
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406484
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406485
+ }
1406486
+ }
1406487
+ },
1406488
+ {
1406489
+ "Sid": "SsmViaMgnDocumentOnAwsManagedOperationsReadOnly",
1406490
+ "Effect": "Allow",
1406491
+ "Action": [
1406492
+ "ssm:DescribeDocument",
1406493
+ "ssm:GetDocument",
1406494
+ "ssm:ListDocumentVersions"
1406495
+ ],
1406496
+ "Resource": "arn:aws:ssm:*::document/AWS*",
1406497
+ "Condition": {
1406498
+ "ForAnyValue:StringEquals": {
1406499
+ "aws:CalledVia": [
1406500
+ "mgn.amazonaws.com"
1406501
+ ]
1406502
+ },
1406503
+ "StringEquals": {
1406504
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406505
+ }
1406506
+ }
1406507
+ },
1406508
+ {
1406509
+ "Sid": "SsmViaMgnDocumentOperationsReadOnly",
1406510
+ "Effect": "Allow",
1406511
+ "Action": [
1406512
+ "ssm:DescribeDocument",
1406513
+ "ssm:GetDocument",
1406514
+ "ssm:ListDocumentVersions"
1406515
+ ],
1406516
+ "Resource": "arn:aws:ssm:*:*:document/*",
1406517
+ "Condition": {
1406518
+ "ForAnyValue:StringEquals": {
1406519
+ "aws:CalledVia": [
1406520
+ "mgn.amazonaws.com"
1406521
+ ]
1406522
+ },
1406523
+ "StringEquals": {
1406524
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406525
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406526
+ }
1406527
+ }
1406528
+ },
1406529
+ {
1406530
+ "Sid": "SsmViaMgnPostLaunchCommandAndAutomation",
1406531
+ "Effect": "Allow",
1406532
+ "Action": [
1406533
+ "ssm:SendCommand",
1406534
+ "ssm:StartAutomationExecution"
1406535
+ ],
1406536
+ "Resource": [
1406537
+ "arn:aws:ssm:*:*:automation-definition/*:*",
1406538
+ "arn:aws:ssm:*:*:automation-execution/*",
1406539
+ "arn:aws:ssm:*:*:document/*"
1406540
+ ],
1406541
+ "Condition": {
1406542
+ "ForAnyValue:StringEquals": {
1406543
+ "aws:CalledVia": [
1406544
+ "mgn.amazonaws.com"
1406545
+ ]
1406546
+ },
1406547
+ "StringEquals": {
1406548
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406549
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406550
+ }
1406551
+ }
1406552
+ },
1406553
+ {
1406554
+ "Sid": "SsmViaMgnPostLaunchCommandAndAutomationOnAwsManaged",
1406555
+ "Effect": "Allow",
1406556
+ "Action": [
1406557
+ "ssm:SendCommand",
1406558
+ "ssm:StartAutomationExecution"
1406559
+ ],
1406560
+ "Resource": [
1406561
+ "arn:aws:ssm:*::automation-definition/AWS*:*",
1406562
+ "arn:aws:ssm:*::document/AWS*"
1406563
+ ],
1406564
+ "Condition": {
1406565
+ "ForAnyValue:StringEquals": {
1406566
+ "aws:CalledVia": [
1406567
+ "mgn.amazonaws.com"
1406568
+ ]
1406569
+ },
1406570
+ "StringEquals": {
1406571
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406572
+ }
1406573
+ }
1406574
+ },
1406575
+ {
1406576
+ "Sid": "SsmViaMgnPostLaunchSendCommandToInstances",
1406577
+ "Effect": "Allow",
1406578
+ "Action": [
1406579
+ "ssm:SendCommand"
1406580
+ ],
1406581
+ "Resource": "arn:aws:ec2:*:*:instance/*",
1406582
+ "Condition": {
1406583
+ "ForAnyValue:StringEquals": {
1406584
+ "aws:CalledVia": [
1406585
+ "mgn.amazonaws.com"
1406586
+ ]
1406587
+ },
1406588
+ "Null": {
1406589
+ "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false"
1406590
+ },
1406591
+ "StringEquals": {
1406592
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406593
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406594
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1406595
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1406596
+ }
1406597
+ }
1406598
+ },
1406599
+ {
1406600
+ "Sid": "StsCrossAccountAssumeRole",
1406601
+ "Effect": "Allow",
1406602
+ "Action": [
1406603
+ "sts:AssumeRole"
1406604
+ ],
1406605
+ "Resource": "arn:aws:iam::*:role/AWSTransformRehostSharingRole_${aws:PrincipalAccount}",
1406606
+ "Condition": {
1406607
+ "StringEquals": {
1406608
+ "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
1406609
+ "sts:ExternalId": "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
1406610
+ }
1406611
+ }
1406612
+ }
1406613
+ ]
1406614
+ }
1406615
+ }
1406616
+ },
1406617
+ "createdDate": "2026-08-06T15:27:14.000Z",
1406618
+ "lastUpdatedDate": "2026-08-06T15:27:14.000Z"
1406619
+ },
1406620
+ "AWSTransformNetworkMigrationAgentPolicy": {
1406621
+ "arn": "arn:aws:iam::aws:policy/AWSTransformNetworkMigrationAgentPolicy",
1406622
+ "latestVersionId": "v1",
1406623
+ "versionsCount": 1,
1406624
+ "versions": {
1406625
+ "v1": {
1406626
+ "createdDate": "2026-08-06T15:27:26.000Z",
1406627
+ "document": {
1406628
+ "Version": "2012-10-17",
1406629
+ "Statement": [
1406630
+ {
1406631
+ "Sid": "CfnNetworkMigrationStackCreate",
1406632
+ "Effect": "Allow",
1406633
+ "Action": [
1406634
+ "cloudformation:CreateStack"
1406635
+ ],
1406636
+ "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
1406637
+ "Condition": {
1406638
+ "StringEquals": {
1406639
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1406640
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406641
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406642
+ }
1406643
+ }
1406644
+ },
1406645
+ {
1406646
+ "Sid": "CfnNetworkMigrationStackDescribeStacks",
1406647
+ "Effect": "Allow",
1406648
+ "Action": [
1406649
+ "cloudformation:DescribeStacks"
1406650
+ ],
1406651
+ "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
1406652
+ "Condition": {
1406653
+ "StringEquals": {
1406654
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406655
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1406656
+ }
1406657
+ }
1406658
+ },
1406659
+ {
1406660
+ "Sid": "CfnNetworkMigrationStackListStacks",
1406661
+ "Effect": "Allow",
1406662
+ "Action": [
1406663
+ "cloudformation:ListStacks"
1406664
+ ],
1406665
+ "Resource": "*",
1406666
+ "Condition": {
1406667
+ "StringEquals": {
1406668
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406669
+ }
1406670
+ }
1406671
+ },
1406672
+ {
1406673
+ "Sid": "CfnNetworkMigrationStackOperationsWrite",
1406674
+ "Effect": "Allow",
1406675
+ "Action": [
1406676
+ "cloudformation:DeleteStack",
1406677
+ "cloudformation:DescribeStackEvents",
1406678
+ "cloudformation:DescribeStackResources",
1406679
+ "cloudformation:GetTemplateSummary",
1406680
+ "cloudformation:ListStackResources",
1406681
+ "cloudformation:UpdateStack",
1406682
+ "cloudformation:UpdateTerminationProtection"
1406683
+ ],
1406684
+ "Resource": "arn:aws:cloudformation:*:*:stack/Nmd*",
1406685
+ "Condition": {
1406686
+ "StringEquals": {
1406687
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406688
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406689
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1406690
+ }
1406691
+ }
1406692
+ },
1406693
+ {
1406694
+ "Sid": "Ec2NetworkProvisionCreate",
1406695
+ "Effect": "Allow",
1406696
+ "Action": [
1406697
+ "ec2:AllocateAddress",
1406698
+ "ec2:CreateInternetGateway",
1406699
+ "ec2:CreateTransitGateway",
1406700
+ "ec2:CreateVpc"
1406701
+ ],
1406702
+ "Resource": "*",
1406703
+ "Condition": {
1406704
+ "StringEquals": {
1406705
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1406706
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406707
+ }
1406708
+ }
1406709
+ },
1406710
+ {
1406711
+ "Sid": "Ec2NetworkTopologyOperationsReadOnly",
1406712
+ "Effect": "Allow",
1406713
+ "Action": [
1406714
+ "ec2:DescribeAvailabilityZones",
1406715
+ "ec2:DescribeNetworkInterfaces",
1406716
+ "ec2:DescribeSecurityGroupRules",
1406717
+ "ec2:DescribeSecurityGroups",
1406718
+ "ec2:DescribeSubnets",
1406719
+ "ec2:DescribeVpcs",
1406720
+ "ec2:GetSubnetCidrReservations"
1406721
+ ],
1406722
+ "Resource": "*",
1406723
+ "Condition": {
1406724
+ "StringEquals": {
1406725
