Help Center/ Migration Center/ User Guide/ Permissions Management/ Using Roles or Policies to Assign Custom Permissions to IAM Users
Updated on 2026-10-13 GMT+08:00
View PDF
Share

Using Roles or Policies to Assign Custom Permissions to IAM Users

With IAM, you can configure permission policies to grant IAM users in your account fine-grained MgC permissions, enabling effective permission isolation.

This section describes the custom permission policies that you need to configure for IAM users to use different MgC functions. For details about how to configure custom policies, see Creating a Custom Policy.

You can add actions required for various scenarios to a single custom policy, instead of creating a new policy for every function.

Agency Authorization Permissions Required for IAM Users

When an IAM user first uses certain MgC functions, they must authorize MgC to create custom policies through an agency. Table 1 lists the custom policies and permissions required for the agency authorization.

Table 1 Policies and permissions required for agency authorization

Scenario

Function

Description

Mandatory

Action

IAM agency permissions

Agency Authorization

Agency authorization is required to use certain MgC functions.

Yes

Create the custom policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:agencies:listAgencies",
                "iam:agencies:createAgency",
                "iam:roles:listRoles",
                "iam:roles:updateRole",
                "iam:quotas:listQuotas",
                "iam:roles:createRole",
                "iam:permissions:listRolesForAgency",
                "iam:permissions:grantRoleToAgency",
                "iam:permissions:revokeRoleFromAgency",
                "iam:permissions:grantRoleToAgencyOnProject",
                "iam:permissions:checkRoleForAgencyOnProject"
            ]
        }
    ]
}

Migrating Servers in Batches

Table 2 lists the functions and permissions required for batch server migration.

Table 2 Permissions required for batch server migration

Scenario

Function

Description

Action

Migrating Servers in Batches

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, MgC MigrateAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Create the following custom policies for global cloud services and project-level cloud services, and grant the permissions to the IAM user.

  • Project-level cloud service permissions 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "vpc:vpcs:create",
                "vpc:subnets:create",
                "vpc:securityGroups:create",
                "vpc:securityGroupRules:create",
                "vpc:publicIps:create",
                "vpc:*:list*",
                "vpc:*:get*",
                "ecs:cloudServers:create",
                "ecs:cloudServers:attach",
                "ecs:cloudServers:detachVolume",
                "ecs:cloudServers:start",
                "ecs:cloudServers:stop",
                "ecs:cloudServers:delete",
                "ecs:cloudServers:reboot",
                "ecs:cloudServers:updateMetadata",
                "ecs:serverPasswords:manage",
                "ecs:serverKeypairs:create",
                "ecs:serverKeypairs:delete",
                "ecs:diskConfigs:use",
                "ecs:servers:setMetadata",
                "ecs:serverVolumes:use",
                "ecs:serverInterfaces:use",
                "ecs:serverGroups:manage",
                "ecs:securityGroups:use",
                "ecs:servers:unlock",
                "ecs:servers:lock",
                "ecs:servers:rebuild",
                "ecs:servers:reboot",
                "ecs:*:get*",
                "ecs:*:list*",
                "evs:volumes:use",
                "evs:volumes:create",
                "evs:volumes:update",
                "evs:volumes:delete",
                "evs:volumes:attach",
                "evs:volumes:detach",
                "evs:snapshots:create",
                "evs:snapshots:delete",
                "evs:snapshots:rollback",
                "evs:*:get*",
                "evs:*:list*",
                "ims:*:get*",
                "ims:*:list*",
                "kms:cmk:list",
                "kms:cmk:get",
                "kms:dek:create",
                "kms:dek:decrypt",
                "smn:topic:list",
                "deh:dedicatedHosts:list",
                "deh:dedicatedHostTypes:list"
            ]
        }
    ]
}
  • Global cloud service permissions 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:bucket:ListAllMyBuckets",
                "obs:bucket:ListBucket",
                "tms:predefineTags:list",
                "eps:enterpriseProjects:list",
                "eps:enterpriseProjects:get",
                "sms:server:migrationServer",
                "sms:server:registerServer",
                "sms:server:queryServer"
            ]
        }
    ]
}

Collecting Server Resources

Collecting information about the servers to be migrated

Adding Source Servers

Accessing the resource list and selecting the servers to be migrated

Associating Existing Target Servers

Associating a source server with a Huawei Cloud target server

Getting Target Recommendations

The system can recommend right-sized Huawei Cloud servers based on source server specifications.

