Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Database Migration Service

Amazon Database Migration Service (service prefix: dms) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Database Migration Service
Actions defined by Amazon Database Migration Service
Permission-only actions for Amazon Database Migration Service
Resource types defined by Amazon Database Migration Service
Condition keys for Amazon Database Migration Service

API operations defined by Amazon Database Migration Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AddTagsToResource	dms:AddTagsToResource			Tagging, Write
ApplyPendingMaintenanceAction	dms:ApplyPendingMaintenanceAction			Write
BatchStartRecommendations	dms:BatchStartRecommendations			Write
CancelMetadataModelConversion	dms:CancelMetadataModelConversion			Write
CancelMetadataModelCreation	dms:CancelMetadataModelCreation			Write
CancelReplicationTaskAssessmentRun	dms:CancelReplicationTaskAssessmentRun			Write
CreateDataMigration	dms:AddTagsToResource			Tagging, Write
	dms:CreateDataMigration			Write
	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
CreateDataProvider	dms:AddTagsToResource			Tagging, Write
	dms:CreateDataProvider			Write
	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
CreateEndpoint	dms:AddTagsToResource			Tagging, Write
	dms:CreateEndpoint			Write
	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
CreateEventSubscription	dms:AddTagsToResource			Tagging, Write
CreateEventSubscription	dms:CreateEventSubscription			Write
CreateFleetAdvisorCollector	dms:CreateFleetAdvisorCollector			Write
CreateFleetAdvisorCollector	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
CreateInstanceProfile	dms:AddTagsToResource			Tagging, Write
CreateInstanceProfile	dms:CreateInstanceProfile			Write
CreateMigrationProject	dms:AddTagsToResource			Tagging, Write
	dms:CreateMigrationProject			Write
	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
CreateReplicationConfig	dms:AddTagsToResource			Tagging, Write
CreateReplicationConfig	dms:CreateReplicationConfig			Write
CreateReplicationInstance	dms:AddTagsToResource			Tagging, Write
CreateReplicationInstance	dms:CreateReplicationInstance			Write
CreateReplicationSubnetGroup	dms:AddTagsToResource			Tagging, Write
CreateReplicationSubnetGroup	dms:CreateReplicationSubnetGroup			Write
CreateReplicationTask	dms:AddTagsToResource			Tagging, Write
CreateReplicationTask	dms:CreateReplicationTask			Write
DeleteCertificate	dms:DeleteCertificate			Write
DeleteConnection	dms:DeleteConnection			Write
DeleteDataMigration	dms:DeleteDataMigration			Write
DeleteDataProvider	dms:DeleteDataProvider			Write
DeleteEndpoint	dms:DeleteEndpoint			Write
DeleteEventSubscription	dms:DeleteEventSubscription			Write
DeleteFleetAdvisorCollector	dms:DeleteFleetAdvisorCollector			Write
DeleteFleetAdvisorDatabases	dms:DeleteFleetAdvisorDatabases			Write
DeleteInstanceProfile	dms:DeleteInstanceProfile			Write
DeleteMigrationProject	dms:DeleteMigrationProject			Write
DeleteReplicationConfig	dms:DeleteReplicationConfig			Write
DeleteReplicationInstance	dms:DeleteReplicationInstance			Write
DeleteReplicationSubnetGroup	dms:DeleteReplicationSubnetGroup			Write
DeleteReplicationTask	dms:DeleteReplicationTask			Write
DeleteReplicationTaskAssessmentRun	dms:DeleteReplicationTaskAssessmentRun			Write
DescribeAccountAttributes	dms:DescribeAccountAttributes			Read
DescribeApplicableIndividualAssessments	dms:DescribeApplicableIndividualAssessments			Read
DescribeCertificates	dms:DescribeCertificates			Read
DescribeConnections	dms:DescribeConnections			Read
DescribeConversionConfiguration	dms:DescribeConversionConfiguration			Read
DescribeDataMigrations	dms:DescribeDataMigrations			Read
DescribeDataProviders	dms:ListDataProviders			Read
DescribeEndpointSettings	dms:DescribeEndpointSettings			Read
DescribeEndpointTypes	dms:DescribeEndpointTypes			Read
DescribeEndpoints	dms:DescribeEndpoints			Read
DescribeEngineVersions	dms:DescribeEngineVersions			Read
DescribeEventCategories	dms:DescribeEventCategories			Read
DescribeEventSubscriptions	dms:DescribeEventSubscriptions			Read
DescribeEvents	dms:DescribeEvents			Read
DescribeExtensionPackAssociations	dms:ListExtensionPacks			Read
DescribeFleetAdvisorCollectors	dms:DescribeFleetAdvisorCollectors			Read
DescribeFleetAdvisorDatabases	dms:DescribeFleetAdvisorDatabases			Read
DescribeFleetAdvisorLsaAnalysis	dms:DescribeFleetAdvisorLsaAnalysis			Read
DescribeFleetAdvisorSchemaObjectSummary	dms:DescribeFleetAdvisorSchemaObjectSummary			Read
DescribeFleetAdvisorSchemas	dms:DescribeFleetAdvisorSchemas			Read
DescribeInstanceProfiles	dms:ListInstanceProfiles			Read
DescribeMetadataModel	dms:DescribeMetadataModel			Read
DescribeMetadataModelAssessments	dms:ListMetadataModelAssessments			Read