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406726
+ }
1406727
+ }
1406728
+ },
1406729
+ {
1406730
+ "Sid": "Ec2TagOnCreateNetworkMigration",
1406731
+ "Effect": "Allow",
1406732
+ "Action": [
1406733
+ "ec2:CreateTags"
1406734
+ ],
1406735
+ "Resource": [
1406736
+ "arn:aws:ec2:*:*:elastic-ip/*",
1406737
+ "arn:aws:ec2:*:*:internet-gateway/*",
1406738
+ "arn:aws:ec2:*:*:natgateway/*",
1406739
+ "arn:aws:ec2:*:*:network-insights-access-scope-analysis/*",
1406740
+ "arn:aws:ec2:*:*:network-insights-access-scope/*",
1406741
+ "arn:aws:ec2:*:*:network-insights-analysis/*",
1406742
+ "arn:aws:ec2:*:*:network-insights-path/*",
1406743
+ "arn:aws:ec2:*:*:network-interface/*",
1406744
+ "arn:aws:ec2:*:*:route-table/*",
1406745
+ "arn:aws:ec2:*:*:security-group-rule/*",
1406746
+ "arn:aws:ec2:*:*:security-group/*",
1406747
+ "arn:aws:ec2:*:*:subnet/*",
1406748
+ "arn:aws:ec2:*:*:transit-gateway-attachment/*",
1406749
+ "arn:aws:ec2:*:*:transit-gateway-connect-peer/*",
1406750
+ "arn:aws:ec2:*:*:transit-gateway-policy-table/*",
1406751
+ "arn:aws:ec2:*:*:transit-gateway-route-table/*",
1406752
+ "arn:aws:ec2:*:*:transit-gateway/*",
1406753
+ "arn:aws:ec2:*:*:vpc/*"
1406754
+ ],
1406755
+ "Condition": {
1406756
+ "StringEquals": {
1406757
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1406758
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406759
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1406760
+ "ec2:CreateAction": [
1406761
+ "AllocateAddress",
1406762
+ "CreateInternetGateway",
1406763
+ "CreateNatGateway",
1406764
+ "CreateNetworkInsightsAccessScope",
1406765
+ "CreateNetworkInsightsPath",
1406766
+ "CreateNetworkInterface",
1406767
+ "CreateRouteTable",
1406768
+ "CreateSecurityGroup",
1406769
+ "CreateSubnet",
1406770
+ "CreateTransitGateway",
1406771
+ "CreateTransitGatewayConnect",
1406772
+ "CreateTransitGatewayConnectPeer",
1406773
+ "CreateTransitGatewayPeeringAttachment",
1406774
+ "CreateTransitGatewayPolicyTable",
1406775
+ "CreateTransitGatewayPrefixListReference",
1406776
+ "CreateTransitGatewayRoute",
1406777
+ "CreateTransitGatewayRouteTable",
1406778
+ "CreateTransitGatewayRouteTableAnnouncement",
1406779
+ "CreateTransitGatewayVpcAttachment",
1406780
+ "CreateVpc",
1406781
+ "StartNetworkInsightsAnalysis"
1406782
+ ]
1406783
+ }
1406784
+ }
1406785
+ },
1406786
+ {
1406787
+ "Sid": "Ec2ViaCfnCrossOrgTgwAttachmentCreate",
1406788
+ "Effect": "Allow",
1406789
+ "Action": [
1406790
+ "ec2:CreateTransitGatewayVpcAttachment"
1406791
+ ],
1406792
+ "Resource": [
1406793
+ "arn:aws:ec2:*:*:subnet/*",
1406794
+ "arn:aws:ec2:*:*:transit-gateway-attachment/*",
1406795
+ "arn:aws:ec2:*:*:transit-gateway/*",
1406796
+ "arn:aws:ec2:*:*:vpc/*"
1406797
+ ],
1406798
+ "Condition": {
1406799
+ "ForAnyValue:StringEquals": {
1406800
+ "aws:CalledVia": [
1406801
+ "cloudformation.amazonaws.com"
1406802
+ ]
1406803
+ },
1406804
+ "StringEquals": {
1406805
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406806
+ "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
1406807
+ }
1406808
+ }
1406809
+ },
1406810
+ {
1406811
+ "Sid": "Ec2ViaCfnNetworkOperationsWrite",
1406812
+ "Effect": "Allow",
1406813
+ "Action": [
1406814
+ "ec2:AcceptTransitGatewayVpcAttachment",
1406815
+ "ec2:AssociateNatGatewayAddress",
1406816
+ "ec2:AssociateRouteTable",
1406817
+ "ec2:AssociateSubnetCidrBlock",
1406818
+ "ec2:AssociateTransitGatewayRouteTable",
1406819
+ "ec2:AssociateVpcCidrBlock",
1406820
+ "ec2:AttachInternetGateway",
1406821
+ "ec2:AuthorizeSecurityGroupEgress",
1406822
+ "ec2:AuthorizeSecurityGroupIngress",
1406823
+ "ec2:DeleteInternetGateway",
1406824
+ "ec2:DeleteLaunchTemplate",
1406825
+ "ec2:DeleteLaunchTemplateVersions",
1406826
+ "ec2:DeleteNatGateway",
1406827
+ "ec2:DeleteNetworkInsightsAnalysis",
1406828
+ "ec2:DeleteNetworkInsightsPath",
1406829
+ "ec2:DeleteNetworkInterface",
1406830
+ "ec2:DeleteRoute",
1406831
+ "ec2:DeleteRouteTable",
1406832
+ "ec2:DeleteSecurityGroup",
1406833
+ "ec2:DeleteSubnet",
1406834
+ "ec2:DeleteTransitGateway",
1406835
+ "ec2:DeleteTransitGatewayRoute",
1406836
+ "ec2:DeleteTransitGatewayRouteTable",
1406837
+ "ec2:DeleteTransitGatewayVpcAttachment",
1406838
+ "ec2:DeleteVpc",
1406839
+ "ec2:DetachInternetGateway",
1406840
+ "ec2:DisableTransitGatewayRouteTablePropagation",
1406841
+ "ec2:DisassociateNatGatewayAddress",
1406842
+ "ec2:DisassociateRouteTable",
1406843
+ "ec2:DisassociateTransitGatewayRouteTable",
1406844
+ "ec2:EnableTransitGatewayRouteTablePropagation",
1406845
+ "ec2:ModifySubnetAttribute",
1406846
+ "ec2:ModifyTransitGateway",
1406847
+ "ec2:ModifyTransitGatewayVpcAttachment",
1406848
+ "ec2:ModifyVpcAttribute",
1406849
+ "ec2:RejectTransitGatewayVpcAttachment",
1406850
+ "ec2:ReleaseAddress",
1406851
+ "ec2:ReplaceRoute",
1406852
+ "ec2:ReplaceTransitGatewayRoute",
1406853
+ "ec2:RevokeSecurityGroupEgress",
1406854
+ "ec2:RevokeSecurityGroupIngress",
1406855
+ "ec2:SearchTransitGatewayRoutes",
1406856
+ "ec2:StartNetworkInsightsAnalysis"
1406857
+ ],
1406858
+ "Resource": "*",
1406859
+ "Condition": {
1406860
+ "ForAnyValue:StringEquals": {
1406861
+ "aws:CalledVia": [
1406862
+ "cloudformation.amazonaws.com"
1406863
+ ]
1406864
+ },
1406865
+ "StringEquals": {
1406866
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406867
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1406868
+ }
1406869
+ }
1406870
+ },
1406871
+ {
1406872
+ "Sid": "Ec2ViaCfnNetworkProvisionCreateWithRequestTag",
1406873
+ "Effect": "Allow",
1406874
+ "Action": [
1406875
+ "ec2:CreateNatGateway",
1406876
+ "ec2:CreateNetworkInsightsPath",
1406877
+ "ec2:CreateNetworkInterface",
1406878
+ "ec2:CreateRoute",
1406879
+ "ec2:CreateRouteTable",
1406880
+ "ec2:CreateSubnet",
1406881
+ "ec2:CreateTransitGatewayRoute",
1406882
+ "ec2:CreateTransitGatewayRouteTable",
1406883
+ "ec2:CreateTransitGatewayVpcAttachment"
1406884
+ ],
1406885
+ "Resource": "*",
1406886
+ "Condition": {
1406887
+ "ForAnyValue:StringEquals": {
1406888
+ "aws:CalledVia": [
1406889
+ "cloudformation.amazonaws.com"
1406890
+ ]
1406891
+ },
1406892
+ "StringEquals": {
1406893
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1406894
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406895
+ }
1406896
+ }
1406897
+ },
1406898
+ {
1406899
+ "Sid": "Ec2ViaCfnNetworkProvisionCreateWithResourceTag",
1406900
+ "Effect": "Allow",
1406901
+ "Action": [
1406902
+ "ec2:CreateNatGateway",
1406903
+ "ec2:CreateNetworkInsightsPath",
1406904
+ "ec2:CreateNetworkInterface",
1406905
+ "ec2:CreateRoute",
1406906
+ "ec2:CreateRouteTable",
1406907
+ "ec2:CreateSubnet",
1406908
+ "ec2:CreateTransitGatewayRoute",
1406909
+ "ec2:CreateTransitGatewayRouteTable",
1406910
+ "ec2:CreateTransitGatewayVpcAttachment"
1406911
+ ],
1406912
+ "Resource": "*",
1406913
+ "Condition": {
1406914
+ "ForAnyValue:StringEquals": {
1406915
+ "aws:CalledVia": [
1406916
+ "cloudformation.amazonaws.com"
1406917
+ ]
1406918
+ },
1406919
+ "StringEquals": {
1406920
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1406921
+ "ec2:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1406922
+ }
1406923
+ }
1406924
+ },
1406925
+ {
1406926
+ "Sid": "Ec2ViaCfnOperationsReadOnly",
1406927
+ "Effect": "Allow",
1406928
+ "Action": [
1406929
+ "ec2:DescribeAccountAttributes",
1406930
+ "ec2:DescribeAddresses",
1406931
+ "ec2:DescribeAvailabilityZones",
1406932
+ "ec2:DescribeCustomerGateways",
1406933
+ "ec2:DescribeEgressOnlyInternetGateways",
1406934
+ "ec2:DescribeInstances",
1406935
+ "ec2:DescribeInternetGateways",
1406936
+ "ec2:DescribeManagedPrefixLists",
1406937
+ "ec2:DescribeNatGateways",
1406938
