Help Center/ Migration Center/ User Guide/ Permissions Management/ Agency Permissions

Updated on 2026-05-22 GMT+08:00

Agency Permissions

Overview

To use certain functions of MgC, you must assign MgC the required permissions so that it can provide you with complete services. This section describes the scenarios where agency-based authorization is required and what custom permission policies will be created.

The system may create a new custom policy or update an existing policy during the agency-based authorization.

If there is no available custom policy, the system automatically creates a new one.
If there is an available custom policy but it does not contain required rules, the system automatically updates the policy.

Do not modify the custom policy unless necessary. Otherwise, system permission verification may fail, affecting related functions.

Checking Agency Permissions

You can check the agency permissions granted to MgC by performing the following operations.

Sign in to the IAM console.
In the navigation pane on the left, click Agencies.
In the agency list, find the agency named mgc_migration_trust and click its name.
On the Permissions tab, check the policies that have been assigned to MgC.

Cross-AZ Server Migration

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Migrating servers across AZs	MgC	MgC AzMigrationAgencyPolicy	ecs:cloudServers:showServer (Querying details about an ECS) ecs:flavors:get (Querying ECS flavors) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ecs:cloudServerQuotas:get (Querying quotas of a tenant) ecs:servers:list (Querying ECSs) ecs:cloudServers:list (Querying details about ECSs) ecs:servers:stop (Stopping an ECS) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS) ecs:cloudServers:createServers (Creating an ECS) ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS) ecs:cloudServerNics:update (Configuring a private IP address for a NIC of an ECS) ecs:availabilityZones:list (Listing AZs) ecs:servers:start (Starting an ECS) ecs:cloudServers:changeNetworkInterface (Updating attributes of a specified NIC on an ECS) ecs:serverInterfaces:get (Querying ECS NICs) ecs:cloudServers:get (Querying details about an ECS) vpc:publicIps:create (Creating an EIP) vpc:publicIps:update (Updating an EIP) vpc:subnets:get (Querying subnets or querying details about a subnet) vpc:networks:get (Querying networks) vpc:publicIps:list (Listing EIPs) vpc:publicIps:get (Querying details about an EIP) vpc:ports:get (Querying ports or querying details about a port) vpc:ports:delete (Deleting a port) vpc:ports:update (Updating a port) vpc:ports:create (Creating a port) evs:types:get (Querying EVS disk types) evs:volumes:list (Listing EVS disks) cbr:vaults:get (Querying a specified vault) cbr:vaults:list (Querying vaults) cbr:vaults:create (Creating a vault) cbr:vaults:addResources (Associating resources) cbr:vaults:backup (Creating backups) cbr:backups:list (Querying backups) cbr:tasks:list (Querying tasks) cbr:tasks:get (Querying details about a task) cbr:backups:delete (Deleting a backup) cbr:backups:get (Querying a backup) cbr:vaults:delete (Deleting a vault) ims:wholeImages:create (Creating a full-ECS image) ims:images:list (Listing images) ims:images:delete (Deleting an image) ims:images:get (Querying details about an image) ims:serverImages:create (Creating an image)
Enabling SMN notifications for a cross-AZ migration workflow	MgC	MgC MigrationSmnAgencyPolicy	smn:topic:list (Listing topics) smn:topic:publish (Publishing messages)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Migrating servers across AZs

MgC

MgC AzMigrationAgencyPolicy

ecs:cloudServers:showServer (Querying details about an ECS)

ecs:flavors:get (Querying ECS flavors)

ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information)

ecs:cloudServerQuotas:get (Querying quotas of a tenant)

ecs:servers:list (Querying ECSs)

ecs:cloudServers:list (Querying details about ECSs)

ecs:servers:stop (Stopping an ECS)

ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)

ecs:cloudServers:createServers (Creating an ECS)

ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS)

ecs:cloudServerNics:update (Configuring a private IP address for a NIC of an ECS)

ecs:availabilityZones:list (Listing AZs)

ecs:servers:start (Starting an ECS)

ecs:cloudServers:changeNetworkInterface (Updating attributes of a specified NIC on an ECS)

ecs:serverInterfaces:get (Querying ECS NICs)

ecs:cloudServers:get (Querying details about an ECS)

vpc:publicIps:create (Creating an EIP)

vpc:publicIps:update (Updating an EIP)

vpc:subnets:get (Querying subnets or querying details about a subnet)

vpc:networks:get (Querying networks)

vpc:publicIps:list (Listing EIPs)

vpc:publicIps:get (Querying details about an EIP)

vpc:ports:get (Querying ports or querying details about a port)

vpc:ports:delete (Deleting a port)

vpc:ports:update (Updating a port)

vpc:ports:create (Creating a port)

evs:types:get (Querying EVS disk types)

evs:volumes:list (Listing EVS disks)

cbr:vaults:get (Querying a specified vault)

cbr:vaults:list (Querying vaults)

cbr:vaults:create (Creating a vault)

cbr:vaults:addResources (Associating resources)

cbr:vaults:backup (Creating backups)

cbr:backups:list (Querying backups)

cbr:tasks:list (Querying tasks)

cbr:tasks:get (Querying details about a task)

cbr:backups:delete (Deleting a backup)

cbr:backups:get (Querying a backup)

cbr:vaults:delete (Deleting a vault)

ims:wholeImages:create (Creating a full-ECS image)

ims:images:list (Listing images)

ims:images:delete (Deleting an image)

ims:images:get (Querying details about an image)

ims:serverImages:create (Creating an image)

Enabling SMN notifications for a cross-AZ migration workflow

MgC

MgC MigrationSmnAgencyPolicy

smn:topic:list (Listing topics)

smn:topic:publish (Publishing messages)

TCO Analysis

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Creating a TCO analysis task	MgC	MgC TcoAgencyPolicy	ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) evs:types:get (Querying EVS disk types)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Creating a TCO analysis task

MgC

MgC TcoAgencyPolicy

ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information)

evs:types:get (Querying EVS disk types)

Cloud Discovery

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Huawei Cloud discovery	MgC	MgC CloudPlatformCollectionAgencyPolicy	vpc:vpcs:list (Listing VPCs) vpc:subnets:get (Querying subnets or querying details about a subnet) vpc:securityGroups:get (Querying security groups or querying details about a security group) vpc:securityGroupRules:get (Querying security group rules or querying details about a security group rule) vpc:publicIps:list (Listing EIPs) ecs:cloudServers:list (Querying details about ECSs) evs:volumes:list (Listing EVS disks) ces:metricData:list (Querying metric data) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Huawei Cloud discovery

MgC

MgC CloudPlatformCollectionAgencyPolicy

vpc:vpcs:list (Listing VPCs)

vpc:subnets:get (Querying subnets or querying details about a subnet)

vpc:securityGroups:get (Querying security groups or querying details about a security group)

vpc:securityGroupRules:get (Querying security group rules or querying details about a security group rule)

vpc:publicIps:list (Listing EIPs)

ecs:cloudServers:list (Querying details about ECSs)

evs:volumes:list (Listing EVS disks)

ces:metricData:list (Querying metric data)

ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)

SMS Server Synchronization

Scenario	Delegated Object	Custom Policy	Minimal Permissions
SMS server synchronization	MgC	MgC SmsSyncCollectionAgencyPolicy	sms:server:queryServer (Querying servers and details)

Target Recommendation

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Target recommendation	MgC	MgC ServerAssessAgencyPolicy	ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ims:images:list (Listing images) evs:types:get (Querying EVS disk types) deh:dedicatedHosts:get (Obtaining details about a DeH) deh:dedicatedHosts:list (Listing DeHs)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Target recommendation

MgC

MgC ServerAssessAgencyPolicy

ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information)

ims:images:list (Listing images)

evs:types:get (Querying EVS disk types)

deh:dedicatedHosts:get (Obtaining details about a DeH)

deh:dedicatedHosts:list (Listing DeHs)

Target Server Association

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Target server association	MgC	MgC ServerBindTargetAgencyPolicy	ecs:cloudServers:showServer (Querying details about an ECS) evs:volumes:list (Listing EVS disks) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ims:images:list (Listing images)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Target server association

