Learn how Cloud Migration Hub (CMH) uses your AWS AccessKey pair to survey resources, and how your information is protected.
Analyze the costs for migrating AWS resources
Before you select AK/SK as the survey method, make sure that AWS Cost Explorer is active and the account that you assign to Cloud Migration Hub (CMH) has the following permissions:
arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess
arn:aws:iam::aws:policy/Billing
arn:aws:iam::aws:rds/DescribeDbInstancesCMH calls the GetCostAndUsageRequest and GetCostAndUsageResponse operations through AWS SDKs to read your AWS service bills, which may incur read-operation charges. You must also authorize read-only access to RDS so that CMH can retrieve instance specifications and recommend comparable Alibaba Cloud RDS specifications.
CMH does not record or store your sensitive information such as the AccessKey pair. The key information you fill in is used only for the current task.
Survey AWS resources in online mode
To survey all your AWS resources in online mode, provide an AWS account with read permissions on all resources. AWS offers a system policy for read-only access that you can assign to the account:
arn:aws:iam::aws:policy/ReadOnlyAccessFor supported resource types and API details for online-mode surveys, see Fields collected from AWS. If you need a policy with fewer permissions, you can create a custom policy based on the ReadOnlyAccess policy of AWS.
Similarly, CMH does not record or store your sensitive information such as the AccessKey pair. The key information you fill in is used only for the current task.
API reference
|
Supported resources |
API operation |
Client |
|
Amazon Elastic Compute Cloud (Amazon EC2) |
DescribeInstancesRequest/Response,DescribeInstanceTypesRequest/Response,DescribeImagesRequest/Response |
Ec2Client |
|
NAT gateways |
DescribeNatGatewaysResponse |
Ec2Client |
|
Security groups |
DescribeSecurityGroupsResponse and DescribeSecurityGroupRulesIterable |
Ec2Client |
|
Amazon Virtual Private Cloud (Amazon VPC) |
DescribeVpcsResponse |
Ec2Client |
|
Availability Zones (AZs) |
DescribeAvailabilityZonesResponse |
Ec2Client |
|
Elastic Load Balancing (ELB) |
DescribeTargetGroupsResponse, DescribeInstancesResponse, DescribeLoadBalancersResponse, and DescribeTagsRequest/Response |
ElasticLoadBalancingV2Client and Ec2Client |
|
Amazon RDS |
DescribeDbInstancesRequest/Response |
RdsClient |
|
Amazon ElastiCache |
DescribeCacheClustersResponse, DescribeCacheSubnetGroupsResponse, and ListTagsForResourceRequest/Response |
ElastiCacheClient |
|
Amazon Simple Storage Service (Amazon S3) |
ListBucketsResponse, ListObjectsV2Request/Response, GetBucketTaggingRequest/Response, GetPublicAccessBlockRequest/Response, GetBucketLifecycleConfigurationRequest/Response, GetBucketReplicationRequest/Response, and ListBucketInventoryConfigurationsRequest/Response |
S3Client |
|
Amazon ElastiCache |
DescribeCacheClustersResponse, DescribeCacheSubnetGroupsResponse, and ListTagsForResourceRequest/Response |
ElastiCacheClient |
|
Amazon DocumentDB |
DescribeSecurityGroupsResponse, DescribeDbClustersResponse, and ListTagsForResourceRequest/Response |
DocDbClient and Ec2Client |
|
Elasticsearch |
DescribeCacheClustersResponse, DescribeCacheSubnetGroupsResponse, and ListTagsForResourceRequest/Response |
ElastiCacheClient |
|
Amazon Managed Streaming for Apache Kafka (Amazon MSK) |
DescribeSecurityGroupsResponse and ListClustersV2Request/Response |
KafkaClient and Ec2Client |
|
Security group rules |
DescribeSecurityGroupRulesRequest/Response and DescribeSecurityGroupRulesIterable |
Ec2Client |
|
OLAP databases |
DescribeClustersResponse |
RedshiftClient |
|
Amazon Elastic Kubernetes Service (Amazon EKS) |
ListClustersRequest/Response and DescribeClusterRequest/Response |
EksClient |
|
AWS Global Accelerator |
ListAcceleratorsRequest/Response |
GlobalAcceleratorClient |
|
Amazon Athena |
ListDataCatalogsRequest/Response, ListDatabasesRequest/Response, and ListTableMetadataRequest/Response |
AthenaClient |
|
Amazon Lambda |
ListFunctionsRequest/Response and GetFunctionRequest/Response |
LambdaClient |
|
Amazon CloudFront |
ListDistributionsResponse and ListTagsForResourceRequest/Response |
CloudFrontClient |
|
Amazon MQ |
ListBrokersResponse and DescribeBrokerRequest/Response |
MqClient |
|
Amazon Simple Queue Service (Amazon SQS) |
ListQueuesRequest/Response, GetQueueAttributesRequest/Response, and ListQueueTagsRequest/Response |
SqsClient |
|
Auto Scaling |
DescribeAutoScalingGroupsRequest/Response |
AutoScalingClient |
|
Elastic IP Address (EIP) |
DescribeAddressesResponse |
Ec2Client |