+ "ec2:DescribeNetworkInsightsAnalyses",
1406939
+ "ec2:DescribeNetworkInsightsPaths",
1406940
+ "ec2:DescribeNetworkInterfaces",
1406941
+ "ec2:DescribePrefixLists",
1406942
+ "ec2:DescribeRegions",
1406943
+ "ec2:DescribeRouteTables",
1406944
+ "ec2:DescribeSecurityGroupRules",
1406945
+ "ec2:DescribeSecurityGroups",
1406946
+ "ec2:DescribeSubnets",
1406947
+ "ec2:DescribeTransitGatewayAttachments",
1406948
+ "ec2:DescribeTransitGatewayConnects",
1406949
+ "ec2:DescribeTransitGatewayPeeringAttachments",
1406950
+ "ec2:DescribeTransitGatewayRouteTables",
1406951
+ "ec2:DescribeTransitGatewayVpcAttachments",
1406952
+ "ec2:DescribeTransitGateways",
1406953
+ "ec2:DescribeVpcEndpointServiceConfigurations",
1406954
+ "ec2:DescribeVpcEndpoints",
1406955
+ "ec2:DescribeVpcPeeringConnections",
1406956
+ "ec2:DescribeVpcs",
1406957
+ "ec2:DescribeVpnConnections",
1406958
+ "ec2:DescribeVpnGateways",
1406959
+ "ec2:GetManagedPrefixListEntries",
1406960
+ "ec2:GetTransitGatewayRouteTableAssociations",
1406961
+ "ec2:GetTransitGatewayRouteTablePropagations"
1406962
+ ],
1406963
+ "Resource": "*",
1406964
+ "Condition": {
1406965
+ "ForAnyValue:StringEquals": {
1406966
+ "aws:CalledVia": [
1406967
+ "cloudformation.amazonaws.com"
1406968
+ ]
1406969
+ },
1406970
+ "StringEquals": {
1406971
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406972
+ }
1406973
+ }
1406974
+ },
1406975
+ {
1406976
+ "Sid": "Ec2ViaCfnSecurityGroupCreate",
1406977
+ "Effect": "Allow",
1406978
+ "Action": [
1406979
+ "ec2:CreateSecurityGroup"
1406980
+ ],
1406981
+ "Resource": "*",
1406982
+ "Condition": {
1406983
+ "ForAnyValue:StringEquals": {
1406984
+ "aws:CalledVia": [
1406985
+ "cloudformation.amazonaws.com"
1406986
+ ]
1406987
+ },
1406988
+ "StringEquals": {
1406989
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1406990
+ }
1406991
+ }
1406992
+ },
1406993
+ {
1406994
+ "Sid": "Ec2ViaCfnSecurityGroupTagCreate",
1406995
+ "Effect": "Allow",
1406996
+ "Action": [
1406997
+ "ec2:CreateTags"
1406998
+ ],
1406999
+ "Resource": [
1407000
+ "arn:aws:ec2:*:*:security-group-rule/*",
1407001
+ "arn:aws:ec2:*:*:security-group/*"
1407002
+ ],
1407003
+ "Condition": {
1407004
+ "ForAnyValue:StringEquals": {
1407005
+ "aws:CalledVia": [
1407006
+ "cloudformation.amazonaws.com"
1407007
+ ]
1407008
+ },
1407009
+ "StringEquals": {
1407010
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407011
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407012
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407013
+ }
1407014
+ }
1407015
+ },
1407016
+ {
1407017
+ "Sid": "IamTgwServiceLinkedRoleCreate",
1407018
+ "Effect": "Allow",
1407019
+ "Action": [
1407020
+ "iam:CreateServiceLinkedRole"
1407021
+ ],
1407022
+ "Resource": "arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway",
1407023
+ "Condition": {
1407024
+ "StringEquals": {
1407025
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407026
+ },
1407027
+ "StringLike": {
1407028
+ "iam:AWSServiceName": "transitgateway.amazonaws.com"
1407029
+ }
1407030
+ }
1407031
+ },
1407032
+ {
1407033
+ "Sid": "IamViaCfnTgwLambdaRoleCleanupOperations",
1407034
+ "Effect": "Allow",
1407035
+ "Action": [
1407036
+ "iam:DeleteRole",
1407037
+ "iam:DeleteRolePolicy",
1407038
+ "iam:DetachRolePolicy",
1407039
+ "iam:GetRolePolicy",
1407040
+ "iam:ListAttachedRolePolicies",
1407041
+ "iam:ListRolePolicies"
1407042
+ ],
1407043
+ "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
1407044
+ "Condition": {
1407045
+ "ForAnyValue:StringEquals": {
1407046
+ "aws:CalledVia": [
1407047
+ "cloudformation.amazonaws.com"
1407048
+ ]
1407049
+ },
1407050
+ "StringEquals": {
1407051
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407052
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407053
+ }
1407054
+ }
1407055
+ },
1407056
+ {
1407057
+ "Sid": "IamViaCfnTgwLambdaRoleCreate",
1407058
+ "Effect": "Allow",
1407059
+ "Action": [
1407060
+ "iam:CreateRole"
1407061
+ ],
1407062
+ "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
1407063
+ "Condition": {
1407064
+ "ForAnyValue:StringEquals": {
1407065
+ "aws:CalledVia": [
1407066
+ "cloudformation.amazonaws.com"
1407067
+ ]
1407068
+ },
1407069
+ "StringEquals": {
1407070
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407071
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407072
+ }
1407073
+ }
1407074
+ },
1407075
+ {
1407076
+ "Sid": "IamViaCfnTgwLambdaRoleOperationsReadOnly",
1407077
+ "Effect": "Allow",
1407078
+ "Action": [
1407079
+ "iam:GetRole"
1407080
+ ],
1407081
+ "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
1407082
+ "Condition": {
1407083
+ "ForAnyValue:StringEquals": {
1407084
+ "aws:CalledVia": [
1407085
+ "cloudformation.amazonaws.com"
1407086
+ ]
1407087
+ },
1407088
+ "StringEquals": {
1407089
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407090
+ }
1407091
+ }
1407092
+ },
1407093
+ {
1407094
+ "Sid": "IamViaCfnTgwLambdaRolePassRole",
1407095
+ "Effect": "Allow",
1407096
+ "Action": [
1407097
+ "iam:PassRole"
1407098
+ ],
1407099
+ "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
1407100
+ "Condition": {
1407101
+ "ForAnyValue:StringEquals": {
1407102
+ "aws:CalledVia": [
1407103
+ "cloudformation.amazonaws.com"
1407104
+ ]
1407105
+ },
1407106
+ "StringEquals": {
1407107
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407108
+ "iam:PassedToService": "lambda.amazonaws.com"
1407109
+ }
1407110
+ }
1407111
+ },
1407112
+ {
1407113
+ "Sid": "IamViaCfnTgwLambdaRolePolicyAttach",
1407114
+ "Effect": "Allow",
1407115
+ "Action": [
1407116
+ "iam:AttachRolePolicy"
1407117
+ ],
1407118
+ "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
1407119
+ "Condition": {
1407120
+ "ArnEquals": {
1407121
+ "iam:PolicyARN": [
1407122
+ "arn:aws:iam::aws:policy/AWSApplicationMigrationNetworkMigrationCustomResource",
1407123
+ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
1407124
+ ]
1407125
+ },
1407126
+ "ForAnyValue:StringEquals": {
1407127
+ "aws:CalledVia": [
1407128
+ "cloudformation.amazonaws.com"
1407129
+ ]
1407130
+ },
1407131
+ "StringEquals": {
1407132
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407133
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407134
+ }
1407135
+ }
1407136
+ },
1407137
+ {
1407138
+ "Sid": "IamViaCfnTgwLambdaRoleTag",
1407139
+ "Effect": "Allow",
1407140
+ "Action": [
1407141
+ "iam:TagRole"
1407142
+ ],
1407143
+ "Resource": "arn:aws:iam::*:role/Nmd*modifyTransitGateway*",
1407144
+ "Condition": {
1407145
+ "ForAnyValue:StringEquals": {
1407146
+ "aws:CalledVia": [
1407147
+ "cloudformation.amazonaws.com"
1407148
+ ]
1407149
+ },
1407150
+ "StringEquals": {
1407151
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407152
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407153
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407154
+ }
1407155
+ }
1407156
+ },
1407157
+ {
1407158
+ "Sid": "KmsS3EncryptionOperationsNetworkMigration",
1407159
+ "Effect": "Allow",
1407160
+ "Action": [
1407161
+ "kms:Decrypt",
1407162
+ "kms:DescribeKey",
1407163
+ "kms:GenerateDataKey"
1407164
+ ],
1407165
+ "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/EncryptionKeyId}",
1407166
+ "Condition": {
1407167
+ "StringLike": {
1407168
+ "kms:ViaService": "s3.*.amazonaws.com"
1407169
+ }
1407170
+ }
1407171
+ },
1407172
+ {
1407173
+ "Sid": "LambdaViaCfnNetworkMigrationFunctionCreate",
1407174
+ "Effect": "Allow",
1407175
+ "Action": [
1407176
+ "lambda:CreateFunction"
1407177
+ ],
1407178
+ "Resource": "arn:aws:lambda:*:*:function:network-migration*",
1407179
+ "Condition": {
1407180
+ "ForAnyValue:StringEquals": {
1407181