MgC

MgC ServerBindTargetAgencyPolicy

ecs:cloudServers:showServer (Querying details about an ECS)

evs:volumes:list (Listing EVS disks)

ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information)

ims:images:list (Listing images)

Migration Plans

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Batch server migration plans – server quota verification	MgC	MgC ServerMigrationQuotasAgencyPolicy	ecs:cloudServers:list (Querying details about ECSs) evs:quotas:get (Querying EVS disk quotas) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:quotas:list (Listing resource quotas)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Batch server migration plans – server quota verification

MgC

MgC ServerMigrationQuotasAgencyPolicy

ecs:cloudServers:list (Querying details about ECSs)

evs:quotas:get (Querying EVS disk quotas)

ecs:cloudServerQuotas:get (Querying quotas of a tenant)

vpc:quotas:list (Listing resource quotas)

Server Migration Workflows

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Server migration workflows	MgC	MgC ServerMigrationAgencyPolicy	ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServers:createServers (Creating an ECS) sms:server:migrationServer (Migrating a source server) sms:server:queryServer (Querying source servers) ecs:cloudServers:list (Querying ECSs) ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:publicIps:create (Creating an EIP) vpc:privateIps:list (Querying private IP addresses) ecs:cloudServers:get (Querying details about an ECS) ecs:cloudServers:changeVpc (Changing a VPC for an ECS) ecs:cloudServers:attach (Attaching a disk to an ECS) ecs:cloudServers:start (Starting ECSs in batches) ecs:cloudServers:detachVolume (Detaching a disk from a specified ECS) ecs:cloudServers:stop (Stopping ECSs in batches) ecs:servers:unlock (Unlocking an ECS) evs:volumes:delete (Deleting an EVS disk) evs:volumes:use (Attaching and detaching EVS disks) evs:volumes:get (Querying details about an EVS disk) ims:images:get (Querying details about an image)
Enabling the option to retain IP addresses for a server migration workflow	MgC	MgC ServerMigrationIpKeepAgencyPolicy	vpc:subnets:get (Querying subnets or querying details about a subnet) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)
Enabling SMN notifications for a server migration workflow	MgC	MgC MigrationSmnAgencyPolicy	smn:topic:list (Listing topics) smn:topic:publish (Publishing messages)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Server migration workflows

MgC

MgC ServerMigrationAgencyPolicy

ecs:cloudServers:showServer (Querying details about an ECS)

ecs:cloudServers:createServers (Creating an ECS)

sms:server:migrationServer (Migrating a source server)

sms:server:queryServer (Querying source servers)

ecs:cloudServers:list (Querying ECSs)

ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS)

ecs:cloudServerQuotas:get (Querying quotas of a tenant)

vpc:publicIps:create (Creating an EIP)

vpc:privateIps:list (Querying private IP addresses)

ecs:cloudServers:get (Querying details about an ECS)

ecs:cloudServers:changeVpc (Changing a VPC for an ECS)

ecs:cloudServers:attach (Attaching a disk to an ECS)

ecs:cloudServers:start (Starting ECSs in batches)

ecs:cloudServers:detachVolume (Detaching a disk from a specified ECS)

ecs:cloudServers:stop (Stopping ECSs in batches)

ecs:servers:unlock (Unlocking an ECS)

evs:volumes:delete (Deleting an EVS disk)

evs:volumes:use (Attaching and detaching EVS disks)

evs:volumes:get (Querying details about an EVS disk)

ims:images:get (Querying details about an image)

Enabling the option to retain IP addresses for a server migration workflow

MgC

MgC ServerMigrationIpKeepAgencyPolicy

vpc:subnets:get (Querying subnets or querying details about a subnet)

ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)

Enabling SMN notifications for a server migration workflow

MgC

MgC MigrationSmnAgencyPolicy

smn:topic:list (Listing topics)

smn:topic:publish (Publishing messages)