Creating a Batch Server Migration Task

Creating and executing a batch server migration task

Checking Resource Quotas

Checking whether the resource quota of the migration account in the target region meets the requirements

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-Migration Stage and Script

Adding a stage or step to a migration task

Migrating Servers Across AZs

Table 3 lists the functions and permissions required for batch server migration across AZs.

Table 3 Permissions required for batch server migration across AZs

Scenario

Function

Description

Action

Migrating Servers Across AZs

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, MgC MigrateAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Create the custom policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServerFlavors:get",
                "ecs:availabilityZones:list",
                "evs:types:get",
                "smn:topic:list"

            ]
        }
    ]
}

Collecting Server Resources

Collecting information about the servers to be migrated

Selecting Source AZ

Selecting the region and AZ where the servers to be migrated are located

Configuring Target Servers

By default, the system recommends target servers that match the source servers.

Getting Notifications

Enabling notifications in migration parameters requires SMN permissions.

Creating a Cross-AZ Batch Server Migration Task

Creating and executing a cross-AZ batch server migration task

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-Migration Stage and Script

Adding a stage or step to a migration task

Migrating Servers Across Regions

Table 4 lists the functions and permissions required for batch server migration across regions.

Table 4 Permissions required for cross-region server migration

Scenario

Function

Description

Action

Migrating Servers Across Regions

Managing Migration Projects

Creating an application migration project

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, MgC MigrateAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Create the custom policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "vpc:vpcs:list",
                "vpc:subnets:get",
                "vpc:securityGroups:get",
                "ecs:availabilityZones:list",
                "ecs:cloudServerFlavors:get",
                "evs:types:get",
                "smn:topic:list"
            ]
        }
    ]
}

Collecting Server Resources

Collecting information about the servers to be migrated

Selecting Source Servers

Selecting the source region and source servers

Configuring Target Servers

Selecting the target region and AZ, automatically or manually configuring the target network, and customizing the target specifications

Getting Notifications

Enabling notifications in migration parameters requires SMN permissions.

Creating a Cross-Region Server Migration Task

Creating and executing a cross-region batch server migration task

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-Migration Stage and Script

Adding a stage or step to a migration task

Migrating Storage Data

Table 5 lists the functions and permissions required for storage resource migration.

Table 5 Permissions required for storage migration

Scenario

Function

Description

Action

Migrating Storage Data

Managing Migration Projects

Creating an application migration project
  • Assign the following system policies to the IAM user: OMS Administrator, MgC DiscoveryAccess, MgC AppDiscoveryAccess, MgC MigrateAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.
  • For details about the permissions required for creating an OBS bucket and an SFS file system, see:
  • Create the following custom policies for global cloud services and project-level cloud services, and grant the permissions to the IAM user.
    • Project-level cloud service permissions 
      {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kps:domainKeypairs:list",
                "nat:natGateways:list",
                "vpc:vpcs:list",
                "vpc:subnets:get",
                "ecs:cloudServerFlavors:get",
                "smn:topic:list",
                "kms:cmk:get",
                "kms:cmk:list"
            ]
        }
    ]
}
    • Global cloud service permissions 
      {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:object:GetObject",
                "obs:bucket:ListBucket",
                "obs:bucket:ListAllMyBuckets"
            ]
        }
    ]
}

Collecting Storage Resource Information

Collecting information about the storage resources to be migrated

Creating Target Storage Systems

MgC supports migrations from object storage to file storage and from file storage to object storage (OBS buckets). Target object buckets or file systems must be prepared on Huawei Cloud in advance.