DescribeMetadataModelChildren	dms:DescribeMetadataModelChildren			Read
DescribeMetadataModelConversions	dms:ListMetadataModelConversions			Read
DescribeMetadataModelCreations	dms:DescribeMetadataModelCreations			Read
DescribeMetadataModelExportsAsScript	dms:ListMetadataModelExports			Read
DescribeMetadataModelExportsToTarget	dms:ListMetadataModelExports			Read
DescribeMetadataModelImports	dms:DescribeMetadataModelImports			Read
DescribeMigrationProjects	dms:ListMigrationProjects			Read
DescribeOrderableReplicationInstances	dms:DescribeOrderableReplicationInstances			Read
DescribePendingMaintenanceActions	dms:DescribePendingMaintenanceActions			Read
DescribeRecommendationLimitations	dms:DescribeRecommendationLimitations			Read
DescribeRecommendations	dms:DescribeRecommendations			Read
DescribeRefreshSchemasStatus	dms:DescribeRefreshSchemasStatus			Read
DescribeReplicationConfigs	dms:DescribeReplicationConfigs			Read
DescribeReplicationInstanceTaskLogs	dms:DescribeReplicationInstanceTaskLogs			Read
DescribeReplicationInstances	dms:DescribeReplicationInstances			Read
DescribeReplicationSubnetGroups	dms:DescribeReplicationSubnetGroups			Read
DescribeReplicationTableStatistics	dms:DescribeReplicationTableStatistics			Read
DescribeReplicationTaskAssessmentResults	dms:DescribeReplicationTaskAssessmentResults			Read
DescribeReplicationTaskAssessmentRuns	dms:DescribeReplicationTaskAssessmentRuns			Read
DescribeReplicationTaskIndividualAssessments	dms:DescribeReplicationTaskIndividualAssessments			Read
DescribeReplicationTasks	dms:DescribeReplicationTasks			Read
DescribeReplications	dms:DescribeReplications			Read
DescribeSchemas	dms:DescribeSchemas			Read
DescribeTableStatistics	dms:DescribeTableStatistics			Read
ExportMetadataModelAssessment	dms:ExportMetadataModelAssessment			Write
GetTargetSelectionRules	dms:GetTargetSelectionRules			Read
ImportCertificate	dms:AddTagsToResource			Tagging, Write
ImportCertificate	dms:ImportCertificate			Write
ListTagsForResource	dms:ListTagsForResource			Read
ModifyConversionConfiguration	dms:UpdateConversionConfiguration			Write
ModifyDataMigration	dms:ModifyDataMigration			Write
ModifyDataMigration	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
ModifyDataProvider	dms:UpdateDataProvider			Write
ModifyDataProvider	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
ModifyEndpoint	dms:ModifyEndpoint			Write
ModifyEndpoint	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
ModifyEventSubscription	dms:ModifyEventSubscription			Write
ModifyInstanceProfile	dms:UpdateInstanceProfile			Write
ModifyMigrationProject	dms:UpdateMigrationProject			Write
ModifyMigrationProject	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
ModifyReplicationConfig	dms:ModifyReplicationConfig			Write
ModifyReplicationInstance	dms:ModifyReplicationInstance			Write
ModifyReplicationSubnetGroup	dms:ModifyReplicationSubnetGroup			Write
ModifyReplicationTask	dms:ModifyReplicationTask			Write
MoveReplicationTask	dms:MoveReplicationTask			Write
RebootReplicationInstance	dms:RebootReplicationInstance			Write
RefreshSchemas	dms:RefreshSchemas			Write
ReloadReplicationTables	dms:ReloadReplicationTables			Write
ReloadTables	dms:ReloadTables			Write
RemoveTagsFromResource	dms:RemoveTagsFromResource			Tagging, Write
RunFleetAdvisorLsaAnalysis	dms:RunFleetAdvisorLsaAnalysis			Write
StartDataMigration	dms:StartDataMigration			Write
StartExtensionPackAssociation	dms:AssociateExtensionPack			Write
StartMetadataModelAssessment	dms:StartMetadataModelAssessment			Write
StartMetadataModelConversion	dms:StartMetadataModelConversion			Write
StartMetadataModelCreation	dms:StartMetadataModelCreation			Write
StartMetadataModelExportAsScript	dms:StartMetadataModelExportAsScripts			Write
StartMetadataModelExportToTarget	dms:StartMetadataModelExportToTarget			Write
StartMetadataModelImport	dms:StartMetadataModelImport			Write
StartRecommendations	dms:StartRecommendations			Write
StartReplication	dms:StartReplication			Write
StartReplicationTask	dms:StartReplicationTask			Write
StartReplicationTaskAssessment	dms:StartReplicationTaskAssessment			Write
StartReplicationTaskAssessmentRun	dms:AddTagsToResource			Tagging, Write
	dms:StartReplicationTaskAssessmentRun			Write
	iam:PassRole	iam:PassedToService	dms.amazonaws.com	Write
StopDataMigration	dms:StopDataMigration			Write
StopReplication	dms:StopReplication			Write
StopReplicationTask	dms:StopReplicationTask			Write
TestConnection	dms:TestConnection			Read
UpdateSubscriptionsToEventBridge	dms:UpdateSubscriptionsToEventBridge			Write

Actions defined by Amazon Database Migration Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddTagsToResource	Grants permission to add metadata tags to DMS resources, including replication instances, endpoints, security groups, and migration tasks	Certificate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:cert-tag/${TagKey} dms:req-tag/${TagKey}	Tagging, Write