+ "aws:CalledVia": [
1407182
+ "cloudformation.amazonaws.com"
1407183
+ ]
1407184
+ },
1407185
+ "StringEquals": {
1407186
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407187
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407188
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407189
+ }
1407190
+ }
1407191
+ },
1407192
+ {
1407193
+ "Sid": "LambdaViaCfnNetworkMigrationFunctionOperations",
1407194
+ "Effect": "Allow",
1407195
+ "Action": [
1407196
+ "lambda:DeleteFunction",
1407197
+ "lambda:GetFunctionCodeSigningConfig",
1407198
+ "lambda:GetFunctionConfiguration",
1407199
+ "lambda:GetFunctionRecursionConfig",
1407200
+ "lambda:GetRuntimeManagementConfig",
1407201
+ "lambda:InvokeFunction"
1407202
+ ],
1407203
+ "Resource": "arn:aws:lambda:*:*:function:network-migration*",
1407204
+ "Condition": {
1407205
+ "ForAnyValue:StringEquals": {
1407206
+ "aws:CalledVia": [
1407207
+ "cloudformation.amazonaws.com"
1407208
+ ]
1407209
+ },
1407210
+ "StringEquals": {
1407211
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407212
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407213
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407214
+ }
1407215
+ }
1407216
+ },
1407217
+ {
1407218
+ "Sid": "LambdaViaCfnNetworkMigrationFunctionOperationsReadOnly",
1407219
+ "Effect": "Allow",
1407220
+ "Action": [
1407221
+ "lambda:GetFunction"
1407222
+ ],
1407223
+ "Resource": "arn:aws:lambda:*:*:function:network-migration*",
1407224
+ "Condition": {
1407225
+ "ForAnyValue:StringEquals": {
1407226
+ "aws:CalledVia": [
1407227
+ "cloudformation.amazonaws.com"
1407228
+ ]
1407229
+ },
1407230
+ "StringEquals": {
1407231
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407232
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407233
+ }
1407234
+ }
1407235
+ },
1407236
+ {
1407237
+ "Sid": "LambdaViaCfnNetworkMigrationFunctionTag",
1407238
+ "Effect": "Allow",
1407239
+ "Action": [
1407240
+ "lambda:TagResource"
1407241
+ ],
1407242
+ "Resource": "arn:aws:lambda:*:*:function:network-migration*",
1407243
+ "Condition": {
1407244
+ "ForAnyValue:StringEquals": {
1407245
+ "aws:CalledVia": [
1407246
+ "cloudformation.amazonaws.com"
1407247
+ ]
1407248
+ },
1407249
+ "StringEquals": {
1407250
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407251
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407252
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407253
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407254
+ }
1407255
+ }
1407256
+ },
1407257
+ {
1407258
+ "Sid": "LogsViaCfnNetworkMigrationOperationsWrite",
1407259
+ "Effect": "Allow",
1407260
+ "Action": [
1407261
+ "logs:CreateLogGroup",
1407262
+ "logs:CreateLogStream",
1407263
+ "logs:PutLogEvents"
1407264
+ ],
1407265
+ "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/network-migration*",
1407266
+ "Condition": {
1407267
+ "ForAnyValue:StringEquals": {
1407268
+ "aws:CalledVia": [
1407269
+ "cloudformation.amazonaws.com"
1407270
+ ]
1407271
+ },
1407272
+ "StringEquals": {
1407273
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407274
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407275
+ }
1407276
+ }
1407277
+ },
1407278
+ {
1407279
+ "Sid": "MgnNetworkMigrationDefinitionCreate",
1407280
+ "Effect": "Allow",
1407281
+ "Action": [
1407282
+ "mgn:CreateNetworkMigrationDefinition"
1407283
+ ],
1407284
+ "Resource": "*",
1407285
+ "Condition": {
1407286
+ "StringEquals": {
1407287
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1407288
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1407289
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1407290
+ }
1407291
+ }
1407292
+ },
1407293
+ {
1407294
+ "Sid": "MgnNetworkMigrationDefinitionDelete",
1407295
+ "Effect": "Allow",
1407296
+ "Action": [
1407297
+ "mgn:DeleteNetworkMigrationDefinition"
1407298
+ ],
1407299
+ "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
1407300
+ "Condition": {
1407301
+ "StringEquals": {
1407302
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407303
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407304
+ "aws:ResourceTag/CreatedBy": [
1407305
+ "AWSTransform",
1407306
+ "QTransform"
1407307
+ ]
1407308
+ }
1407309
+ }
1407310
+ },
1407311
+ {
1407312
+ "Sid": "MgnNetworkMigrationDefinitionOperations",
1407313
+ "Effect": "Allow",
1407314
+ "Action": [
1407315
+ "mgn:GetNetworkMigrationDefinition",
1407316
+ "mgn:ListNetworkMigrationMappingUpdates",
1407317
+ "mgn:StartNetworkMigrationMappingUpdate",
1407318
+ "mgn:UpdateNetworkMigrationDefinition",
1407319
+ "mgn:UpdateNetworkMigrationMapperSegment",
1407320
+ "mgn:UpdateNetworkMigrationMapperSegmentConstruct"
1407321
+ ],
1407322
+ "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
1407323
+ "Condition": {
1407324
+ "StringEquals": {
1407325
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407326
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407327
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1407328
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1407329
+ }
1407330
+ }
1407331
+ },
1407332
+ {
1407333
+ "Sid": "MgnNetworkMigrationDefinitionTagOperationsWrite",
1407334
+ "Effect": "Allow",
1407335
+ "Action": [
1407336
+ "mgn:TagResource"
1407337
+ ],
1407338
+ "Resource": "arn:aws:mgn:*:*:network-migration-definition/*",
1407339
+ "Condition": {
1407340
+ "StringEquals": {
1407341
+ "aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1407342
+ "aws:RequestTag/CreatedBy": "AWSTransform",
1407343
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407344
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407345
+ "aws:ResourceTag/CreatedBy": "AWSTransform",
1407346
+ "mgn:CreateAction": "CreateNetworkMigrationDefinition"
1407347
+ }
1407348
+ }
1407349
+ },
1407350
+ {
1407351
+ "Sid": "NetworkMigrationOperationsReadOnly",
1407352
+ "Effect": "Allow",
1407353
+ "Action": [
1407354
+ "mgn:ListNetworkMigrationAnalyses",
1407355
+ "mgn:ListNetworkMigrationAnalysisResults",
1407356
+ "mgn:ListNetworkMigrationCodeGenerationSegments",
1407357
+ "mgn:ListNetworkMigrationCodeGenerations",
1407358
+ "mgn:ListNetworkMigrationDefinitions",
1407359
+ "mgn:ListNetworkMigrationDeployedStacks",
1407360
+ "mgn:ListNetworkMigrationDeployedStacksDeletions",
1407361
+ "mgn:ListNetworkMigrationDeployments",
1407362
+ "mgn:ListNetworkMigrationExecutions",
1407363
+ "mgn:ListNetworkMigrationMapperSegmentConstructs",
1407364
+ "mgn:ListNetworkMigrationMapperSegments",
1407365
+ "mgn:ListNetworkMigrationMappings"
1407366
+ ],
1407367
+ "Resource": "*",
1407368
+ "Condition": {
1407369
+ "StringEquals": {
1407370
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1407371
+ }
1407372
+ }
1407373
+ },
1407374
+ {
1407375
+ "Sid": "NetworkMigrationOperationsWrite",
1407376
+ "Effect": "Allow",
1407377
+ "Action": [
1407378
+ "mgn:StartNetworkMigrationAnalysis",
1407379
+ "mgn:StartNetworkMigrationCodeGeneration",
1407380
+ "mgn:StartNetworkMigrationDeployedStacksDeletion",
1407381
+ "mgn:StartNetworkMigrationDeployment",
1407382
+ "mgn:StartNetworkMigrationMapping"
1407383
+ ],
1407384
+ "Resource": "*",
1407385
+ "Condition": {
1407386
+ "StringEquals": {
1407387
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407388
+ "aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
1407389
+ "aws:ResourceTag/CreatedBy": "AWSTransform"
1407390
+ }
1407391
+ }
1407392
+ },
1407393
+ {
1407394
+ "Sid": "OrganizationsOperationsReadOnlyNetworkMigration",
1407395
+ "Effect": "Allow",
1407396
+ "Action": [
1407397
+ "organizations:ListAccounts"
1407398
+ ],
1407399
+ "Resource": "*"
1407400
+ },
1407401
+ {
1407402