Server Migration Tasks

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Server migration tasks	MgC	MgC ServerMigrationAgencyPolicy	ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServers:createServers (Creating an ECS) sms:server:migrationServer (Migrating a source server) sms:server:queryServer (Querying source servers) ecs:cloudServers:list (Querying ECSs) ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:publicIps:create (Creating an EIP) vpc:privateIps:list (Querying private IP addresses) ecs:cloudServers:get (Querying details about an ECS) ecs:cloudServers:changeVpc (Changing a VPC for an ECS) ecs:cloudServers:attach (Attaching a disk to an ECS) ecs:cloudServers:start (Starting ECSs in batches) ecs:cloudServers:detachVolume (Detaching a disk from a specified ECS) ecs:cloudServers:stop (Stopping ECSs in batches) ecs:servers:unlock (Unlocking an ECS) evs:volumes:delete (Deleting an EVS disk) evs:volumes:use (Attaching and detaching EVS disks) evs:volumes:get (Querying details about an EVS disk) ims:images:get (Querying details about an image)
Enabling the option to retain IP addresses for a server migration task	MgC	MgC ServerMigrationIpKeepAgencyPolicy	vpc:subnets:get (Querying subnets or querying details about a subnet) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)
Enabling SMN notifications for a server migration task	MgC	MgC MigrationSmnAgencyPolicy	smn:topic:list (Listing topics) smn:topic:publish (Publishing messages)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Server migration tasks

MgC

MgC ServerMigrationAgencyPolicy

ecs:cloudServers:showServer (Querying details about an ECS)

ecs:cloudServers:createServers (Creating an ECS)

sms:server:migrationServer (Migrating a source server)

sms:server:queryServer (Querying source servers)

ecs:cloudServers:list (Querying ECSs)

ecs:cloudServers:listServerBlockDevices (Querying information about the disks attached to an ECS)

ecs:cloudServerQuotas:get (Querying quotas of a tenant)

vpc:publicIps:create (Creating an EIP)

vpc:privateIps:list (Querying private IP addresses)

ecs:cloudServers:get (Querying details about an ECS)

ecs:cloudServers:changeVpc (Changing a VPC for an ECS)

ecs:cloudServers:attach (Attaching a disk to an ECS)

ecs:cloudServers:start (Starting ECSs in batches)

ecs:cloudServers:detachVolume (Detaching a disk from a specified ECS)

ecs:cloudServers:stop (Stopping ECSs in batches)

ecs:servers:unlock (Unlocking an ECS)

evs:volumes:delete (Deleting an EVS disk)

evs:volumes:use (Attaching and detaching EVS disks)

evs:volumes:get (Querying details about an EVS disk)

ims:images:get (Querying details about an image)

Enabling the option to retain IP addresses for a server migration task

MgC

MgC ServerMigrationIpKeepAgencyPolicy

vpc:subnets:get (Querying subnets or querying details about a subnet)

ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)

Enabling SMN notifications for a server migration task

MgC

MgC MigrationSmnAgencyPolicy

smn:topic:list (Listing topics)

smn:topic:publish (Publishing messages)

Resource Purchases

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Resource purchases	MgC	MgC PurchaseAgencyPolicy	eps:resources:add (Adding resources to an enterprise project) ecs:cloudServers:createServers (Creating an ECS) ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information) ecs:cloudServers:list (Querying details about ECSs) evs:volumes:list (Listing EVS disks) vpc:publicIps:update (Updating an EIP) vpc:publicIps:create (Creating an EIP) ims:images:list (Listing images)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Resource purchases

MgC

MgC PurchaseAgencyPolicy

eps:resources:add (Adding resources to an enterprise project)

ecs:cloudServers:createServers (Creating an ECS)

ecs:cloudServers:showServer (Querying details about an ECS)

ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information)

ecs:cloudServers:list (Querying details about ECSs)

evs:volumes:list (Listing EVS disks)

vpc:publicIps:update (Updating an EIP)

vpc:publicIps:create (Creating an EIP)

ims:images:list (Listing images)

