AWS mgn: Simplified CloudFormation deployment for MGN connector roles
Summary
Replaced detailed JSON template and manual steps with instructions to download templates from MGN console and use CloudFormation StackSets.
Security assessment
The change streamlines IAM role deployment using standardized templates, reducing misconfiguration risks but doesn't address a specific vulnerability.
Evidence
For multiple accounts, you can use CloudFormation StackSets to deploy the **AWSApplicationMigrationConnectorSharingRole_`management-account-id`** role to member accounts.
Diff
diff --git a/mgn/latest/ug/CloudFormation_Template.md b/mgn/latest/ug/CloudFormation_Template.md index 6bc20b0c2..f74b49f6d 100644 --- a//mgn/latest/ug/CloudFormation_Template.md +++ b//mgn/latest/ug/CloudFormation_Template.md @@ -9,171 +9,13 @@ NEW - You can now accelerate your migration and modernization with AWS Transform -# Deploy the AWSApplicationMigrationConnectorSharingRole_`management-account-id` role using a CloudFormation template - -See the [Create roles manually](./create-permissions-manually.html) to deploy these permissions manually. - - 1. To configure the required IAM roles and policies, after replacing the described parameters, save the following AWS CloudFormation JSON template to a text file called `aws-mgn-connector-iam-principals.json` on your local system: - - 1. Replace the example account number **111122223333** with your account number. - - 2. Replace **ROLE-NAME** with the user role that serves as the trusted entity. This user role assumes the **MGNConnectorInstallerRole** role and can install the connector. - - 3. Replace the example region **us-east-2** with the Region of the account. - - 4. Replace **LOGS-BUCKET** with the S3 logs bucket name. Remove the relevant item from the statement if you have not set up outputting logs to S3. - - { - "AWSTemplateFormatVersion": "2010-09-09", - "Description": "IAM Roles for AWS Application Migration Connector", - "Resources": { - "MGNConnectorInstallerRole": { - "Type": "AWS::IAM::Role", - "Properties": { - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:role/ROLE-NAME" - }, - "Action": "sts:AssumeRole" - } - ] - }, - "Policies": [ - { - "PolicyName": "MGNConnectorInstallerPolicy", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "mgn:TagResource", - "Resource": "arn:aws:mgn:*:*:connector/*", - "Condition": { - "StringEquals": { - "mgn:CreateAction": "CreateConnector" - } - } - }, - { - "Effect": "Allow", - "Action": "mgn:CreateConnector", - "Resource": "*" - } - ] - } - } - ] - } - }, - "AWSApplicationMigrationConnectorManagementRole": { - "Type": "AWS::IAM::Role", - "Properties": { - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": "ssm.amazonaws.com" - }, - "Action": "sts:AssumeRole" - } - ] - }, - "ManagedPolicyArns": [ - "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" - ], - "Policies": [ - { - "PolicyName": "MgnConnectorPolicy", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "logs:CreateLogGroup", - "logs:CreateLogStream", - "logs:DescribeLogGroups", - "logs:DescribeLogStreams", - "logs:PutLogEvents" - ], - "Resource": "*" - }, - { - "Action": [ - "s3:GetObject" - ], - "Resource": [ - "arn:aws:s3:::aws-application-migration-service-us-east-2/latest/source-automation-client/linux/ssaf-client/ssaf_client", - "arn:aws:s3:::aws-application-migration-service-us-east-2/*" - ], - "Effect": "Allow" - }, - { - "Action": [ - "s3:PutObject" - ], - "Resource": "arn:aws:s3:::LOGS-BUCKET/*", - "Effect": "Allow" - }, - { - "Effect": "Allow", - "Action": "sts:AssumeRole", - "Resource": "arn:aws:iam::*:role/AWSApplicationMigrationConnectorSharingRole_111122223333" - }, - { - "Effect": "Allow", - "Action": "secretsmanager:GetSecretValue", - "Resource": "arn:aws:secretsmanager:*:*:secret:*", - "Condition": { - "Null": { - "aws:ResourceTag/AWSApplicationMigrationServiceManaged": "false" - } - } - } - ] - } - } - ] - } - } - } - } - - - 2. Create a stack: - -Via AWS CloudFormation console - - - 1. **Stacks → Create stack → With new resources (standard)** - - 2. Under **Specify template** select **Upload a template file** - - 3. Choose **Choose file** and select the template file `aws-mgn-connector-iam-principals.json` in the dialog. - - 4. Choose **Next**. - - 5. In the following screen, choose a name for your CloudFormation stack (for example: `aws-mgn-connector-iam-principals-stack`) and choose **Next**. - - 6. Choose **Next** again. - - 7. Acknowledge the required capabilities and choose **Submit**. - - 8. Wait for the stack to finish creation. - -Via AWS CLI - - - 1. Using the following command: - -###### Example - - aws cloudformation deploy --stack-name aws-mgn-connector-iam-principals-stack --capabilities CAPABILITY_NAMED_IAM --region <AWS_REGION> --template-file <PATH_TO_TEMPLATE_FILE> - - - 2. Replace `<AWS_REGION>` with the AWS region you will be deploying in and `<PATH_TO_TEMPLATE_FILE>` with the CloudFormation template file path. - - 3. Wait for the stack to finish creation. +# Deploy role using a CloudFormation template + +For multiple accounts, you can use CloudFormation StackSets to deploy the **AWSApplicationMigrationConnectorSharingRole_`management-account-id`** role to member accounts. The MGN console provides templates for download, as described in [Download the CloudFormation templates](./create-permissions-console.html#download-cloudformation-templates) under "Create roles using the MGN console". + +If you prefer to deploy the roles using CloudFormation StackSets manually, you can download the templates from the **Add connector** page: + + 1. On the **MGN connectors** page, choose **Add connector**. + + 2. Under **IAM Roles** , expand **View or deploy roles yourself** to access the template download options. + + 3. Download the **Member Account Template** (`mgn-connector-sharing-role.json`) to deploy to member accounts. + + 4. Using the CloudFormation console or AWS CLI, create a StackSet from the template and deploy it to the desired member accounts. For instructions, see [Getting started with AWS CloudFormation StackSets](https://docs.aws.amazon.com/cloudformation/latest/userguide/stacksets-getting-started.html) in the _AWS CloudFormation User Guide_. @@ -192 +34 @@ Create roles manually -Setup instructions +Installing the MGN connector on a secured network