AWS transform documentation change
Summary
Updated IAM roles section: consolidated roles, renamed connector role, and removed outdated role descriptions
Security assessment
Changes clarify IAM role creation but don't reference any security vulnerability fix. The update focuses on accuracy of role names and creation workflow, not security enhancements or vulnerability remediation.
Diff
diff --git a/transform/latest/userguide/transform-vmware-connect-target-account.md b/transform/latest/userguide/transform-vmware-connect-target-account.md index 1157838b5..d1aeb4214 100644 --- a//transform/latest/userguide/transform-vmware-connect-target-account.md +++ b//transform/latest/userguide/transform-vmware-connect-target-account.md @@ -102 +102 @@ For more information, see [Delegated administrator for Application Migration Ser -### IAM roles created during setup +### IAM roles created during connector setup @@ -104 +104 @@ For more information, see [Delegated administrator for Application Migration Ser -During migration setup, a CloudFormation StackSet (`MGNMultiAccountRoles`) is deployed to create the required IAM roles across your target accounts. These roles grant the permissions that AWS Transform needs to replicate servers, launch instances, and install agents in each target account. The following roles are created: +During connector setup, AWS Transform creates the following IAM role in your target account: @@ -106 +106 @@ During migration setup, a CloudFormation StackSet (`MGNMultiAccountRoles`) is de - * `AWSApplicationMigrationConnectorManagementRole` – Used during agent installation to access source server credentials from AWS Secrets Manager. + * `AWSTransform-Connector-role-` – Created when you set up the target account connector, in the management account or the delegated administrator account of your AWS Organization. This role allows AWS Transform to connect to your target account and act on your behalf to run migration operations. @@ -108 +107,0 @@ During migration setup, a CloudFormation StackSet (`MGNMultiAccountRoles`) is de - * `AWSApplicationMigrationConnectorSharingRole_<ACCOUNT-ID>` – Contains permissions for agent installation across accounts. @@ -110 +108,0 @@ During migration setup, a CloudFormation StackSet (`MGNMultiAccountRoles`) is de - * Application Migration Service service roles – Created automatically during Application Migration Service initialization in each target account. These include roles for replication and launch operations, and cross-account roles for multi-account migrations. @@ -113,6 +110,0 @@ During migration setup, a CloudFormation StackSet (`MGNMultiAccountRoles`) is de - - -###### Note - -IAM roles are created only if they don't already exist in the account. If they already exist, the setup process doesn't create them again. -