Configuring Server Purchase Templates

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Configuring a server purchase template	MgC	MgC PurchaseTemplateAgencyPolicy	iam:projects:listProjects (Querying projects) eps:enterpriseProjects:list (Listing enterprise projects) vpc:subnets:get (Querying subnets or querying details about a subnet) vpc:securityGroups:get (Querying security groups or querying details about a security group) vpc:vpcs:get (Querying VPC details)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Configuring a server purchase template

MgC

MgC PurchaseTemplateAgencyPolicy

iam:projects:listProjects (Querying projects)

eps:enterpriseProjects:list (Listing enterprise projects)

vpc:subnets:get (Querying subnets or querying details about a subnet)

vpc:securityGroups:get (Querying security groups or querying details about a security group)

vpc:vpcs:get (Querying VPC details)

Migration Plans (Old)

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Batch server migration plans – importing target server configurations from an OBS bucket	MgC	MgC ImportTargetConfigurationAgencyPolicy	obs:object:GetObject (Obtaining object content and metadata) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:ListAllMyBuckets (Listing buckets)
Batch server migration plans – exporting target server configurations		MgC ExportTargetConfigurationAgencyPolicy	ims:images:list (Listing images) ecs:cloudServerFlavors:get (Querying details about flavors and extended flavor information)
Batch server migration plans – server quota verification		MgC ServerMigrationQuotasAgencyPolicy	ecs:cloudServers:list (Querying details about ECSs) evs:quotas:get (Querying EVS disk quotas) ecs:cloudServerQuotas:get (Querying quotas of a tenant) vpc:quotas:list (Listing resource quotas)
Batch object storage migration plans – configuring target buckets		MgC ListObsBucketsAgencyPolicy	obs:bucket:ListAllMyBuckets (Listing buckets)

Migration Cluster Creation

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Migration cluster creation	OMS	OMS ObsMigrationAgencyPolicy	ecs:cloudServers:createServers (Creating an ECS) ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS) ecs:cloudServers:showServer (Querying details about an ECS) ecs:cloudServers:deleteServers (Deleting ECSs) nat:natGateways:create (Creating a NAT Gateway) nat:natGateways:get (Querying details about a NAT gateway) nat:natGateways:delete (Deleting a NAT gateway) nat:snatRules:create (Creating an SNAT rule) nat:snatRules:get (Querying details about an SNAT rule) nat:dnatRules:list (Querying DNAT rules) nat:snatRules:list (Querying SNAT rules) nat:snatRules:delete (Deleting an SNAT rule) vpc:securityGroups:create (Creating a security group) vpc:securityGroups:delete (Deleting a security group) vpc:securityGroups:get (Querying security groups or querying details about a security group) vpc:securityGroupRules:create (Creating a security group rule) vpc:securityGroupRules:get (Querying security group rules or querying details about a security group rule) vpc:securityGroupRules:delete (Deleting a security group rule) vpcep:epservices:create (Creating a VPC endpoint service) vpcep:epservices:get (Querying details about a VPC endpoint service) vpcep:epservices:delete (Deleting a VPC endpoint service) vpcep:connections:update (Accepting or rejecting a connection from a VPC endpoint) vpcep:permissions:update (Batch adding or deleting whitelist records of a VPC endpoint service) lts:topics:create (Creating a log topic) lts:topics:delete (Deleting a log topic) lts:groups:create (Creating a log group) lts:groups:get (Querying details about a log group) lts:groups:delete (Deleting a log group) ims:images:list (Listing images) apm:icmgr:list (Listing ICAgents) apm:icmgr:get (Obtaining the collection component version)
ECS	ECS ObsMigrationAgencyPolicy	apm:icmgr:* (Full permissions for the APM collection component)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Migration cluster creation

