Help Center/ Migration Center/ User Guide/ Permissions Management/ Using Identity Policies to Assign Custom Permissions to IAM Users (New Version)
Updated on 2026-10-13 GMT+08:00
View PDF
Share

Using Identity Policies to Assign Custom Permissions to IAM Users (New Version)

With IAM, you can configure permission policies to grant IAM users in your account fine-grained MgC permissions, enabling effective permission isolation.

This section describes the custom permission policies that you need to configure for IAM users to use different MgC functions. For details about how to customize permissions for IAM users, see Creating a Custom Identity Policy.

You can add actions required for various scenarios to a single custom policy, instead of creating a new policy for every function.

Agency Authorization Permissions Required for IAM Users

When an IAM user first uses certain MgC functions, they must authorize MgC to create custom identity policies through an agency. Table 1 lists the custom identity policies and permissions required for the agency authorization.

Table 1 Policies and permissions required for agency authorization

Scenario

Function

Description

Mandatory

Action

IAM agency permissions

Performing Agency Authorization

Agency authorization is required to use certain MgC functions.

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:agencies:list",
                "iam:agencies:create",
                "iam:roles:list",
                "iam:roles:update",
                "iam:roles:create",
                "iam:quotas:list",
                "iam:agencies:listRoles",
                "iam:agencies:grantRole",
                "iam:agencies:revokeRole",
                "iam:agencies:grantRoleOnProject",
                "iam:agencies:checkRoleOnProject"
            ]
        }
    ]
}

Migrating Servers in Batches

Table 2 lists the functions and permissions required for batch server migration.

Table 2 Permissions required for batch server migration

Scenario

Function

Description

Action

Migrating Servers in Batches

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCMigrationPlanAccessPolicy, MGCAssessmentAccessPolicy, MGCWorkflowAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined identity policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "tms:predefineTags:list",
                "kms:cmk:list",
                "deh:dedicatedHostTypes:list",
                "deh:dedicatedHosts:list",
                "obs:bucket:listAllMyBuckets",
                "obs:bucket:listBucket",
                "eps:enterpriseProjects:list",
                "kms:cmk:get",
                "kms:dek:decrypt",
                "sms:server:migrationServer",
                "sms:server:queryServer",
                "sms:server:register",
                "smn:topic:listTopic",
                "smn:topic:get",
                "vpc:securityGroups:create",
                "vpc:securityGroupRules:create",
                "vpc:vpcs:create",
                "vpc:publicIps:create",
                "vpc:subnets:create",
                "ecs:cloudServers:attach",
                "ecs:cloudServers:detachVolume",
                "ecs:cloudServers:start",
                "ecs:cloudServers:stop",
                "ecs:cloudServers:delete",
                "ecs:cloudServers:reboot",
                "ecs:cloudServers:updateMetadata",
                "ecs:serverPasswords:manage",
                "ecs:CloudServers:create",
                "ecs:servers:setMetadata",
                "ecs:serverVolumes:use",
                "ecs:serverInterfaces:use",
                "ecs:serverGroups:manage",
                "ecs:securityGroups:use",
                "ecs:servers:unlock",
                "ecs:servers:rebuild",
                "ecs:servers:lock",
                "ecs:servers:reboot",
                "evs:volumes:use",
                "evs:volumes:create",
                "evs:volumes:update",
                "evs:volumes:delete",
                "evs:snapshots:create",
                "evs:snapshots:delete",
                "evs:snapshots:rollback",
                "ecs:*:get*",
                "ecs:*:list*",
                "evs:*:get*",
                "evs:*:list*",
                "vpc:*:list*",
                "vpc:*:get*",
                "ims:*:get*",
                "ims:*:list*"
            ]
        }
    ]
}

Collecting Server Resources

Collecting information about the servers to be migrated

Adding Source Servers

Accessing the resource list and selecting the servers to be migrated

Associating Existing Target Servers

Associating a source server with a Huawei Cloud target server

Getting Target Recommendations

The system can recommend right-sized Huawei Cloud servers based on source server specifications.

Creating a Batch Server Migration Task

Creating and executing a batch server migration task

Checking Resource Quotas

Checking whether the resource quota of the migration account in the target region meets the requirements

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-migration Stage and Script

Adding a stage or step to a migration task

Migrating Servers Across AZs

Table 3 lists the functions and permissions required for batch server migration across AZs.