		DataMigration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:data-migration-tag/${TagKey} dms:req-tag/${TagKey}
		DataProvider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:data-provider-tag/${TagKey} dms:req-tag/${TagKey}
		Endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:endpoint-tag/${TagKey} dms:req-tag/${TagKey}
		EventSubscription	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:es-tag/${TagKey} dms:req-tag/${TagKey}
		InstanceProfile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:instance-profile-tag/${TagKey} dms:req-tag/${TagKey}
		MigrationProject	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:migration-project-tag/${TagKey} dms:req-tag/${TagKey}
		ReplicationConfig	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:replication-config-tag/${TagKey} dms:req-tag/${TagKey}
		ReplicationInstance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:rep-tag/${TagKey} dms:req-tag/${TagKey}
		ReplicationSubnetGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey} dms:subgrp-tag/${TagKey}
		ReplicationTask	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey} dms:task-tag/${TagKey}
		ReplicationTaskAssessmentRun	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:assessment-run-tag/${TagKey} dms:req-tag/${TagKey}
		ReplicationTaskIndividualAssessment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:individual-assessment-tag/${TagKey} dms:req-tag/${TagKey}
ApplyPendingMaintenanceAction	Grants permission to apply a pending maintenance action to a resource (for example, to a replication instance)	ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Write
AssociateExtensionPack	Grants permission to associate a extension pack	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
BatchStartRecommendations	Grants permission to start the analysis of up to 20 source databases to recommend target engines for each source database			Write
CancelMetadataModelConversion	Grants permission to cancel a single metadata model conversion operation that was started with StartMetadataModelConversion	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
CancelMetadataModelCreation	Grants permission to cancel a single metadata model creation operation that was started with StartMetadataModelCreation	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
CancelReplicationTaskAssessmentRun	Grants permission to cancel a single premigration assessment run	ReplicationTaskAssessmentRun*	aws:ResourceTag/${TagKey} dms:assessment-run-tag/${TagKey}	Write
CreateDataMigration	Grants permission to create a database migration using the provided settings	MigrationProject*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:migration-project-tag/${TagKey} dms:req-tag/${TagKey}	Write
CreateDataProvider	Grants permission to create an data provider using the provided settings		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey}	Write
CreateEndpoint	Grants permission to create an endpoint using the provided settings		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey}	Write
CreateEventSubscription	Grants permission to create an Amazon DMS event notification subscription		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey}	Write
CreateFleetAdvisorCollector	Grants permission to create a Fleet Advisor collector using the specified parameters			Write
CreateInstanceProfile	Grants permission to create an instance profile using the provided settings		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey}	Write
CreateMigrationProject	Grants permission to create an migration project using the provided settings	DataProvider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:data-provider-tag/${TagKey} dms:req-tag/${TagKey}	Write
CreateMigrationProject		InstanceProfile*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:instance-profile-tag/${TagKey} dms:req-tag/${TagKey}	Write
CreateReplicationConfig	Grants permission to create a replication config using the provided settings	Endpoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:endpoint-tag/${TagKey} dms:req-tag/${TagKey}	Write
CreateReplicationInstance	Grants permission to create a replication instance using the specified parameters		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey}	Write
CreateReplicationSubnetGroup	Grants permission to create a replication subnet group given a list of the subnet IDs in a VPC		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey}	Write
CreateReplicationTask	Grants permission to create a replication task using the specified parameters	Endpoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:endpoint-tag/${TagKey} dms:req-tag/${TagKey}	Write
