AWS dms documentation change

Service: dms · 2026-07-10 · Documentation medium

File: dms/latest/userguide/security-iam-awsmanpol.md

Summary

Added new S3 permissions for DMS Schema Conversion to access metadata in ABAC-enabled buckets and updated policy description.

Security assessment

The change introduces new IAM permissions (s3:GetObject and s3:ListBucket) with resource tagging conditions for secure access to source database metadata. This documents security controls for a new feature (virtual mode) but doesn't address a specific vulnerability.

Diff

diff --git a/dms/latest/userguide/security-iam-awsmanpol.md b/dms/latest/userguide/security-iam-awsmanpol.md
index d8b4ecbec..6595fa25f 100644
--- a//dms/latest/userguide/security-iam-awsmanpol.md
+++ b//dms/latest/userguide/security-iam-awsmanpol.md
@@ -96 +96 @@ This policy is attached to the `AWSServiceRoleForDMSServerless` role, which allo
-This policy grants contributor permissions that allow AWS DMS to manage replication resources.
+This policy grants contributor permissions that allow AWS DMS to manage replication resources. It also grants permissions that allow DMS Schema Conversion to list and read the contents of a designated Amazon S3 bucket containing source database metadata.
@@ -104 +104,5 @@ This policy includes the following permissions.
-  * **Amazon S3** – Allows DMS to create an S3 bucket to store a premigration assessment. The S3 bucket is created for one user per Region and its bucket policy limits access to only the service's service role. 
+  * **Amazon S3** : 
+
+    1. Allows AWS DMS to create an Amazon S3 bucket to store a premigration assessment. The Amazon S3 bucket is created for one user per Region and its bucket policy limits access to only the service's service role. 
+
+    2. Allows DMS Schema Conversion to list and read the contents of an ABAC-enabled Amazon S3 bucket designated with a resource tag. It is used to parse source database metadata from a data provider in **Virtual Mode**. For more information, see [Virtual mode for offline source and virtual target](./virtual-data-provider.html). 
@@ -220,0 +225,24 @@ This policy includes the following permissions.
+            },
+            {
+                "Sid": "ReadDDLScript",
+                "Effect": "Allow",
+                "Action": "s3:GetObject",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:ResourceAccount": "${aws:PrincipalAccount}",
+                        "aws:ResourceTag/ResourceUsedBy": "DMSDatabaseMigrations"
+                    }
+                }
+            },
+            {
+                "Sid": "ListDDLScript",
+                "Effect": "Allow",
+                "Action": "s3:ListBucket",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:ResourceAccount": "${aws:PrincipalAccount}",
+                        "aws:ResourceTag/ResourceUsedBy": "DMSDatabaseMigrations"
+                    }
+                }