+ "Sid": "RamShareCrossAccountOperationsReadOnly",
1407403
+ "Effect": "Allow",
1407404
+ "Action": [
1407405
+ "ram:GetResourceShares"
1407406
+ ],
1407407
+ "Resource": "*",
1407408
+ "Condition": {
1407409
+ "StringEquals": {
1407410
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1407411
+ }
1407412
+ }
1407413
+ },
1407414
+ {
1407415
+ "Sid": "RamViaCfnShareAssociateOperationsWrite",
1407416
+ "Effect": "Allow",
1407417
+ "Action": [
1407418
+ "ram:AssociateResourceShare"
1407419
+ ],
1407420
+ "Resource": "arn:aws:ram:*:*:resource-share/*",
1407421
+ "Condition": {
1407422
+ "ForAnyValue:StringEquals": {
1407423
+ "aws:CalledVia": [
1407424
+ "cloudformation.amazonaws.com"
1407425
+ ]
1407426
+ },
1407427
+ "StringEquals": {
1407428
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407429
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407430
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService",
1407431
+ "ram:RequestedResourceType": [
1407432
+ "ec2:TransitGateway",
1407433
+ "ssm:Parameter"
1407434
+ ]
1407435
+ }
1407436
+ }
1407437
+ },
1407438
+ {
1407439
+ "Sid": "RamViaCfnShareCreate",
1407440
+ "Effect": "Allow",
1407441
+ "Action": [
1407442
+ "ram:CreateResourceShare"
1407443
+ ],
1407444
+ "Resource": "arn:aws:ram:*:*:resource-share/*",
1407445
+ "Condition": {
1407446
+ "Bool": {
1407447
+ "ram:RequestedAllowsExternalPrincipals": "false"
1407448
+ },
1407449
+ "ForAnyValue:StringEquals": {
1407450
+ "aws:CalledVia": [
1407451
+ "cloudformation.amazonaws.com"
1407452
+ ]
1407453
+ },
1407454
+ "StringEquals": {
1407455
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407456
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407457
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407458
+ }
1407459
+ }
1407460
+ },
1407461
+ {
1407462
+ "Sid": "RamViaCfnShareOperations",
1407463
+ "Effect": "Allow",
1407464
+ "Action": [
1407465
+ "ram:DeleteResourceShare",
1407466
+ "ram:DisassociateResourceShare",
1407467
+ "ram:UpdateResourceShare"
1407468
+ ],
1407469
+ "Resource": "arn:aws:ram:*:*:resource-share/*",
1407470
+ "Condition": {
1407471
+ "ForAnyValue:StringEquals": {
1407472
+ "aws:CalledVia": [
1407473
+ "cloudformation.amazonaws.com"
1407474
+ ]
1407475
+ },
1407476
+ "StringEquals": {
1407477
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407478
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407479
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407480
+ }
1407481
+ }
1407482
+ },
1407483
+ {
1407484
+ "Sid": "RamViaCfnShareTagOperationsWrite",
1407485
+ "Effect": "Allow",
1407486
+ "Action": [
1407487
+ "ram:TagResource"
1407488
+ ],
1407489
+ "Resource": "arn:aws:ram:*:*:resource-share/*",
1407490
+ "Condition": {
1407491
+ "ForAnyValue:StringEquals": {
1407492
+ "aws:CalledVia": [
1407493
+ "cloudformation.amazonaws.com"
1407494
+ ]
1407495
+ },
1407496
+ "StringEquals": {
1407497
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407498
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407499
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407500
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407501
+ }
1407502
+ }
1407503
+ },
1407504
+ {
1407505
+ "Sid": "ReachabilityAnalyzerAnalysisStart",
1407506
+ "Effect": "Allow",
1407507
+ "Action": [
1407508
+ "ec2:CreateTags",
1407509
+ "ec2:StartNetworkInsightsAnalysis"
1407510
+ ],
1407511
+ "Resource": "arn:aws:ec2:*:*:network-insights-analysis/*",
1407512
+ "Condition": {
1407513
+ "StringEquals": {
1407514
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407515
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407516
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407517
+ }
1407518
+ }
1407519
+ },
1407520
+ {
1407521
+ "Sid": "ReachabilityAnalyzerCleanupOperationsWrite",
1407522
+ "Effect": "Allow",
1407523
+ "Action": [
1407524
+ "ec2:AuthorizeSecurityGroupEgress",
1407525
+ "ec2:AuthorizeSecurityGroupIngress",
1407526
+ "ec2:DeleteNetworkInsightsAnalysis",
1407527
+ "ec2:DeleteNetworkInsightsPath",
1407528
+ "ec2:DeleteNetworkInterface",
1407529
+ "ec2:DeleteSecurityGroup"
1407530
+ ],
1407531
+ "Resource": "*",
1407532
+ "Condition": {
1407533
+ "StringEquals": {
1407534
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407535
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407536
+ }
1407537
+ }
1407538
+ },
1407539
+ {
1407540
+ "Sid": "ReachabilityAnalyzerCreateWithRequestTag",
1407541
+ "Effect": "Allow",
1407542
+ "Action": [
1407543
+ "ec2:CreateNetworkInsightsPath",
1407544
+ "ec2:CreateNetworkInterface"
1407545
+ ],
1407546
+ "Resource": "*",
1407547
+ "Condition": {
1407548
+ "StringEquals": {
1407549
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407550
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1407551
+ }
1407552
+ }
1407553
+ },
1407554
+ {
1407555
+ "Sid": "ReachabilityAnalyzerCreateWithResourceTag",
1407556
+ "Effect": "Allow",
1407557
+ "Action": [
1407558
+ "ec2:CreateNetworkInsightsPath",
1407559
+ "ec2:CreateNetworkInterface",
1407560
+ "ec2:CreateSecurityGroup",
1407561
+ "ec2:StartNetworkInsightsAnalysis"
1407562
+ ],
1407563
+ "Resource": "*",
1407564
+ "Condition": {
1407565
+ "StringEquals": {
1407566
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407567
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407568
+ }
1407569
+ }
1407570
+ },
1407571
+ {
1407572
+ "Sid": "ReachabilityAnalyzerCrossOrgPathCreate",
1407573
+ "Effect": "Allow",
1407574
+ "Action": [
1407575
+ "ec2:CreateNetworkInsightsPath"
1407576
+ ],
1407577
+ "Resource": "arn:aws:ec2:*:*:network-interface/*",
1407578
+ "Condition": {
1407579
+ "StringEquals": {
1407580
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407581
+ "aws:ResourceOrgID": "${aws:PrincipalOrgID}"
1407582
+ }
1407583
+ }
1407584
+ },
1407585
+ {
1407586
+ "Sid": "ReachabilityAnalyzerOperationsReadOnly",
1407587
+ "Effect": "Allow",
1407588
+ "Action": [
1407589
+ "directconnect:DescribeConnections",
1407590
+ "directconnect:DescribeDirectConnectGatewayAssociations",
1407591
+ "directconnect:DescribeDirectConnectGatewayAttachments",
1407592
+ "directconnect:DescribeDirectConnectGateways",
1407593
+ "directconnect:DescribeVirtualGateways",
1407594
+ "directconnect:DescribeVirtualInterfaces",
1407595
+ "ec2:DescribeAvailabilityZones",
1407596
+ "ec2:DescribeCustomerGateways",
1407597
+ "ec2:DescribeInstances",
1407598
+ "ec2:DescribeInternetGateways",
1407599
+ "ec2:DescribeManagedPrefixLists",
1407600
+ "ec2:DescribeNatGateways",
1407601
+ "ec2:DescribeNetworkAcls",
1407602
+ "ec2:DescribeNetworkInsightsAnalyses",
1407603
+ "ec2:DescribeNetworkInsightsPaths",
1407604
+ "ec2:DescribeNetworkInterfaces",
1407605
+ "ec2:DescribePrefixLists",
1407606
+ "ec2:DescribeRegions",
1407607
+ "ec2:DescribeRouteTables",
1407608
+ "ec2:DescribeSecurityGroupRules",
1407609
+ "ec2:DescribeSecurityGroups",
1407610
+ "ec2:DescribeSubnets",
1407611
+ "ec2:DescribeTransitGatewayAttachments",
1407612
+ "ec2:DescribeTransitGatewayConnects",
1407613
+ "ec2:DescribeTransitGatewayPeeringAttachments",
1407614
+ "ec2:DescribeTransitGatewayRouteTables",
1407615
+ "ec2:DescribeTransitGatewayVpcAttachments",
1407616
+ "ec2:DescribeTransitGateways",
1407617
+ "ec2:DescribeVpcEndpointServiceConfigurations",
1407618
+ "ec2:DescribeVpcEndpoints",
1407619
+ "ec2:DescribeVpcPeeringConnections",
1407620
+ "ec2:DescribeVpcs",
1407621
+ "ec2:DescribeVpnConnections",
1407622
+ "ec2:DescribeVpnGateways",
1407623
+ "ec2:GetManagedPrefixListEntries",
1407624
+ "ec2:GetTransitGatewayRouteTablePropagations",
1407625
+ "ec2:SearchTransitGatewayRoutes",
1407626