Table 3 Permissions required for batch server migration across AZs

Scenario

Function

Description

Action

Migrating Servers Across AZs

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCMigrationPlanAccessPolicy, MGCAssessmentAccessPolicy, MGCWorkflowAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined identity policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServers:listServersDetails",
                "ecs:availabilityZones:list",
                "evs:volumes:list",
                "ecs:cloudServerFlavors:get",
                "evs:types:get",
                "smn:topic:listTopic"
            ]
        }
    ]
}

Collecting Server Resources

Collecting information about the servers to be migrated

Creating a Cross-AZ Batch Server Migration Plan

Creating a server migration plan, planning server migration batches, and configuring migration parameters

Selecting Source AZ

Selecting the region and AZ where the servers to be migrated are located

Configuring Target Servers

By default, the system recommends target servers that match the source servers.

Getting Notifications

Enabling notifications in migration parameters requires SMN permissions.

Creating a Cross-AZ Batch Server Migration Task

Creating and executing a cross-AZ batch server migration task

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-migration Stage and Script

Adding a stage or step to a migration task

Migrating Servers Across Regions

Table 4 lists the functions and permissions required for batch server migration across regions.

Table 4 Permissions required for cross-region server migration

Scenario

Function

Description

Action

Migrating Servers Across Regions

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCMigrationPlanAccessPolicy, MGCAssessmentAccessPolicy, MGCWorkflowAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined identity policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "evs:volumes:list",
                "ecs:cloudServers:listServersDetails",
                "ecs:availabilityZones:list",
                "vpc:vpcs:list",
                "vpc:subnets:get",
                "vpc:securityGroups:get",
                "vpc:securityGroups:list",
                "smn:topic:listTopic"
            ]
        }
    ]
}

Collecting Server Resources

Collecting information about the servers to be migrated

Creating a Cross-Region Server Migration Plan

Creating a server migration plan, planning server migration batches, and configuring migration parameters

Selecting Source Servers

Selecting the source region and source servers

Configuring Target Servers

Selecting the target region and AZ, automatically or manually configuring the target network, and customizing the target specifications

Getting Notifications

Enabling notifications in migration parameters requires SMN permissions.

Creating a Cross-Region Server Migration Task

Creating and executing a cross-region batch server migration task

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-migration Stage and Script

Adding a stage or step to a migration task

Migrating Storage Data

Table 5 lists the functions and permissions required for storage resource migration.

Table 5 Permissions required for storage migration

Scenario

Function

Description

Action

Migrating Storage Data

Managing Migration Projects

Creating an application migration project
  • Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCMigrationPlanAccessPolicy, MGCAssessmentAccessPolicy, MGCWorkflowAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined identity policies supported by MgC, see Table 1.
  • For details about the permissions required for creating an OBS bucket and an SFS file system, see:
  • Create the custom identity policy below and assign it to the IAM user. 
    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kps:SSHKeyPair:list",
                "nat:natGateways:list",
                "vpc:vpcs:list",
                "vpc:subnets:get",
                "ecs:cloudServerFlavors:get",
                "oms:cluster:list",
                "oms:cluster:create",
                "oms:cluster:get",
                "oms:bucket:listBuckets",
                "oms:bucket:listObjects",
                "oms:task:get",
                "oms:workflowTask:showMonitoring",
                "oms:workflowTask:update",
                "oms:cluster:upgradeVersion",
                "oms:cluster:updateBaseInfo",
                "oms:node:extend",
                "oms:cluster:retry",
                "oms:cluster:delete",
                "oms:node:retry",
                "oms:node:reinstall",
                "oms:node:delete",
                "oms:cluster:updateExtendProperty",
                "oms:cluster:retryExtendProperty",
                "eps:enterpriseProjects:list",
                "smn:topic:get",
                "smn:topic:listTopic",
                "smn:topic:listAttributes",
                "kms:cmk:get",
                "kms:cmk:list",
                "obs:bucket:listAllMyBuckets",
                "obs:object:GetObject",
                "obs:bucket:ListBucket"
            ]
        }
    ]
}

Collecting Storage Resource Information

Collecting information about the storage resources to be migrated
  • Creating an Object Storage Migration Plan
  • Creating a File Storage Migration Plan

Creating a batch migration plan for object storage and file storage, planning migration batches, and configuring migration parameters

Creating Target Storage Systems

MgC supports migrations from object storage to file storage and from file storage to object storage (OBS buckets). Target object buckets or file systems must be prepared on Huawei Cloud in advance.