CreateReplicationTask		ReplicationInstance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:rep-tag/${TagKey} dms:req-tag/${TagKey}	Write
DeleteCertificate	Grants permission to delete the specified certificate	Certificate*	aws:ResourceTag/${TagKey} dms:cert-tag/${TagKey}	Write
DeleteConnection	Grants permission to delete the specified connection between a replication instance and an endpoint	Endpoint*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}	Write
DeleteConnection		ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Write
DeleteDataMigration	Grants permission to delete the specified database migration	DataMigration*	aws:ResourceTag/${TagKey} dms:data-migration-tag/${TagKey}	Write
DeleteDataProvider	Grants permission to delete the specified data provider	DataProvider*	aws:ResourceTag/${TagKey} dms:data-provider-tag/${TagKey}	Write
DeleteEndpoint	Grants permission to delete the specified endpoint	Endpoint*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}	Write
DeleteEventSubscription	Grants permission to delete an Amazon DMS event subscription	EventSubscription*	aws:ResourceTag/${TagKey} dms:es-tag/${TagKey}	Write
DeleteFleetAdvisorCollector	Grants permission to delete the specified Fleet Advisor collector			Write
DeleteFleetAdvisorDatabases	Grants permission to delete the specified Fleet Advisor databases			Write
DeleteInstanceProfile	Grants permission to delete the specified instance profile	InstanceProfile*	aws:ResourceTag/${TagKey} dms:instance-profile-tag/${TagKey}	Write
DeleteMigrationProject	Grants permission to delete the specified migration project	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
DeleteReplicationConfig	Grants permission to delete the specified replication config	ReplicationConfig*	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}	Write
DeleteReplicationInstance	Grants permission to delete the specified replication instance	ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Write
DeleteReplicationSubnetGroup	Grants permission to deletes a subnet group	ReplicationSubnetGroup*	aws:ResourceTag/${TagKey} dms:subgrp-tag/${TagKey}	Write
DeleteReplicationTask	Grants permission to delete the specified replication task	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
DeleteReplicationTaskAssessmentRun	Grants permission to delete the record of a single premigration assessment run	ReplicationTaskAssessmentRun*	aws:ResourceTag/${TagKey} dms:assessment-run-tag/${TagKey}	Write
DescribeAccountAttributes	Grants permission to list all of the Amazon DMS attributes for a customer account			Read
DescribeApplicableIndividualAssessments	Grants permission to list individual assessments that you can specify for a new premigration assessment run	ReplicationInstance	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Read
DescribeApplicableIndividualAssessments		ReplicationTask	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Read
DescribeCertificates	Grants permission to provide a description of the certificate			Read
DescribeConnections	Grants permission to describe the status of the connections that have been made between the replication instance and an endpoint			Read
DescribeConversionConfiguration	Grants permission to return information about DMS Schema Conversion project configuration	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
DescribeDataMigrations	Grants permission to return information about database migrations for your account in the specified region			Read
DescribeEndpointSettings	Grants permission to return the possible endpoint settings available when you create an endpoint for a specific database engine			Read
DescribeEndpointTypes	Grants permission to return information about the type of endpoints available			Read
DescribeEndpoints	Grants permission to return information about the endpoints for your account in the current region			Read
DescribeEngineVersions	Grants permission to return information about the available versions for DMS replication instances			Read
DescribeEventCategories	Grants permission to list categories for all event source types, or, if specified, for a specified source type			Read
DescribeEventSubscriptions	Grants permission to list all the event subscriptions for a customer account			Read
DescribeEvents	Grants permission to list events for a given source identifier and source type			Read
DescribeFleetAdvisorCollectors	Grants permission to return a paginated list of Fleet Advisor collectors in your account based on filter settings			Read
DescribeFleetAdvisorDatabases	Grants permission to return a paginated list of Fleet Advisor databases in your account based on filter settings			Read