OMS

OMS ObsMigrationAgencyPolicy

ecs:cloudServers:createServers (Creating an ECS)

ecs:cloudServers:listServerInterfaces (Querying NICs of an ECS)

ecs:cloudServers:showServer (Querying details about an ECS)

ecs:cloudServers:deleteServers (Deleting ECSs)

nat:natGateways:create (Creating a NAT Gateway)

nat:natGateways:get (Querying details about a NAT gateway)

nat:natGateways:delete (Deleting a NAT gateway)

nat:snatRules:create (Creating an SNAT rule)

nat:snatRules:get (Querying details about an SNAT rule)

nat:dnatRules:list (Querying DNAT rules)

nat:snatRules:list (Querying SNAT rules)

nat:snatRules:delete (Deleting an SNAT rule)

vpc:securityGroups:create (Creating a security group)

vpc:securityGroups:delete (Deleting a security group)

vpc:securityGroups:get (Querying security groups or querying details about a security group)

vpc:securityGroupRules:create (Creating a security group rule)

vpc:securityGroupRules:get (Querying security group rules or querying details about a security group rule)

vpc:securityGroupRules:delete (Deleting a security group rule)

vpcep:epservices:create (Creating a VPC endpoint service)

vpcep:epservices:get (Querying details about a VPC endpoint service)

vpcep:epservices:delete (Deleting a VPC endpoint service)

vpcep:connections:update (Accepting or rejecting a connection from a VPC endpoint)

vpcep:permissions:update (Batch adding or deleting whitelist records of a VPC endpoint service)

lts:topics:create (Creating a log topic)

lts:topics:delete (Deleting a log topic)

lts:groups:create (Creating a log group)

lts:groups:get (Querying details about a log group)

lts:groups:delete (Deleting a log group)

ims:images:list (Listing images)

apm:icmgr:list (Listing ICAgents)

apm:icmgr:get (Obtaining the collection component version)

ECS

ECS ObsMigrationAgencyPolicy

apm:icmgr:* (Full permissions for the APM collection component)

Storage Migration Workflows

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Storage migration tasks	MgC	-	OMS AgencyOperator (a system-defined role)
MgC QueryKMSKeyAgencyPolicy	kms:cmk:get (Querying key information)
OMS	OMS EncryptCredentialAgencyPolicy	kms:cmk:get (Querying key information) kms:dek:create (Creating a DEK) kms:dek:decrypt (Decrypting a DEK)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Storage migration tasks

MgC

OMS AgencyOperator (a system-defined role)

MgC QueryKMSKeyAgencyPolicy

kms:cmk:get (Querying key information)

OMS

OMS EncryptCredentialAgencyPolicy

kms:cmk:get (Querying key information)

kms:dek:create (Creating a DEK)

kms:dek:decrypt (Decrypting a DEK)

RVTools Data Import

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Importing RVTools data	MgC	MgC OfflineCollectionAgencyPolicy	obs:object:GetObject (Obtaining object content and metadata) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:ListAllMyBuckets (Listing buckets)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Importing RVTools data

MgC

MgC OfflineCollectionAgencyPolicy

obs:object:GetObject (Obtaining object content and metadata)

obs:bucket:ListBucket (Listing objects in a bucket)

obs:bucket:ListAllMyBuckets (Listing buckets)

Adding a Script

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Adding a post-migration stage and script to a workflow	MgC	MgC ExecuteScriptAgencyPolicy	coc:instance:executeDocument (Executing documents on an ECS) coc:job:get (Querying service ticket details)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Adding a post-migration stage and script to a workflow

MgC

MgC ExecuteScriptAgencyPolicy

coc:instance:executeDocument (Executing documents on an ECS)

coc:job:get (Querying service ticket details)

Questionnaires

Scenario	Delegated Object	Custom Policy	Minimal Permissions
Importing responses to the architecture survey	MgC	MgC ImportQuestionnaireAgencyPolicy	obs:object:GetObject (Obtaining object content and metadata) obs:bucket:ListBucket (Listing objects in a bucket) obs:bucket:ListAllMyBuckets (Listing buckets)

Scenario

Delegated Object

Custom Policy

Minimal Permissions

Importing responses to the architecture survey

MgC

MgC ImportQuestionnaireAgencyPolicy

obs:object:GetObject (Obtaining object content and metadata)

obs:bucket:ListBucket (Listing objects in a bucket)

obs:bucket:ListAllMyBuckets (Listing buckets)

Parent Topic: Permissions Management

Previous topic: Using IAM Identity Policies to Grant Access to MgC (New Console)