AWS transform documentation change
Summary
Added explicit list of IAM roles created during Application Migration Service initialization
Security assessment
Listing specific IAM roles improves transparency but doesn't address a security flaw. The added role names help understand permissions boundaries but aren't new security features or vulnerability fixes.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-servers.md b/transform/latest/userguide/transform-vmware-migrate-servers.md index deb4c6292..6d82a3549 100644 --- a//transform/latest/userguide/transform-vmware-migrate-servers.md +++ b//transform/latest/userguide/transform-vmware-migrate-servers.md @@ -86 +86,20 @@ AWS Transform supports two migration modes: -AWS Transform confirms the target account configuration and verifies that Application Migration Service is initialized in each target account. If Application Migration Service is not yet initialized, AWS Transform provides instructions to complete the initialization. During initialization, Application Migration Service creates the required IAM service roles for replication and launch operations, including cross-account roles for multi-account migrations. To learn more about this requirement, see [Initializing Application Migration Service with the console](https://docs.aws.amazon.com/mgn/latest/ug/mgn-initialize-console.html) or [Initializing Application Migration Service with the API](https://docs.aws.amazon.com/mgn/latest/ug/mgn-initialize-api.html) in the _Application Migration Service User Guide_. +AWS Transform confirms the target account configuration and verifies that Application Migration Service is initialized in each target account. If Application Migration Service is not yet initialized, AWS Transform provides instructions to complete the initialization. During initialization, Application Migration Service creates the following IAM service roles for replication and launch operations: + + * `AWSApplicationMigrationReplicationServerRole` + + * `AWSApplicationMigrationConversionServerRole` + + * `AWSApplicationMigrationMGHRole` + + * `AWSApplicationMigrationLaunchInstanceWithDrsRole` + + * `AWSApplicationMigrationLaunchInstanceWithSsmRole` + + * `AWSApplicationMigrationAgentRole` + + + + +To learn more about these roles, see [Initializing Application Migration Service with the console](https://docs.aws.amazon.com/mgn/latest/ug/mgn-initialize-console.html) or [Initializing Application Migration Service with the API](https://docs.aws.amazon.com/mgn/latest/ug/mgn-initialize-api.html) in the _Application Migration Service User Guide_. + +For multi-account migrations, AWS Transform also creates the following role during the initialization step: `AWSTransformRehostSharingRole_<management-or-delegated-admin-account-id>`. This role is deployed across all migration target accounts.