DescribeFleetAdvisorLsaAnalysis	Grants permission to return a paginated list of descriptions of large-scale assessment (LSA) analyses produced by your Fleet Advisor collectors			Read
DescribeFleetAdvisorSchemaObjectSummary	Grants permission to return a paginated list of descriptions of schemas discovered by your Fleet Advisor collectors based on filter settings			Read
DescribeFleetAdvisorSchemas	Grants permission to return a paginated list of schemas discovered by your Fleet Advisor collectors based on filter settings			Read
DescribeMetadataModel	Grants permission to get detailed information about the specified metadata model, including its definition and corresponding converted objects in the target database if applicable	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
DescribeMetadataModelChildren	Grants permission to get a list of child metadata models for the specified metadata model in the database hierarchy	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
DescribeMetadataModelCreations	Grants permission to return a paginated list of metadata model creation requests for a migration project	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
DescribeMetadataModelImports	Grants permission to return information about start metadata model import operations for a migration project	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
DescribeOrderableReplicationInstances	Grants permission to return information about the replication instance types that can be created in the specified region			Read
DescribePendingMaintenanceActions	Grants permission to return information about pending maintenance actions			Read
DescribeRecommendationLimitations	Grants permission to return a paginated list of descriptions of limitations for recommendations of target Amazon engines			Read
DescribeRecommendations	Grants permission to return a paginated list of descriptions of target engine recommendations for your source databases			Read
DescribeRefreshSchemasStatus	Grants permission to returns the status of the RefreshSchemas operation	Endpoint*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}	Read
DescribeReplicationConfigs	Grants permission to describe replication configs			Read
DescribeReplicationInstanceTaskLogs	Grants permission to return information about the task logs for the specified task	ReplicationInstance*	aws:ResourceTag/${TagKey} aws:TagKeys dms:rep-tag/${TagKey}	Read
DescribeReplicationInstances	Grants permission to return information about replication instances for your account in the current region			Read
DescribeReplicationSubnetGroups	Grants permission to return information about the replication subnet groups			Read
DescribeReplicationTableStatistics	Grants permission to describe replication table statistics	ReplicationConfig*	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}	Read
DescribeReplicationTaskAssessmentResults	Grants permission to return the latest task assessment results from Amazon S3	ReplicationTask	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Read
DescribeReplicationTaskAssessmentRuns	Grants permission to return a paginated list of premigration assessment runs based on filter settings	ReplicationInstance	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Read
		ReplicationTask	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}
		ReplicationTaskAssessmentRun	aws:ResourceTag/${TagKey} dms:assessment-run-tag/${TagKey}
DescribeReplicationTaskIndividualAssessments	Grants permission to return a paginated list of individual assessments based on filter settings	ReplicationTask	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Read
DescribeReplicationTaskIndividualAssessments		ReplicationTaskAssessmentRun	aws:ResourceTag/${TagKey} dms:assessment-run-tag/${TagKey}	Read
DescribeReplicationTasks	Grants permission to return information about replication tasks for your account in the current region			Read
DescribeReplications	Grants permission to describe replications			Read
DescribeSchemas	Grants permission to return information about the schema for the specified endpoint	Endpoint*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}	Read
DescribeTableStatistics	Grants permission to return table statistics on the database migration task, including table name, rows inserted, rows updated, and rows deleted	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Read
ExportMetadataModelAssessment	Grants permission to export the specified metadata model assessment	MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
GetTargetSelectionRules	Grants permission to convert source selection rules into their target counterparts for schema conversion operations	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