Configuring Target Buckets

Configuring target buckets for receiving data from source buckets

Managing Migration Clusters

A migration cluster is a core component for storage migration tasks. It allows you to create and manage migration nodes and list nodes, and deploy and upgrade migration plugins, ensuring smooth operations of storage tasks.

Creating a General Storage Migration Plan

Creating a general storage migration plan. Enabling notifications requires SMN permissions.

Getting Notifications

Enabling notifications requires SMN permissions.

Key Encryption

Using KMS keys for encryption during the creation of migration plans requires certain permissions.

Importing File Storage Migration Plans in Batches

Importing source file storage resources in batches using a template

Creating a Storage Migration Task

Creating a storage migration task based on a migration plan

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-migration Stage and Script

Adding a stage or step to a migration task

Big Data Migration

Table 6 lists the functions and permissions required for big data migration.

Table 6 Permissions required for big data migration

Scenario

Function

Description

Action

Big Data Migration

Managing Migration Projects

Creating big data migration projects

Assign the system-defined identity policy MGCBigdataAccessPolicy to the IAM user. For details about the system-defined identity policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dli:queue:list",
                "mrs:cluster:listHosts"
            ]
        }
    ]
}

Managing Connections

Creating source and target connections

NOTE:

Using the resource collection function requires the MRSReadOnlyAccessPolicy and DLIReadOnlyPolicy permissions.

Migrating Data

Creating and executing a big data migration task

Big Data Verification

Table 7 lists the functions and permissions required for big data verification.

Table 7 Permissions required for big data verification

Scenario

Function

Description

Action

Big Data Verification

Managing Migration Projects

Creating big data migration projects

Assign the system-defined identity policies MGCBigdataAccessPolicy and SMN FullAccess to the IAM user. For details about the system-defined identity policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dli:queue:list",
                "mrs:cluster:listHosts",
                "smn:topic:listTopic",
                "obs:object:GetObject",
                "obs:object:PutObject"
            ]
        }
    ]
}

Managing Connections

Creating source and target connections

NOTE:

Using the resource collection function requires the MRSReadOnlyAccessPolicy and DLIReadOnlyPolicy permissions.

Managing Tasks

Creating and executing verification tasks for the source and target. Enabling notifications requires SMN permissions. Creating a custom verification task requires OBS upload and download permissions.

Managing Instances

Checking the task execution progress, exporting error lists, and uploading error logs. Uploading logs requires OBS upload and download permissions.

Resource Collection

Table 8 lists the functions and permissions required for resource collection.

Table 8 Permissions required for resource collection

Scenario

Function

Description

Action

Cloud Discovery

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCAssessmentAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Online Discovery – Cloud Platform Discovery

Collecting cloud resource information

Collection Method – Credentials

Collecting resource information using credentials

Huawei Cloud Discovery – Agency

Collecting resource information using an agency

SMS Server Synchronization

Online Discovery – SMS Server Synchronization

Synchronizing server information collected by SMS to MgC

Intranet Discovery

IDC Discovery

Discovering IDC servers via network segment scanning

VMware Discovery

Discovering VMs in VMware vCenter

Import

RVTools Data Import

Importing RVTools data to MgC to obtain a server resource list

Cloud Inventory Import
  1. Resource exports (all resources) from Alibaba Cloud Resource Management are supported.
  2. Resource exports (all resources) from Azure Resource Manager are supported.

Collection Result Import

Importing local resource information collected by MgC Agent collectors

Template Import

Importing resources in batches using a template and associating credentials with them

Resource List

Resource Management

Querying resources (such as server, container, database, middleware, big data, network, and storage resources) in a specified migration project and managing these resources

Questionnaires

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCAssessmentAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:object:GetObject",
                "obs:bucket:ListAllMyBuckets",
                "obs:bucket:ListBucket"
            ]
        }
    ]
}

Importing Responses to the Architecture Survey

Importing architecture survey responses using a file

Architecture Survey – Selecting a Response File from an OBS Bucket

Selecting the file used to import architecture survey responses

Maturity Assessments

Maturity assessments

Application List

Associating Resources with Applications to Implement Resource Grouping

Querying applications in a specified migration project

Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCAssessmentAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:availabilityZones:list"
            ]
        }
    ]
}

Creating or Modifying an Application
  1. Business Scenario – Intra-Cloud Migration – Cross-AZ Migration
  2. Business Scenario – Intra-Cloud Migration – Cross-Region Migration

Assessment

Table 9 lists the functions and permissions required for assessment.

