Creating required IAM resources for homogeneous data migrations in Amazon DMS - Amazon Database Migration Service
Creating an IAM policyCreating an IAM role
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Creating required IAM resources for homogeneous data migrations in Amazon DMS

To run homogeneous data migrations, you must create an IAM policy and an IAM role in your account to interact with other Amazon services. In this section, you create these required IAM resources.

Creating an IAM policy for homogeneous data migrations in Amazon DMS

To access your databases and to migrate data, with Amazon DMS, you can create a serverless environment for homogeneous data migrations. Also, Amazon DMS stores logs, metrics, and progress for each data migration in Amazon CloudWatch. To create a data migration project, Amazon DMS needs access to these services.

In this step, you create an IAM policy that provides Amazon DMS with access to Amazon EC2 and CloudWatch resources. Next, create an IAM role and attach this policy.

To create an IAM policy for homogeneous data migrations in Amazon DMS

  1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

  2. In the navigation pane, choose Policies.

  3. Choose Create policy.

  4. In the Create policy page, choose the JSON tab.

  5. Paste the following JSON into the editor.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup"
            ],
            "Resource": "arn:aws:logs:*:*:log-group:dms-data-migration-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:log-group:dms-data-migration-*:log-stream:dms-data-migration-*"
        },
        {
            "Effect": "Allow",
            "Action": "cloudwatch:PutMetricData",
            "Resource": "*"
        }
    ]
}

  6. Choose Next.

  7. Enter HomogeneousDataMigrationsPolicy for Policy name, and choose Create policy.

Creating an IAM role for homogeneous data migrations in Amazon DMS

In this step, you create an IAM role that provides Amazon DMS with access to Amazon Secrets Manager, Amazon EC2, and CloudWatch.

When creating an IAM role, you must also create a dms-vpc-role. For more information, see Creating an IAM role for Amazon DMS to manage Amazon VPC in the Amazon Relational Database Service User Guide.

To create an IAM role for homogeneous data migrations in Amazon DMS

  1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

  2. In the navigation pane, choose Roles.

  3. Choose Create role.

  4. On the Select trusted entity page, for Trusted entity type, choose Amazon Service. For Use cases for other Amazon services, choose DMS.

  5. Select the DMS check box and choose Next.

  6. On the Add permissions page, choose HomogeneousDataMigrationsPolicy that you created before.

  7. On the Name, review, and create page, enter HomogeneousDataMigrationsRole for Role name, and choose Create role.

  8. Choose Update policy.