ImportCertificate	Grants permission to upload the specified certificate		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ListDataProviders	Grants permission to list the Amazon DMS attributes for a data providers			Read
ListExtensionPacks	Grants permission to list the Amazon DMS attributes for a extension packs	MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
ListInstanceProfiles	Grants permission to list the Amazon DMS attributes for a instance profiles	InstanceProfile	aws:ResourceTag/${TagKey} dms:instance-profile-tag/${TagKey}	Read
ListMetadataModelAssessments	Grants permission to list the Amazon DMS attributes for a metadata model assessments	MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
ListMetadataModelConversions	Grants permission to list the Amazon DMS attributes for a metadata model conversions	MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
ListMetadataModelExports	Grants permission to list the Amazon DMS attributes for a metadata model exports	MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
ListMigrationProjects	Grants permission to list the Amazon DMS attributes for a migration projects. Note. Despite this action requires DescribeMigrationProjects and DescribeConversionConfiguration, both required actions do not currently authorize the described Schema Conversion operation	DataProvider	aws:ResourceTag/${TagKey} dms:data-provider-tag/${TagKey}	Read
		InstanceProfile	aws:ResourceTag/${TagKey} dms:instance-profile-tag/${TagKey}
		MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}
ListTagsForResource	Grants permission to list all tags for an Amazon DMS resource	Certificate	aws:ResourceTag/${TagKey} dms:cert-tag/${TagKey}	Read
		DataMigration	aws:ResourceTag/${TagKey} dms:data-migration-tag/${TagKey}
		DataProvider	aws:ResourceTag/${TagKey} dms:data-provider-tag/${TagKey}
		Endpoint	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}
		EventSubscription	aws:ResourceTag/${TagKey} dms:es-tag/${TagKey}
		InstanceProfile	aws:ResourceTag/${TagKey} dms:instance-profile-tag/${TagKey}
		MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}
		ReplicationConfig	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}
		ReplicationInstance	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}
		ReplicationSubnetGroup	aws:ResourceTag/${TagKey} dms:subgrp-tag/${TagKey}
		ReplicationTask	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}
		ReplicationTaskAssessmentRun	aws:ResourceTag/${TagKey} dms:assessment-run-tag/${TagKey}
		ReplicationTaskIndividualAssessment	aws:ResourceTag/${TagKey} dms:individual-assessment-tag/${TagKey}
ModifyDataMigration	Grants permission to modify the specified database migration	DataMigration*	aws:ResourceTag/${TagKey} dms:data-migration-tag/${TagKey}	Write
ModifyEndpoint	Grants permission to modify the specified endpoint	Certificate	aws:ResourceTag/${TagKey} dms:cert-tag/${TagKey}	Write
ModifyEndpoint	Grants permission to modify the specified endpoint	Endpoint*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}	Write
ModifyEventSubscription	Grants permission to modify an existing Amazon DMS event notification subscription			Write
ModifyReplicationConfig	Grants permission to modify the specified replication config	ReplicationConfig*	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}	Write
ModifyReplicationInstance	Grants permission to modify the replication instance to apply new settings	ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Write
ModifyReplicationSubnetGroup	Grants permission to modify the settings for the specified replication subnet group			Write
ModifyReplicationTask	Grants permission to modify the specified replication task	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
MoveReplicationTask	Grants permission to move the specified replication task to a different replication instance	ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Write
MoveReplicationTask		ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
RebootReplicationInstance	Grants permission to reboot a replication instance. Rebooting results in a momentary outage, until the replication instance becomes available again	ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Write
RefreshSchemas	Grants permission to populate the schema for the specified endpoint	Endpoint*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}	Write
RefreshSchemas		ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Write
ReloadReplicationTables	Grants permission to reload the target database table with the source for a replication	ReplicationConfig*	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}	Write
ReloadTables	Grants permission to reload the target database table with the source data	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
