Creating required Amazon resources for Amazon DMS Fleet Advisor

To download the CloudFormation template files

1. Open the context (right-click) menu for one of the following links and choose Save Link As:

   • If you plan to use DMS Fleet Advisor, choose dms-fleetadvisor-iam-slr-s3.zip. If you have already created the SLR for DMS Fleet Advisor, choose dms-fleetadvisor-iam-s3.zip

   • If you plan to use the Amazon Application Discovery Service (ADS) Agentless Collector and have not created the SLR for it, then choose dms-fleetadvisor-ads-iam-slr-s3.zip. If you have created the SLR for DMS Fleet Advisor with ADS before, choose dms-fleetadvisor-ads-iam-s3.zip.

2. Save the file to your computer.

To configure Amazon S3 and IAM using CloudFormation

1. Open the CloudFormation console at https://console.amazonaws.cn/cloudformation.

2. Start the Create Stack wizard by choosing Create Stack and With new resources in the dropdown list.

3. On the Create stack page, do the following:

   1. For Prepare template, choose Template is ready.

   2. For Template source, choose Upload a template file.

   3. For Choose file, navigate to, then choose dms-fleetadvisor-iam-slr-S3.json, dms-fleetadvisor-iam-S3.json., dms-fleetadvisor-ads-iam-slr-s3.zip, or dms-fleetadvisor-ads-iam-s3.zip.

   4. Choose Next.

4. On the Specify stack details page, do the following:

   1. For Stack name, enter dms-fleetadvisor-iam-slr-s3,dms-fleetadvisor-iam-s3, dms-fleetadvisor-ads-iam-slr-s3, or dms-fleetadvisor-ads-iam-s3.

   2. Choose Next.

5. On the Configure stack options page, choose Next.

6. On the Review dms-fleetadvisor-iam-slr-s3,Review dms-fleetadvisor-iam-s3, Review dms-fleetadvisor-ads-iam-slr-s3, or Review dms-fleetadvisor-ads-iam-s3 page, do the following:

   1. Select the I acknowledge that Amazon CloudFormation might create IAM resources with custom names check box.

   2. Choose Submit.

   CloudFormation creates the S3 bucket and IAM roles and user that DMS Fleet Advisor requires. In the left panel, when dms-fleetadvisor-iam-slr-s3, dms-fleetadvisor-iam-s3, dms-fleetadvisor-ads-iam-slr-s3, or dms-fleetadvisor-ads-iam-s3 shows CREATE_COMPLETE, proceed to the next step.

7. In the left panel, choose dms-fleetadvisor-iam-slr-s3, dms-fleetadvisor-iam-s3, dms-fleetadvisor-ads-iam-slr-s3, or dms-fleetadvisor-ads-iam-s3. In the right panel, do the following:

   1. Choose Stack info. Your stack has an ID in the format arn:aws:cloudformation:region:account-no:stack/dms-fleetadvisor-iam-slr-s3/identifier, arn:aws:cloudformation:region:account-no:stack/dms-fleetadvisor-iam-s3/identifier, arn:aws:cloudformation:region:account-no:stack/dms-fleetadvisor-ads-iam-slr-s3/identifier, or arn:aws:cloudformation:region:account-no:stack/dms-fleetadvisor-ads-iam-s3/identifier.

   2. Choose Resources. You should see the following:

      • An Amazon S3 bucket named dms-fleetadvisor-data-accountId-region

      • A service role named FleetAdvisorS3Role-region

      • An IAM user named FleetAdvisorCollectorUser-region

      • An IAM SLR named AWSServiceRoleForDMSFleetAdvisor (if you downloaded dms-fleet-advisor-iam-slr-s3.zip or dms-fleet-advisor-ads-iam-slr-s3.zip).

      • An access policy named FleetAdvisorS3Role-region-Policy

      • An access policy named FleetAdvisorCollectorUser-region-Policy

To create an Amazon S3 bucket to store local data environment information

1. Sign in to the Amazon Web Services Management Console and open the Amazon S3 console at https://console.amazonaws.cn/s3/.

2. Choose Create bucket.

3. On the Create bucket page, enter a globally unique name that includes your sign-in name for the bucket, such as fa-bucket-yoursignin.

4. Choose the Amazon Web Services Region where you use the DMS Fleet Advisor.

5. Keep the remaining settings and choose Create bucket.

To create an IAM policy for DMS Fleet Advisor and your data collector to access Amazon S3

1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Policies.

3. Choose Create policy.

4. In the Create policy page, choose the JSON tab.

5. Paste the following JSON into the editor, replacing the example code. Replace fa_bucket with the name of the Amazon S3 bucket that you created in the previous section.