+ "elasticloadbalancing:DescribeListeners",
1407627
+ "elasticloadbalancing:DescribeLoadBalancerAttributes",
1407628
+ "elasticloadbalancing:DescribeLoadBalancers",
1407629
+ "elasticloadbalancing:DescribeRules",
1407630
+ "elasticloadbalancing:DescribeTags",
1407631
+ "elasticloadbalancing:DescribeTargetGroupAttributes",
1407632
+ "elasticloadbalancing:DescribeTargetGroups",
1407633
+ "elasticloadbalancing:DescribeTargetHealth",
1407634
+ "globalaccelerator:ListAccelerators",
1407635
+ "globalaccelerator:ListCustomRoutingAccelerators",
1407636
+ "globalaccelerator:ListCustomRoutingEndpointGroups",
1407637
+ "globalaccelerator:ListCustomRoutingListeners",
1407638
+ "globalaccelerator:ListCustomRoutingPortMappings",
1407639
+ "globalaccelerator:ListEndpointGroups",
1407640
+ "globalaccelerator:ListListeners",
1407641
+ "network-firewall:DescribeFirewall",
1407642
+ "network-firewall:DescribeFirewallPolicy",
1407643
+ "network-firewall:DescribeResourcePolicy",
1407644
+ "network-firewall:DescribeRuleGroup",
1407645
+ "network-firewall:ListFirewallPolicies",
1407646
+ "network-firewall:ListFirewalls",
1407647
+ "network-firewall:ListRuleGroups",
1407648
+ "tiros:CreateQuery",
1407649
+ "tiros:ExtendQuery",
1407650
+ "tiros:GetQueryAnswer",
1407651
+ "tiros:GetQueryExplanation",
1407652
+ "tiros:GetQueryExtensionAccounts"
1407653
+ ],
1407654
+ "Resource": "*",
1407655
+ "Condition": {
1407656
+ "StringEquals": {
1407657
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1407658
+ }
1407659
+ }
1407660
+ },
1407661
+ {
1407662
+ "Sid": "ReachabilityAnalyzerProbeCreateOnSecurityGroup",
1407663
+ "Effect": "Allow",
1407664
+ "Action": [
1407665
+ "ec2:CreateNetworkInterface"
1407666
+ ],
1407667
+ "Resource": "arn:aws:ec2:*:*:security-group/*",
1407668
+ "Condition": {
1407669
+ "StringEquals": {
1407670
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407671
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407672
+ }
1407673
+ }
1407674
+ },
1407675
+ {
1407676
+ "Sid": "ReachabilityAnalyzerSecurityGroupCreateOnVpc",
1407677
+ "Effect": "Allow",
1407678
+ "Action": [
1407679
+ "ec2:CreateSecurityGroup"
1407680
+ ],
1407681
+ "Resource": "arn:aws:ec2:*:*:vpc/*",
1407682
+ "Condition": {
1407683
+ "StringEquals": {
1407684
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407685
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407686
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407687
+ }
1407688
+ }
1407689
+ },
1407690
+ {
1407691
+ "Sid": "ReachabilityAnalyzerSecurityGroupCreateWithRequestTag",
1407692
+ "Effect": "Allow",
1407693
+ "Action": [
1407694
+ "ec2:CreateSecurityGroup"
1407695
+ ],
1407696
+ "Resource": [
1407697
+ "arn:aws:ec2:*:*:security-group-rule/*",
1407698
+ "arn:aws:ec2:*:*:security-group/*"
1407699
+ ],
1407700
+ "Condition": {
1407701
+ "StringEquals": {
1407702
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407703
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407704
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407705
+ }
1407706
+ }
1407707
+ },
1407708
+ {
1407709
+ "Sid": "S3TargetBucketOperationsNetworkMigration",
1407710
+ "Effect": "Allow",
1407711
+ "Action": [
1407712
+ "s3:CreateBucket",
1407713
+ "s3:GetBucketLocation",
1407714
+ "s3:GetBucketPublicAccessBlock",
1407715
+ "s3:GetBucketTagging",
1407716
+ "s3:ListBucket",
1407717
+ "s3:PutBucketTagging",
1407718
+ "s3:PutEncryptionConfiguration"
1407719
+ ],
1407720
+ "Resource": "arn:aws:s3:::transform-vmware-target-*",
1407721
+ "Condition": {
1407722
+ "StringEquals": {
1407723
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407724
+ }
1407725
+ }
1407726
+ },
1407727
+ {
1407728
+ "Sid": "S3TargetObjectOperationsNetworkMigration",
1407729
+ "Effect": "Allow",
1407730
+ "Action": [
1407731
+ "s3:AbortMultipartUpload",
1407732
+ "s3:DeleteObject",
1407733
+ "s3:GetObject",
1407734
+ "s3:GetObjectAttributes",
1407735
+ "s3:GetObjectVersion",
1407736
+ "s3:ListBucketMultipartUploads",
1407737
+ "s3:ListMultipartUploadParts",
1407738
+ "s3:PutObject"
1407739
+ ],
1407740
+ "Resource": "arn:aws:s3:::transform-vmware-target-*/*",
1407741
+ "Condition": {
1407742
+ "StringEquals": {
1407743
+ "aws:ResourceAccount": "${aws:PrincipalAccount}"
1407744
+ }
1407745
+ }
1407746
+ },
1407747
+ {
1407748
+ "Sid": "SsmParametersViaCfnOperationsReadOnly",
1407749
+ "Effect": "Allow",
1407750
+ "Action": [
1407751
+ "ssm:GetParameters"
1407752
+ ],
1407753
+ "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
1407754
+ "Condition": {
1407755
+ "ForAnyValue:StringEquals": {
1407756
+ "aws:CalledVia": [
1407757
+ "cloudformation.amazonaws.com"
1407758
+ ]
1407759
+ },
1407760
+ "StringEquals": {
1407761
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
1407762
+ }
1407763
+ }
1407764
+ },
1407765
+ {
1407766
+ "Sid": "SsmParametersViaCfnOperationsWriteWithRequestTag",
1407767
+ "Effect": "Allow",
1407768
+ "Action": [
1407769
+ "ssm:AddTagsToResource",
1407770
+ "ssm:PutParameter"
1407771
+ ],
1407772
+ "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
1407773
+ "Condition": {
1407774
+ "ForAnyValue:StringEquals": {
1407775
+ "aws:CalledVia": [
1407776
+ "cloudformation.amazonaws.com"
1407777
+ ]
1407778
+ },
1407779
+ "StringEquals": {
1407780
+ "aws:RequestTag/CreatedBy": "AWSApplicationMigrationService",
1407781
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407782
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407783
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407784
+ }
1407785
+ }
1407786
+ },
1407787
+ {
1407788
+ "Sid": "SsmParametersViaCfnOperationsWriteWithResourceTag",
1407789
+ "Effect": "Allow",
1407790
+ "Action": [
1407791
+ "ssm:DeleteParameter",
1407792
+ "ssm:DeleteResourcePolicy",
1407793
+ "ssm:GetResourcePolicies",
1407794
+ "ssm:ListTagsForResource",
1407795
+ "ssm:PutResourcePolicy"
1407796
+ ],
1407797
+ "Resource": "arn:aws:ssm:*:*:parameter/network-migration/*",
1407798
+ "Condition": {
1407799
+ "ForAnyValue:StringEquals": {
1407800
+ "aws:CalledVia": [
1407801
+ "cloudformation.amazonaws.com"
1407802
+ ]
1407803
+ },
1407804
+ "StringEquals": {
1407805
+ "aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
1407806
+ "aws:ResourceAccount": "${aws:PrincipalAccount}",
1407807
+ "aws:ResourceTag/CreatedBy": "AWSApplicationMigrationService"
1407808
+ }
1407809
+ }
1407810
+ },
1407811
+ {
1407812
+ "Sid": "StsCrossAccountAssumeRoleNetworkMigration",
1407813
+ "Effect": "Allow",
1407814
+ "Action": [
1407815
+ "sts:AssumeRole"
1407816
+ ],
1407817
+ "Resource": "arn:aws:iam::*:role/AWSTransformNetworkMigrationAgentSharingRole_${aws:PrincipalAccount}",
1407818
+ "Condition": {
1407819
+ "StringEquals": {
1407820
+ "aws:ResourceOrgID": "${aws:PrincipalOrgID}",
1407821
+ "sts:ExternalId": "${aws:PrincipalAccount}:workspace/${aws:PrincipalTag/WorkspaceId}"
1407822
+ }
1407823
+ }
1407824
+ }
1407825
+ ]
1407826
+ }
1407827
+ }
1407828
+ },
1407829
+ "createdDate": "2026-08-06T15:27:26.000Z",
1407830
+ "lastUpdatedDate": "2026-08-06T15:27:26.000Z"
1407831
+ },
1407832
+ "AWSBackupAccessPointOperatorAccess": {
1407833
+ "arn": "arn:aws:iam::aws:policy/AWSBackupAccessPointOperatorAccess",
1407834
+ "latestVersionId": "v1",
1407835
+ "versionsCount": 1,
1407836
+ "versions": {
1407837
+ "v1": {
1407838
+ "createdDate": "2026-08-06T16:12:24.000Z",
1407839
+ "document": {
1407840
+ "Version": "2012-10-17",
1407841
+ "Statement": [
1407842
+ {
1407843
+ "Sid": "CreateBackupAccessPointPermissions",
1407844
+ "Effect": "Allow",
1407845
+ "Action": [
1407846
+ "backup:CreateBackupAccessPoint"
1407847
+ ],
1407848