RemoveTagsFromResource	Grants permission to remove metadata tags from a DMS resource	Certificate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:cert-tag/${TagKey}	Tagging, Write
		DataMigration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:data-migration-tag/${TagKey}
		DataProvider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:data-provider-tag/${TagKey}
		Endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:endpoint-tag/${TagKey}
		EventSubscription	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:es-tag/${TagKey}
		InstanceProfile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:instance-profile-tag/${TagKey}
		MigrationProject	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:migration-project-tag/${TagKey}
		ReplicationConfig	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:replication-config-tag/${TagKey}
		ReplicationInstance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:rep-tag/${TagKey}
		ReplicationSubnetGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:subgrp-tag/${TagKey}
		ReplicationTask	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:task-tag/${TagKey}
		ReplicationTaskAssessmentRun	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:assessment-run-tag/${TagKey}
		ReplicationTaskIndividualAssessment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:individual-assessment-tag/${TagKey}
RunFleetAdvisorLsaAnalysis	Grants permission to run a large-scale assessment (LSA) analysis on every Fleet Advisor collector in your account			Write
StartDataMigration	Grants permission to start the database migration	DataMigration*	aws:ResourceTag/${TagKey} dms:data-migration-tag/${TagKey}	Write
StartMetadataModelAssessment	Grants permission to start a new assessment of metadata model	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
StartMetadataModelConversion	Grants permission to start a new conversion of metadata model	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
StartMetadataModelCreation	Grants permission to create source metadata model of the given type with the specified properties for schema conversion operations	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
StartMetadataModelExportAsScripts	Grants permission to start a new export of metadata model as script	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
StartMetadataModelExportToTarget	Grants permission to start a new export of metadata model to target	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
StartMetadataModelImport	Grants permission to start a new import of metadata model	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
StartRecommendations	Grants permission to start the analysis of your source database to provide recommendations of target engines			Write
StartReplication	Grants permission to start a replication	ReplicationConfig*	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}	Write
StartReplicationTask	Grants permission to start the replication task	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
StartReplicationTaskAssessment	Grants permission to start the replication task assessment for unsupported data types in the source database	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
StartReplicationTaskAssessmentRun	Grants permission to start a new premigration assessment run for one or more individual assessments of a migration task	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
StopDataMigration	Grants permission to stop the database migration	DataMigration*	aws:ResourceTag/${TagKey} dms:data-migration-tag/${TagKey}	Write
StopReplication	Grants permission to stop a replication	ReplicationConfig*	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}	Write
StopReplicationTask	Grants permission to stop the replication task	ReplicationTask*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}	Write
TestConnection	Grants permission to test the connection between the replication instance and the endpoint	Endpoint*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}	Read
TestConnection		ReplicationInstance*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}	Read
UpdateConversionConfiguration	Grants permission to update a conversion configuration	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
UpdateDataProvider	Grants permission to update the specified data provider	DataProvider*	aws:ResourceTag/${TagKey} dms:data-provider-tag/${TagKey}	Write
UpdateInstanceProfile	Grants permission to update the specified instance profile	InstanceProfile*	aws:ResourceTag/${TagKey} dms:instance-profile-tag/${TagKey}	Write
UpdateMigrationProject	Grants permission to update the specified migration project	MigrationProject*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Write