Table 9 Permissions required for assessment

Scenario

Function

Description

Action

TCO Analysis for On-Prem to Cloud Migration

Creating a Task

With the provided on-premises infrastructure details and assumptions, the system automatically matches source resources with equivalent Huawei Cloud products and usage, providing a cost comparison.

Assign the following system policies to the IAM user: MGCAssessmentAccessPolicy and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.

Saving, Downloading, or Deleting a Report

Saving, downloading, or deleting a cost comparison report

TCO Analysis for Cross-Cloud Migration with Credentials

Creating or Deleting an Analysis Task

With the provided source cloud credentials, the system matches source resources with target alternatives and performs cost analysis, providing a comprehensive migration cost report.
  • Assign the following system policies to the IAM user: MGCAssessmentAccessPolicy and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.
  • Create the custom identity policy below and assign it to the IAM user. 
    {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:cloudServerFlavors:get",
        "evs:types:get",
        "ims:images:list"
      ]
    }
  ]
}
  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

Downloading Bills

By analyzing the source bills for a specified period, the system identifies product billing items and gathers details like product specifications, monthly average usage, and monthly average consumption.

Viewing Analysis Results

In terms of usage costs, the system compares the costs of the source cloud vendor and Huawei Cloud within a specified period.

Viewing Product Mappings

Viewing, adding, modifying, or deleting product mappings, and adjusting the predefined resource mapping logic to ensure the resulting resource specifications meet requirements

TCO Analysis for Cross-Cloud Migration with Bills

Creating an Analysis Task

By analyzing uploaded source bills, the system identifies what and how many source resources are used on the source cloud, matches the source resources with Huawei Cloud alternatives, and then compares the costs of source environment with the costs on Huawei Cloud.
  • Assign the following system policies to the IAM user: MGCAssessmentAccessPolicy and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.
  • Create the custom identity policy below and assign it to the IAM user. 
    {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:cloudServerFlavors:get",
        "evs:types:get",
        "ims:images:list"
      ]
    }
  ]
}
  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

Exporting or Deleting Analysis Results

Exporting or deleting analysis results

Migration Journeys (Old)

Creating or Deleting a Migration Journey

There are ready-to-use migration framework templates for complex scenarios, including database and LLM migrations.

Assign the following system policies to the IAM user: MGCAssessmentAccessPolicy and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user.

{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mgc:journey:*"
      ]
    }
  ]
}

Cloud Migration Planning – Importing a Migration Plan

Importing a Migration Plan

Uploading migration assessment reports through the console. The uploaded files will be stored for 15 days.

Assign the following system policies to the IAM user: MGCAssessmentAccessPolicy and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.

Cloud Migration Planning – Generating Target Recommendations

Creating or Deleting a Target Recommendation Task

The system can recommend right-sized Huawei Cloud resources based on the source resource specifications.
  • Assign the following system policies to the IAM user: MGCAssessmentAccessPolicy and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.
  • Create the custom identity policy below and assign it to the IAM user. 
    {
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:availabilityZones:list",
                "ecs:cloudServerFlavors:get",
                "deh:dedicatedHosts:list",
                "deh:dedicatedHostTypes:list",
                "evs:types:get",
                "ims:images:list",
                "vpc:vpcs:list",
                "vpc:securityGroups:list",
                "vpc:subnets:list"
            ]
        }
    ]
}
    NOTE:

    In certain regions, identity policy–based custom permissions for IAM users are not yet available for DeH. You need to downgrade the custom permissions for IAM users configured using roles and policies. For details, see Cloud Migration Planning – Generating Target Recommendations.

  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

Exporting Assessment Results

Exporting assessment results

Cross-Region and Cross-AZ Assessment

When applications configured for cross-AZ or cross-region migration are assessed using the intra-cloud migration assessment policy, target resources inherit the source specifications by default. If an exact match is unavailable, the system automatically identifies and selects the closest possible specifications for the target.

Configuring Preferences – Servers

During target recommendation, the system gives priority to servers matching the configured preferences.

