Skip to content

Commit 5fb728a

Browse files
author
MAMIP Bot
committed
DBModProvisioningAndMigration - Policy Version v1
1 parent c1f08ab commit 5fb728a

File tree

1 file changed

+211
-0
lines changed

1 file changed

+211
-0
lines changed

‎policies/DBModProvisioningAndMigration‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
{
2+
"PolicyVersion": {
3+
"Document": {
4+
"Version": "2012-10-17",
5+
"Statement": [
6+
{
7+
"Effect": "Allow",
8+
"Action": "secretsmanager:UpdateSecret",
9+
"Resource": "arn:aws:secretsmanager:*:*:secret:atx-db-modernization-*",
10+
"Condition": {
11+
"StringEquals": {
12+
"aws:ResourceTag/Project": "atx-db-modernization",
13+
"aws:ResourceTag/Owner": "database-connector",
14+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
15+
}
16+
}
17+
},
18+
{
19+
"Effect": "Allow",
20+
"Action": [
21+
"secretsmanager:CreateSecret",
22+
"secretsmanager:TagResource"
23+
],
24+
"Resource": "arn:aws:secretsmanager:*:*:secret:atx-db-modernization-*",
25+
"Condition": {
26+
"StringEquals": {
27+
"aws:RequestTag/Project": "atx-db-modernization",
28+
"aws:RequestTag/Owner": "database-connector",
29+
"aws:ResourceTag/Project": "atx-db-modernization",
30+
"aws:ResourceTag/Owner": "database-connector",
31+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
32+
}
33+
}
34+
},
35+
{
36+
"Effect": "Allow",
37+
"Action": [
38+
"s3:CreateBucket",
39+
"s3:PutBucketTagging",
40+
"s3:PutBucketVersioning",
41+
"s3:ListBucket",
42+
"s3:GetObject",
43+
"s3:GetBucketLocation",
44+
"s3:PutObject",
45+
"s3:DeleteObject",
46+
"s3:GetBucketVersioning"
47+
],
48+
"Resource": [
49+
"arn:aws:s3:::atx-db-modernization-*",
50+
"arn:aws:s3:::atx-db-modernization-*/*"
51+
],
52+
"Condition": {
53+
"StringEquals": {
54+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
55+
}
56+
}
57+
},
58+
{
59+
"Effect": "Allow",
60+
"Action": [
61+
"dms:CreateReplicationSubnetGroup",
62+
"dms:CreateInstanceProfile",
63+
"dms:CreateDataProvider",
64+
"dms:CreateMigrationProject",
65+
"dms:CreateEndpoint",
66+
"dms:AddTagsToResource",
67+
"rds:CreateDBSubnetGroup",
68+
"rds:CreateDBCluster",
69+
"rds:CreateDBInstance",
70+
"rds:AddTagsToResource",
71+
"dms:CreateReplicationInstance",
72+
"dms:CreateReplicationTask"
73+
],
74+
"Resource": [
75+
"arn:aws:dms:*:*:subgrp:*",
76+
"arn:aws:dms:*:*:instance-profile:*",
77+
"arn:aws:dms:*:*:data-provider:*",
78+
"arn:aws:dms:*:*:migration-project:*",
79+
"arn:aws:rds:*:*:subgrp:*",
80+
"arn:aws:rds:*:*:cluster:*",
81+
"arn:aws:rds:*:*:db:*",
82+
"arn:aws:ec2:*:*:vpc-endpoint:*",
83+
"arn:aws:dms:*:*:endpoint:*",
84+
"arn:aws:dms:*:*:rep:*",
85+
"arn:aws:dms:*:*:task:*"
86+
],
87+
"Condition": {
88+
"StringEquals": {
89+
"aws:RequestTag/Project": "atx-db-modernization",
90+
"aws:RequestTag/Owner": "database-connector",
91+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
92+
}
93+
}
94+
},
95+
{
96+
"Effect": "Allow",
97+
"Action": [
98+
"dms:ExportMetadataModelAssessment",
99+
"dms:StartMetadataModelImport",
100+
"dms:StartMetadataModelConversion",
101+
"dms:StartMetadataModelExportToTarget",