+ "Resource": "arn:aws:backup:*:*:recovery-point:*"
1407849
+ },
1407850
+ {
1407851
+ "Sid": "BackupAccessPointPermissions",
1407852
+ "Effect": "Allow",
1407853
+ "Action": [
1407854
+ "backup:DescribeBackupAccessPoint",
1407855
+ "backup:DeleteBackupAccessPoint"
1407856
+ ],
1407857
+ "Resource": "arn:aws:backup:*:*:accesspoint/*"
1407858
+ },
1407859
+ {
1407860
+ "Sid": "ListBackupAccessPointPermissions",
1407861
+ "Effect": "Allow",
1407862
+ "Action": [
1407863
+ "backup:ListBackupAccessPoints",
1407864
+ "backup:ListBackupAccessPointsByResource",
1407865
+ "backup:ListBackupAccessPointsByRecoveryPoint"
1407866
+ ],
1407867
+ "Resource": "*"
1407868
+ },
1407869
+ {
1407870
+ "Sid": "S3AccessPointPermissions",
1407871
+ "Effect": "Allow",
1407872
+ "Action": [
1407873
+ "s3:CreateAccessPoint",
1407874
+ "s3:DeleteAccessPoint",
1407875
+ "s3:GetAccessPoint",
1407876
+ "s3:PutAccessPointPolicy"
1407877
+ ],
1407878
+ "Resource": "arn:aws:s3:*:*:accesspoint/*",
1407879
+ "Condition": {
1407880
+ "ForAnyValue:StringEquals": {
1407881
+ "aws:CalledVia": "backup.amazonaws.com"
1407882
+ }
1407883
+ }
1407884
+ },
1407885
+ {
1407886
+ "Sid": "DecryptKMSEncryptedDataByAWSBackup",
1407887
+ "Effect": "Allow",
1407888
+ "Action": [
1407889
+ "kms:Decrypt"
1407890
+ ],
1407891
+ "Resource": "arn:aws:kms:*:*:key/*",
1407892
+ "Condition": {
1407893
+ "StringLike": {
1407894
+ "kms:ViaService": "backup.*.amazonaws.com",
1407895
+ "kms:EncryptionContext:aws:backup:backup-vault": "*"
1407896
+ }
1407897
+ }
1407898
+ }
1407899
+ ]
1407900
+ }
1407901
+ }
1407902
+ },
1407903
+ "createdDate": "2026-08-06T16:12:24.000Z",
1407904
+ "lastUpdatedDate": "2026-08-06T16:12:24.000Z"
1407905
+ },
1407906
+ "AgentRegistryFullAccess": {
1407907
+ "arn": "arn:aws:iam::aws:policy/AgentRegistryFullAccess",
1407908
+ "latestVersionId": "v1",
1407909
+ "versionsCount": 1,
1407910
+ "versions": {
1407911
+ "v1": {
1407912
+ "createdDate": "2026-08-06T18:12:14.000Z",
1407913
+ "document": {
1407914
+ "Version": "2012-10-17",
1407915
+ "Statement": [
1407916
+ {
1407917
+ "Sid": "AgentRegistryFullAccess",
1407918
+ "Effect": "Allow",
1407919
+ "Action": "agent-registry:*",
1407920
+ "Resource": "arn:aws:agent-registry:*:*:*"
1407921
+ },
1407922
+ {
1407923
+ "Sid": "AgentRegistryPassRoleAccess",
1407924
+ "Effect": "Allow",
1407925
+ "Action": "iam:PassRole",
1407926
+ "Resource": "arn:aws:iam::*:role/*",
1407927
+ "Condition": {
1407928
+ "StringEquals": {
1407929
+ "iam:PassedToService": "agent-registry.amazonaws.com"
1407930
+ }
1407931
+ }
1407932
+ },
1407933
+ {
1407934
+ "Sid": "AgentRegistryWorkloadIdentityAccess",
1407935
+ "Effect": "Allow",
1407936
+ "Action": [
1407937
+ "bedrock-agentcore:CreateWorkloadIdentity",
1407938
+ "bedrock-agentcore:DeleteWorkloadIdentity",
1407939
+ "bedrock-agentcore:GetWorkloadAccessToken",
1407940
+ "bedrock-agentcore:GetWorkloadIdentity"
1407941
+ ],
1407942
+ "Resource": "arn:aws:bedrock-agentcore:*:*:workload-identity-directory/*"
1407943
+ },
1407944
+ {
1407945
+ "Sid": "AllowGetResourceOauth2TokenForOauthBasedSynchronization",
1407946
+ "Effect": "Allow",
1407947
+ "Action": [
1407948
+ "bedrock-agentcore:GetResourceOauth2Token"
1407949
+ ],
1407950
+ "Resource": "arn:aws:bedrock-agentcore:*:*:credential-provider/*"
1407951
+ },
1407952
+ {
1407953
+ "Sid": "AllowListOauth2CredentialsProvidersForConsolePicker",
1407954
+ "Effect": "Allow",
1407955
+ "Action": [
1407956
+ "bedrock-agentcore:ListOauth2CredentialProviders"
1407957
+ ],
1407958
+ "Resource": "arn:aws:bedrock-agentcore:*:*:*"
1407959
+ },
1407960
+ {
1407961
+ "Sid": "IAMListAccess",
1407962
+ "Effect": "Allow",
1407963
+ "Action": [
1407964
+ "iam:ListRoles"
1407965
+ ],
1407966
+ "Resource": "arn:aws:iam::*:role/*"
1407967
+ },
1407968
+ {
1407969
+ "Sid": "AgentRegistryKMSAccess",
1407970
+ "Effect": "Allow",
1407971
+ "Action": [
1407972
+ "kms:Decrypt"
1407973
+ ],
1407974
+ "Resource": "arn:aws:kms:*:*:key/*",
1407975
+ "Condition": {
1407976
+ "StringLike": {
1407977
+ "kms:ViaService": "agent-registry.*.amazonaws.com"
1407978
+ }
1407979
+ }
1407980
+ },
1407981
+ {
1407982
+ "Sid": "AgentRegistrySecretsManagerAccess",
1407983
+ "Effect": "Allow",
1407984
+ "Action": [
1407985
+ "secretsmanager:GetSecretValue"
1407986
+ ],
1407987
+ "Resource": "arn:aws:secretsmanager:*:*:secret:*"
1407988
+ },
1407989
+ {
1407990
+ "Sid": "AgentRegistryServiceLinkedRoleAccess",
1407991
+ "Effect": "Allow",
1407992
+ "Action": "iam:CreateServiceLinkedRole",
1407993
+ "Resource": "arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry",
1407994
+ "Condition": {
1407995
+ "StringLike": {
1407996
+ "iam:AWSServiceName": "agent-registry.amazonaws.com"
1407997
+ }
1407998
+ }
1407999
+ }
1408000
+ ]
1408001
+ }
1408002
+ }
1408003
+ },
1408004
+ "createdDate": "2026-08-06T18:12:14.000Z",
1408005
+ "lastUpdatedDate": "2026-08-06T18:12:14.000Z"
1408006
+ },
1408007
+ "AgentRegistryReadOnlyAccess": {
1408008
+ "arn": "arn:aws:iam::aws:policy/AgentRegistryReadOnlyAccess",
1408009
+ "latestVersionId": "v1",
1408010
+ "versionsCount": 1,
1408011
+ "versions": {
1408012
+ "v1": {
1408013
+ "createdDate": "2026-08-06T18:12:29.000Z",
1408014
+ "document": {
1408015
+ "Version": "2012-10-17",
1408016
+ "Statement": [
1408017
+ {
1408018
+ "Sid": "AgentRegistryReadOnlyAccess",
1408019
+ "Effect": "Allow",
1408020
+ "Action": [
1408021
+ "agent-registry:GetRegistry",
1408022
+ "agent-registry:ListRegistries",
1408023
+ "agent-registry:GetRegistryRecord",
1408024
+ "agent-registry:ListRegistryRecords",
1408025
+ "agent-registry:ListDiscoverableRegistryRecords",
1408026
+ "agent-registry:GetDiscoverableRegistryRecord",
1408027
+ "agent-registry:InvokeRegistryMcp",
1408028
+ "agent-registry:SearchDiscoverableRegistryRecords",
1408029
+ "agent-registry:ListTagsForResource"
1408030
+ ],
1408031
+ "Resource": "arn:aws:agent-registry:*:*:*"
1408032
+ }
1408033
+ ]
1408034
+ }
1408035
+ }
1408036
+ },
1408037
+ "createdDate": "2026-08-06T18:12:29.000Z",
1408038
+ "lastUpdatedDate": "2026-08-06T18:12:29.000Z"
1408039
+ },
1408040
+ "AmazonODBReadOnlyAccess": {
1408041
+ "arn": "arn:aws:iam::aws:policy/AmazonODBReadOnlyAccess",
1408042
+ "latestVersionId": "v1",
1408043
+ "versionsCount": 1,
1408044
+ "versions": {
1408045
+ "v1": {
1408046
+ "createdDate": "2026-08-07T01:12:14.000Z",
1408047
+ "document": {
1408048
+ "Version": "2012-10-17",
1408049
+ "Statement": [
1408050
+ {
1408051
+ "Sid": "AllowODBReads",
1408052
+ "Effect": "Allow",
1408053
+ "Action": [
1408054
+ "odb:GetOciOnboardingStatus",
1408055
+ "odb:GetCloudExadataInfrastructure",
1408056
+ "odb:GetCloudExadataInfrastructureUnallocatedResources",
1408057
+ "odb:ListCloudExadataInfrastructures",
1408058
+ "odb:GetCloudVmCluster",
1408059
+ "odb:ListCloudVmClusters",
1408060
+ "odb:GetCloudAutonomousVmCluster",
1408061
+ "odb:ListCloudAutonomousVmClusters",
1408062
+ "odb:GetAutonomousDatabase",
1408063
+ "odb:ListAutonomousDatabases",
1408064
+ "odb:ListAutonomousDatabaseClones",
1408065
+ "odb:ListAutonomousDatabasePeers",
1408066
+ "odb:GetAutonomousDatabaseBackup",
1408067
+ "odb:ListAutonomousDatabaseBackups",
1408068
+ "odb:GetDbNode",
1408069
+ "odb:ListDbNodes",
1408070
+ "odb:GetDbServer",
1408071
+ "odb:ListDbServers",
1408072
+ "odb:GetOdbNetwork",
1408073
+ "odb:ListOdbNetworks",
1408074
+ "odb:GetOdbPeeringConnection",
1408075
+ "odb:ListOdbPeeringConnections",
1408076
+ "odb:ListAutonomousVirtualMachines",
1408077
+ "odb:ListDbSystemShapes",
1408078
+ "odb:ListGiVersions",
1408079
+ "odb:ListSystemVersions",
1408080
+ "odb:ListAutonomousDatabaseVersions",
1408081