UpdateSubscriptionsToEventBridge	Grants permission to migrate DMS subcriptions to Eventbridge			Write

Permission-only actions for Amazon Database Migration Service

The following actions are defined by Amazon Database Migration Service but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateOutboundIntegration	Grants permission to DMS to create resources for zero-ETL integrations with self managed databases		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dms:req-tag/${TagKey}	Write
ListMetadataModelAssessmentActionItems	Grants permission to list the Amazon DMS attributes for a metadata model assessment action items. Note. Despite this action requires StartMetadataModelImport, the latter does not currently authorize the described Schema Conversion operation	MigrationProject	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}	Read
ModifyFleetAdvisorCollector	Grants permission to modify the name and description of the specified Fleet Advisor collector			Write
ModifyFleetAdvisorCollectorStatuses	Grants permission to modify the status of the specified Fleet Advisor collector			Write
ModifyOutboundIntegration	Grants permission to DMS to modify resources for zero-ETL integrations with self managed databases			Write
UploadFileMetadataList	Grants permission to upload files to your Amazon S3 bucket			Write

Resource types defined by Amazon Database Migration Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Certificate	arn:${Partition}:dms:${Region}:${Account}:cert:*	aws:ResourceTag/${TagKey} dms:cert-tag/${TagKey}
DataMigration	arn:${Partition}:dms:${Region}:${Account}:data-migration:*	aws:ResourceTag/${TagKey} dms:data-migration-tag/${TagKey}
DataProvider	arn:${Partition}:dms:${Region}:${Account}:data-provider:*	aws:ResourceTag/${TagKey} dms:data-provider-tag/${TagKey}
Endpoint	arn:${Partition}:dms:${Region}:${Account}:endpoint:*	aws:ResourceTag/${TagKey} dms:endpoint-tag/${TagKey}
EventSubscription	arn:${Partition}:dms:${Region}:${Account}:es:*	aws:ResourceTag/${TagKey} dms:es-tag/${TagKey}
InstanceProfile	arn:${Partition}:dms:${Region}:${Account}:instance-profile:*	aws:ResourceTag/${TagKey} dms:instance-profile-tag/${TagKey}
MigrationProject	arn:${Partition}:dms:${Region}:${Account}:migration-project:*	aws:ResourceTag/${TagKey} dms:migration-project-tag/${TagKey}
ReplicationConfig	arn:${Partition}:dms:${Region}:${Account}:replication-config:*	aws:ResourceTag/${TagKey} dms:replication-config-tag/${TagKey}
ReplicationInstance	arn:${Partition}:dms:${Region}:${Account}:rep:*	aws:ResourceTag/${TagKey} dms:rep-tag/${TagKey}
ReplicationSubnetGroup	arn:${Partition}:dms:${Region}:${Account}:subgrp:*	aws:ResourceTag/${TagKey} dms:subgrp-tag/${TagKey}
ReplicationTask	arn:${Partition}:dms:${Region}:${Account}:task:*	aws:ResourceTag/${TagKey} dms:task-tag/${TagKey}
ReplicationTaskAssessmentRun	arn:${Partition}:dms:${Region}:${Account}:assessment-run:*	aws:ResourceTag/${TagKey} dms:assessment-run-tag/${TagKey}
ReplicationTaskIndividualAssessment	arn:${Partition}:dms:${Region}:${Account}:individual-assessment:*	aws:ResourceTag/${TagKey} dms:individual-assessment-tag/${TagKey}

Condition keys for Amazon Database Migration Service

Amazon Database Migration Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the presence of tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
dms:assessment-run-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for AssessmentRun	String
dms:cert-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for Certificate	String
dms:data-migration-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for DataMigration	String
dms:data-provider-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for DataProvider	String
dms:endpoint-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for Endpoint	String
dms:es-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for EventSubscription	String
dms:individual-assessment-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for IndividualAssessment	String
dms:instance-profile-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for InstanceProfile	String
dms:migration-project-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for MigrationProject	String
dms:rep-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for ReplicationInstance	String
dms:replication-config-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for ReplicationConfig	String
dms:req-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the given request	String
dms:subgrp-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for ReplicationSubnetGroup	String
dms:task-tag/${TagKey}	Filters access by the presence of tag key-value pairs in the request for ReplicationTask	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Cost Explorer Service (ce)

Amazon Direct Connect (directconnect)