   {
       "Version": "2012-10-17",
       "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "s3:GetObject*",
               "s3:GetBucket*",
               "s3:List*",
               "s3:DeleteObject*",
               "s3:PutObject*"
           ],
           "Resource": [
               "arn:aws:s3:::fa_bucket",
               "arn:aws:s3:::fa_bucket/*"
           ]
       }
       ]
       }

6. Choose Next: Tags and Next: Review.

7. Enter FleetAdvisorS3Policy for Name*, and then choose Create policy.

To create an IAM policy for DMS data collector to access DMS Fleet Advisor

1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Policies.

3. Choose Create policy.

4. In the Create policy page, choose the JSON tab.

5. Paste the following JSON code into the editor, replacing the example code.

   {
       "Version": "2012-10-17",
       "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "dms:DescribeFleetAdvisorCollectors",
               "dms:ModifyFleetAdvisorCollectorStatuses",
               "dms:UploadFileMetadataList"
           ],
           "Resource": "*"
       }
       ]
       }

6. Choose Next: Tags and Next: Review.

7. Enter DMSCollectorPolicy for Name*, then choose Create policy.

To create an IAM user with minimum permissions to use DMS data collector

1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Users.

3. Choose Add users.

4. On the Add user page, enter FleetAdvisorCollectorUser for User name*. Choose Access key- Programmatic Access for Select Amazon Access Type. Choose Next: Permissions.

5. In the Set permissions section, choose Attach existing policies directly.

6. Use the search control to find and choose the DMSCollectorPolicy and FleetAdvisorS3Policy policies that you created before. Choose Next: Tags.

7. On the Tags page, choose Next: Review.

8. On the Review page, choose Create user. On the next page, choose Download .csv to save the new user credentials. Use these credentials with DMS Fleet Advisor for minimum required access permissions.

To create an IAM role for DMS Fleet Advisor and your data collector to access Amazon S3

1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Roles.

3. Choose Create role.

4. On the Select trusted entity page, for Trusted entity type, choose Amazon Service. For Use cases for other Amazon services, choose DMS.

5. Select the DMS check box and choose Next.

6. On the Add permissions page, choose FleetAdvisorS3Policy. Choose Next.

7. On the Name, review, and create page, enter FleetAdvisorS3Role for Role name, then choose Create role.

8. On the Roles page, enter FleetAdvisorS3Role for Role name. Choose FleetAdvisorS3Role.

9. On the FleetAdvisorS3Role page, choose the Trust relationships tab. Choose Edit trust policy.

10. On the Edit trust policy page, paste the following JSON into the editor, replacing the existing text.

    {
        "Version": "2012-10-17",
        "Statement": [
        {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
        "Service": [
         "dms.amazonaws.com",
         "dms-fleet-advisor.amazonaws.com"
        ]
        },
        "Action": "sts:AssumeRole"
        }
        ]
        }

    The preceding policy grants the sts:AssumeRole permission to the services that Amazon DMS uses to import collected data from the Amazon S3 bucket.

11. Choose Update policy.

To create the service-linked role for DMS Fleet Advisor

1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Roles. Then, choose Create role.

3. For Trusted entity type, choose Amazon service.

4. For Use cases for other Amazon services, choose DMS – Fleet Advisor.

5. Select the DMS – Fleet Advisor check box and choose Next.

6. On the Add permissions page, choose Next.

7. On the Name, review, and create page, choose Create role.

To create an IAM policy that is required for the DMS Fleet Advisor service-linked role

The minimum required permissions to create the service-linked role are specified in the DMSFleetAdvisorCreateServiceLinkedRolePolicy policy. Create this IAM policy for your account if you are unable to create the service-linked role.

1. Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Policies.

3. Choose Create policy.

4. In the Create policy page, choose the JSON tab.

5. Paste the following JSON code into the editor, replacing the example code.

   {
       "Version": "2012-10-17",
       "Statement": [
       {
           "Effect": "Allow",
           "Action": "iam:CreateServiceLinkedRole",
           "Resource": "arn:aws:iam::*:role/aws-service-role/dms-fleet-advisor.amazonaws.com/AWSServiceRoleForDMSFleetAdvisor*",
           "Condition": {"StringLike": {"iam:AWSServiceName": "dms-fleet-advisor.amazonaws.com"}}
       },
       {
           "Effect": "Allow",
           "Action": [
               "iam:AttachRolePolicy",
               "iam:PutRolePolicy"
           ],
           "Resource": "arn:aws:iam::*:role/aws-service-role/dms-fleet-advisor.amazonaws.com/AWSServiceRoleForDMSFleetAdvisor*"
       }
       ]
       }

6. Choose Next: Tags and Next: Review.

7. Enter DMSFleetAdvisorCreateServiceLinkedRolePolicy for Name*, then choose Create policy.