+ "odb:ListAutonomousDatabaseCharacterSets",
1408082
+ "odb:GetResourcePolicy",
1408083
+ "odb:ListTagsForResource"
1408084
+ ],
1408085
+ "Resource": "*"
1408086
+ },
1408087
+ {
1408088
+ "Sid": "AllowEC2Reads",
1408089
+ "Effect": "Allow",
1408090
+ "Action": [
1408091
+ "ec2:DescribeAvailabilityZones",
1408092
+ "ec2:DescribeVpcs"
1408093
+ ],
1408094
+ "Resource": "*"
1408095
+ }
1408096
+ ]
1408097
+ }
1408098
+ }
1408099
+ },
1408100
+ "createdDate": "2026-08-07T01:12:14.000Z",
1408101
+ "lastUpdatedDate": "2026-08-07T01:12:14.000Z"
1408102
+ },
1408103
+ "AmazonODBNetworkAdmin": {
1408104
+ "arn": "arn:aws:iam::aws:policy/job-function/AmazonODBNetworkAdmin",
1408105
+ "latestVersionId": "v1",
1408106
+ "versionsCount": 1,
1408107
+ "versions": {
1408108
+ "v1": {
1408109
+ "createdDate": "2026-08-07T01:12:22.000Z",
1408110
+ "document": {
1408111
+ "Version": "2012-10-17",
1408112
+ "Statement": [
1408113
+ {
1408114
+ "Sid": "AllowODBActions",
1408115
+ "Effect": "Allow",
1408116
+ "Action": [
1408117
+ "odb:GetOciOnboardingStatus",
1408118
+ "odb:InitializeService",
1408119
+ "odb:CreateOdbNetwork",
1408120
+ "odb:GetOdbNetwork",
1408121
+ "odb:UpdateOdbNetwork",
1408122
+ "odb:DeleteOdbNetwork",
1408123
+ "odb:ListOdbNetworks",
1408124
+ "odb:CreateOdbPeeringConnection",
1408125
+ "odb:GetOdbPeeringConnection",
1408126
+ "odb:UpdateOdbPeeringConnection",
1408127
+ "odb:DeleteOdbPeeringConnection",
1408128
+ "odb:ListOdbPeeringConnections",
1408129
+ "odb:PutResourcePolicy",
1408130
+ "odb:GetResourcePolicy",
1408131
+ "odb:DeleteResourcePolicy",
1408132
+ "odb:ListTagsForResource"
1408133
+ ],
1408134
+ "Resource": "*"
1408135
+ },
1408136
+ {
1408137
+ "Sid": "AllowEC2Actions",
1408138
+ "Effect": "Allow",
1408139
+ "Action": [
1408140
+ "ec2:DescribeAvailabilityZones",
1408141
+ "ec2:DescribeVpcs"
1408142
+ ],
1408143
+ "Resource": "*"
1408144
+ },
1408145
+ {
1408146
+ "Sid": "AllowOdbNetworkPeeringActions",
1408147
+ "Effect": "Allow",
1408148
+ "Action": [
1408149
+ "ec2:CreateOdbNetworkPeering",
1408150
+ "ec2:ModifyOdbNetworkPeering",
1408151
+ "ec2:DeleteOdbNetworkPeering"
1408152
+ ],
1408153
+ "Resource": "*",
1408154
+ "Condition": {
1408155
+ "ForAnyValue:StringEquals": {
1408156
+ "aws:CalledVia": "odb.amazonaws.com"
1408157
+ }
1408158
+ }
1408159
+ },
1408160
+ {
1408161
+ "Sid": "AllowSLRActions",
1408162
+ "Effect": "Allow",
1408163
+ "Action": [
1408164
+ "iam:CreateServiceLinkedRole"
1408165
+ ],
1408166
+ "Resource": "*",
1408167
+ "Condition": {
1408168
+ "StringEquals": {
1408169
+ "iam:AWSServiceName": [
1408170
+ "odb.amazonaws.com",
1408171
+ "vpc-lattice.amazonaws.com"
1408172
+ ]
1408173
+ }
1408174
+ }
1408175
+ },
1408176
+ {
1408177
+ "Sid": "AllowTaggingActions",
1408178
+ "Effect": "Allow",
1408179
+ "Action": [
1408180
+ "odb:TagResource",
1408181
+ "odb:UntagResource"
1408182
+ ],
1408183
+ "Resource": [
1408184
+ "arn:aws:odb:*:*:odb-network/*",
1408185
+ "arn:aws:odb:*:*:odb-peering-connection/*"
1408186
+ ]
1408187
+ }
1408188
+ ]
1408189
+ }
1408190
+ }
1408191
+ },
1408192
+ "createdDate": "2026-08-07T01:12:22.000Z",
1408193
+ "lastUpdatedDate": "2026-08-07T01:12:22.000Z"
1408194
+ },
1408195
+ "AmazonODBExadataInfrastructureAdmin": {
1408196
+ "arn": "arn:aws:iam::aws:policy/job-function/AmazonODBExadataInfrastructureAdmin",
1408197
+ "latestVersionId": "v1",
1408198
+ "versionsCount": 1,
1408199
+ "versions": {
1408200
+ "v1": {
1408201
+ "createdDate": "2026-08-07T01:12:27.000Z",
1408202
+ "document": {
1408203
+ "Version": "2012-10-17",
1408204
+ "Statement": [
1408205
+ {
1408206
+ "Sid": "AllowODBActions",
1408207
+ "Effect": "Allow",
1408208
+ "Action": [
1408209
+ "odb:GetOciOnboardingStatus",
1408210
+ "odb:InitializeService",
1408211
+ "odb:CreateCloudExadataInfrastructure",
1408212
+ "odb:GetCloudExadataInfrastructure",
1408213
+ "odb:UpdateCloudExadataInfrastructure",
1408214
+ "odb:GetCloudExadataInfrastructureUnallocatedResources",
1408215
+ "odb:DeleteCloudExadataInfrastructure",
1408216
+ "odb:ListCloudExadataInfrastructures",
1408217
+ "odb:ListCloudVmClusters",
1408218
+ "odb:ListCloudAutonomousVmClusters",
1408219
+ "odb:GetDbServer",
1408220
+ "odb:ListDbServers",
1408221
+ "odb:ListDbSystemShapes",
1408222
+ "odb:PutResourcePolicy",
1408223
+ "odb:GetResourcePolicy",
1408224
+ "odb:DeleteResourcePolicy",
1408225
+ "odb:ListTagsForResource"
1408226
+ ],
1408227
+ "Resource": "*"
1408228
+ },
1408229
+ {
1408230
+ "Sid": "AllowEC2Actions",
1408231
+ "Effect": "Allow",
1408232
+ "Action": [
1408233
+ "ec2:DescribeAvailabilityZones"
1408234
+ ],
1408235
+ "Resource": "*"
1408236
+ },
1408237
+ {
1408238
+ "Sid": "AllowSLRActions",
1408239
+ "Effect": "Allow",
1408240
+ "Action": [
1408241
+ "iam:CreateServiceLinkedRole"
1408242
+ ],
1408243
+ "Resource": "*",
1408244
+ "Condition": {
1408245
+ "StringEquals": {
1408246
+ "iam:AWSServiceName": [
1408247
+ "odb.amazonaws.com"
1408248
+ ]
1408249
+ }
1408250
+ }
1408251
+ },
1408252
+ {
1408253
+ "Sid": "AllowTaggingActions",
1408254
+ "Effect": "Allow",
1408255
+ "Action": [
1408256
+ "odb:TagResource",
1408257
+ "odb:UntagResource"
1408258
+ ],
1408259
+ "Resource": [
1408260
+ "arn:aws:odb:*:*:cloud-exadata-infrastructure/*"
1408261
+ ]
1408262
+ }
1408263
+ ]
1408264
+ }
1408265
+ }
1408266
+ },
1408267
+ "createdDate": "2026-08-07T01:12:27.000Z",
1408268
+ "lastUpdatedDate": "2026-08-07T01:12:27.000Z"
1408269
+ },
1408270
+ "AmazonODBAutonomousVmClusterAdmin": {
1408271
+ "arn": "arn:aws:iam::aws:policy/job-function/AmazonODBAutonomousVmClusterAdmin",
1408272
+ "latestVersionId": "v1",
1408273
+ "versionsCount": 1,
1408274
+ "versions": {
1408275
+ "v1": {
1408276
+ "createdDate": "2026-08-07T01:12:28.000Z",
1408277
+ "document": {
1408278
+ "Version": "2012-10-17",
1408279
+ "Statement": [
1408280
+ {
1408281
+ "Sid": "AllowODBActions",
1408282
+ "Effect": "Allow",
1408283
+ "Action": [
1408284
+ "odb:GetOciOnboardingStatus",
1408285
+ "odb:InitializeService",
1408286
+ "odb:GetCloudExadataInfrastructure",
1408287
+ "odb:GetCloudExadataInfrastructureUnallocatedResources",
1408288
+ "odb:ListCloudExadataInfrastructures",
1408289
+ "odb:CreateCloudAutonomousVmCluster",
1408290
+ "odb:GetCloudAutonomousVmCluster",
1408291
+ "odb:DeleteCloudAutonomousVmCluster",
1408292
+ "odb:ListCloudAutonomousVmClusters",
1408293
+ "odb:ListDbServers",
1408294
+ "odb:GetOdbNetwork",
1408295
+ "odb:ListOdbNetworks",
1408296
+ "odb:ListAutonomousVirtualMachines",
1408297
+ "odb:ListDbSystemShapes",
1408298
+ "odb:ListGiVersions",
1408299
+ "odb:ListSystemVersions",
1408300
+ "odb:ListTagsForResource"
1408301
+ ],
1408302
+ "Resource": "*"
1408303
+ },
1408304
+ {
1408305
+ "Sid": "AllowEC2Actions",
1408306
+ "Effect": "Allow",
1408307
+ "Action": [
1408308
+ "ec2:DescribeAvailabilityZones"
1408309
+ ],
1408310
+ "Resource": "*"
1408311
+ },
1408312
+ {
1408313
+ "Sid": "AllowTaggingActions",
1408314
+ "Effect": "Allow",
1408315
+ "Action": [
1408316
+ "odb:TagResource",
1408317
+ "odb:UntagResource"
1408318
+ ],
1408319
+ "Resource": [
1408320
+ "arn:aws:odb:*:*:cloud-autonomous-vm-cluster/*"
1408321
+ ]
1408322
+ },
1408323
+ {
1408324
+ "Sid": "AllowOutboundIntegrationActions",
1408325
+ "Effect": "Allow",
1408326
+ "Action": [
1408327
+ "odb:CreateOutboundIntegration"
1408328
+ ],
1408329
+ "Resource": [
1408330
+ "arn:aws:odb:*:*:cloud-autonomous-vm-cluster/*"
1408331
+ ]
1408332
+ }
1408333
+ ]
1408334
+ }
1408335
+ }
1408336
+ },
1408337
+ "createdDate": "2026-08-07T01:12:28.000Z",
1408338
+ "lastUpdatedDate": "2026-08-07T01:12:28.000Z"
1403943
1408339
  }
1403944
1408340
  }