102+
"dms:StartMetadataModelExportAsScripts",
103+
"dms:StartMetadataModelAssessment",
104+
"dms:StartMetadataModelCreation",
105+
"dms:UpdateConversionConfiguration",
106+
"dms:UpdateMigrationProject",
107+
"dms:AddTagsToResource",
108+
"dms:ListTagsForResource",
109+
"dms:DeleteMigrationProject",
110+
"dms:DeleteEndpoint",
111+
"dms:UpdateInstanceProfile",
112+
"dms:UpdateDataProvider",
113+
"dms:DeleteInstanceProfile",
114+
"dms:DeleteDataProvider",
115+
"secretsmanager:GetSecretValue",
116+
"secretsmanager:DescribeSecret"
117+
],
118+
"Resource": [
119+
"arn:aws:dms:*:*:migration-project:*",
120+
"arn:aws:dms:*:*:instance-profile:*",
121+
"arn:aws:dms:*:*:data-provider:*",
122+
"arn:aws:dms:*:*:endpoint:*",
123+
"arn:aws:secretsmanager:*:*:secret:*"
124+
],
125+
"Condition": {
126+
"StringEquals": {
127+
"aws:ResourceAccount": "${aws:PrincipalAccount}",
128+
"aws:ResourceTag/Project": "atx-db-modernization",
129+
"aws:ResourceTag/Owner": "database-connector"
130+
}
131+
}
132+
},
133+
{
134+
"Effect": "Allow",
135+
"Action": [
136+
"dms:CreateReplicationInstance",
137+
"dms:DeleteReplicationInstance",
138+
"dms:ModifyReplicationInstance",
139+
"dms:RebootReplicationInstance"
140+
],
141+
"Resource": "arn:aws:dms:*:*:rep:*",
142+
"Condition": {
143+
"StringEquals": {
144+
"dms:rep-tag/Project": "atx-db-modernization",
145+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
146+
}
147+
}
148+
},
149+
{
150+
"Effect": "Allow",
151+
"Action": [
152+
"dms:DeleteReplicationTask",
153+
"dms:StartReplicationTask",
154+
"dms:StopReplicationTask",
155+
"dms:StartReplicationTaskAssessmentRun",
156+
"dms:CancelReplicationTaskAssessmentRun"
157+
],
158+
"Resource": [
159+
"arn:aws:dms:*:*:task:*",
160+
"arn:aws:dms:*:*:assessment-run:*"
161+
],
162+
"Condition": {
163+
"StringEquals": {
164+
"dms:task-tag/Project": "atx-db-modernization",
165+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
166+
}
167+
}
168+
},
169+
{
170+
"Effect": "Allow",
171+
"Action": "iam:PassRole",
172+
"Resource": [
173+
"arn:aws:iam::*:role/dms-vpc-role",
174+
"arn:aws:iam::*:role/dms-cloudwatch-logs-role",
175+
"arn:aws:iam::*:role/dms-secrets-manager-role",
176+
"arn:aws:iam::*:role/dms-s3-access-role",
177+
"arn:aws:iam::*:role/DMSPremigrationAssessmentS3Role"
178+
],
179+
"Condition": {
180+
"StringEquals": {
181+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
182+
},
183+
"StringLike": {
184+
"iam:PassedToService": [
185+
"dms.amazonaws.com",
186+
"dms.*.amazonaws.com",
187+
"schema-conversion.dms.amazonaws.com"
188+
]
189+
}
190+
}
191+
},
192+
{
193+
"Effect": "Allow",
194+
"Action": "iam:CreateServiceLinkedRole",
195+
"Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
196+
"Condition": {
197+
"StringLike": {
198+
"iam:AWSServiceName": "rds.amazonaws.com"
199+
},
200+
"StringEquals": {
201+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
202+
}
203+
}
204+
}
205+
]
206+
},
207+
"VersionId": "v1",
208+
"IsDefaultVersion": true,
209+
"CreateDate": "2026-03-25T20:42:12+00:00"
210+
}
211+
}

0 commit comments

Comments
 (0)