AWS mgn: Added same-account restriction for MGN EC2 instance policy
Summary
Added explicit statement restricting policy usage to the same AWS account.
Security assessment
The added line clarifies account isolation requirements, preventing potential cross-account privilege escalation or unauthorized access.
Evidence
+This policy allows installing and using the AWS Replication Agent, which is used by AWS Transform MGN to migrate source servers that run on EC2 (cross-Region or cross-AZ). An IAM role with this policy should be attached (as an EC2 Instance Profile) to the EC2 Instances. This policy can only be used within the same AWS account.
Diff
diff --git a/mgn/latest/ug/security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.md b/mgn/latest/ug/security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.md index 28e165e98..3d3b3e546 100644 --- a//mgn/latest/ug/security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.md +++ b//mgn/latest/ug/security-iam-awsmanpol-AWSApplicationMigrationServiceEc2InstancePolicy.md @@ -11 +11 @@ NEW - You can now accelerate your migration and modernization with AWS Transform -This policy allows installing and using the AWS Replication Agent, which is used by AWS Transform MGN to migrate source servers that run on EC2 (cross-Region or cross-AZ). An IAM role with this policy should be attached (as an EC2 Instance Profile) to the EC2 Instances. +This policy allows installing and using the AWS Replication Agent, which is used by AWS Transform MGN to migrate source servers that run on EC2 (cross-Region or cross-AZ). An IAM role with this policy should be attached (as an EC2 Instance Profile) to the EC2 Instances. This policy can only be used within the same AWS account.