Reassessing Source Resources

Modifying the assessment policy to generate target recommendations again

Modifying Resource Assessment Results

Changing the billing mode, product, and migration policy, and configuring specifications for a target server on the Custom page

Viewing Resource Details

Viewing resource details in the assessment report

Cloud Migration Planning – Migration Risk Assessment

Creating, Exporting, and Deleting a Migration Risk Assessment

Creating a risk assessment to check for potential risks that may affect the migration in advance

Assign the following system policies to the IAM user: MGCAssessmentAccessPolicy and MGCManagementAccessPolicy. For details about the system-defined policies supported by MgC, see Table 1.

Cloud Migration Planning – Storage Migration Assessment

Creating, Exporting, and Deleting a Storage Migration Assessment

Creating a storage migration assessment to automatically calculate the migration cluster specifications, network bandwidth, and migration costs required for the migration and generate different migration solutions

Cloud Migration Planning – Big Data Migration Assessment

Creating, Exporting, and Deleting a Big Data Migration Assessment

Assessing how much cluster queue resources are required based on the number of tables and partition changes to be processed

Migration Journeys (New)

Configure the required permissions based on the migration journey functions you need.

Server Migration Journey

Before using the server migration journey, configure the required permissions based on Table 10.

Table 10 Permissions required for functions related to the server migration journey

Scenario

Function

Description

Action

Server Migration Journey

Managing Resource List

Adding or deleting resources

Assign the following system policies to the IAM user: MGCCollectionAccessPolicy, MGCMigrationPlanAccessPolicy, MGCAssessmentAccessPolicy, MGCJourneyAccessPolicy, MGCWorkflowAccessPolicy, and MGCManagementAccessPolicy. For details about the system-defined identity policies supported by MgC, see Table 1.

Create the custom identity policy below and assign it to the IAM user. 
{
    "Version": "5.0",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "tms:predefineTags:list",
                "deh:dedicatedHostTypes:list",
                "deh:dedicatedHosts:list",
                "eps:enterpriseProjects:list",
                "obs:bucket:listAllMyBuckets",
                "obs:bucket:listBucket",
                "kms:cmk:get",
                "kms:dek:decrypt",
                "kms:cmk:list",
                "sms:server:migrationServer",
                "sms:server:queryServer",
                "sms:server:register",
                "smn:topic:listTopic",
                "smn:topic:get",
                "vpc:securityGroups:create",
                "vpc:securityGroupRules:create",
                "vpc:vpcs:create",
                "vpc:publicIps:create",
                "vpc:subnets:create",
                "ecs:cloudServers:create",
                "ecs:cloudServers:attach",
                "ecs:cloudServers:detachVolume",
                "ecs:cloudServers:start",
                "ecs:cloudServers:stop",
                "ecs:cloudServers:delete",
                "ecs:cloudServers:reboot",
                "ecs:cloudServers:updateMetadata",
                "ecs:serverPasswords:manage",
                "ecs:servers:setMetadata",
                "ecs:serverVolumes:use",
                "ecs:serverInterfaces:use",
                "ecs:serverGroups:manage",
                "ecs:securityGroups:use",
                "ecs:servers:unlock",
                "ecs:servers:rebuild",
                "ecs:servers:lock",
                "ecs:servers:reboot",
                "evs:volumes:use",
                "evs:volumes:create",
                "evs:volumes:update",
                "evs:volumes:delete",
                "evs:snapshots:create",
                "evs:snapshots:delete",
                "evs:snapshots:rollback",
                "ecs:*:get*",
                "ecs:*:list*",
                "evs:*:get*",
                "evs:*:list*",
                "vpc:*:list*",
                "vpc:*:get*",
                "ims:*:get*",
                "ims:*:list*"
            ]
        }
    ]
}

Managing Migration Batches

Creating, removing, deleting, or associating migration batches

Creating a Batch Server Migration Plan

Creating a server migration plan, planning server migration batches, and configuring migration parameters

Associating Existing Target Servers

Associating a source server with a Huawei Cloud target server

Getting Target Recommendations

The system can recommend right-sized Huawei Cloud servers based on source server specifications.

Getting Notifications

Enabling notifications in migration parameters requires SMN permissions.

Creating a Batch Server Migration Task

Creating and executing a batch server migration task

Checking Resource Quotas

Checking whether the resource quota of the migration account in the target region meets the requirements

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the automatically created custom policies and their allowed actions, see Server Migration Journey.

Adding a Post-migration Stage and Script

Adding a stage or step to a migration task

Online Discovery - SMS Server Synchronization

Synchronizing server information collected by SMS to MgC
Parent Topic: Permissions Management