Managing Migration Clusters

A migration cluster is a core component for storage migration tasks. It allows you to create and manage migration nodes and list nodes, and deploy and upgrade migration plugins, ensuring smooth operations of storage tasks.

Getting Notifications

Enabling notifications requires SMN permissions.

Encrypting Credentials

Using KMS keys for encryption during the creation of migration plans requires certain permissions.

Creating a Storage Migration Task

Creating a storage migration task based on a migration plan

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the actions included in the custom policies created by the system, see Agency Permissions.

Adding a Post-Migration Stage and Script

Adding a stage or step to a migration task

Big Data Migration

Table 6 lists the functions and permissions required for big data migration.

Table 6 Permissions required for big data migration

Scenario

Function

Description

Mandatory

Action

Big Data Migration

Managing Migration Projects

Creating big data migration projects

Yes

Assign the system policy MgC MigrateAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.

Managing Connections

Creating source and target connections

NOTE:

Using the resource collection function requires the MRS ReadOnlyAccess and DLI ReadOnlyAccess permissions.

Yes

Create the custom policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dli:resource:listAllResource",
                "mrs:host:list"
            ]
        }
    ]
}

Migrating Data

Creating and executing a big data migration task

Yes

Assign the system policy MgC MigrateAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.

Big Data Verification

Table 7 lists the functions and permissions required for big data verification.

Table 7 Permissions required for big data verification

Scenario

Function

Description

Mandatory

Action

Big Data Verification

Managing Migration Projects

Creating big data migration projects

Yes

Assign the system policy MgC MigrateAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.

Managing Connections

Creating source and target connections

NOTE:

Using the resource collection function requires the MRS ReadOnlyAccess and DLI ReadOnlyAccess permissions.

Yes

Create the custom policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dli:queue:list",
                "mrs:host:list"
            ]
        }
    ]
}

Managing Tasks

Creating and executing verification tasks for the source and target. Enabling notifications requires SMN permissions. Creating a custom verification task requires OBS upload and download permissions.

Yes

Assign the system policy SMN FullAccess to the IAM user. In addition, create the custom policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "smn:topic:list"
            ]
        }
    ]
}

Managing Instances

Checking the task execution progress, exporting error lists, and uploading error logs. Uploading logs requires OBS upload and download permissions.

No

Create the custom policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:object:GetObject",
                "obs:object:PutObject"
            ]
        }
    ]
}

Resource Collection

Table 8 lists the functions and permissions required for resource collection.

Table 8 Permissions required for resource collection

Scenario

Function

Description

Mandatory

Action

Cloud Discovery

Managing Migration Projects

Creating an application migration project

Yes

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Online Discovery – Cloud Platform Discovery

Collecting cloud resource information

Yes

Online Discovery – SMS Server Synchronization

Synchronizing server information collected by SMS to MgC

Yes

Collection Method – Credentials

Collecting resource information using credentials

Yes

Huawei Cloud Discovery – Agency

Collecting resource information using an agency

Yes
  • Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.
  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

SMS Server Synchronization

Online Discovery – SMS Server Synchronization

Synchronizing server information collected by SMS to MgC

Yes
  • Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.
  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

Intranet Discovery

IDC Discovery

Discovering IDC servers via network segment scanning

Yes

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

VMware Discovery

Discovering VMs in VMware vCenter

Yes

Import

RVTools Data Import

Importing RVTools data to MgC to obtain a server resource list

Yes

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Cloud Inventory Import
  1. Resource exports (all resources) from Alibaba Cloud Resource Management are supported.
  2. Resource exports (all resources) from Azure Resource Manager are supported.

Yes

Collection Result Import

Importing local resource information collected by MgC Agent collectors

Yes

Template Import

Importing resources in batches using a template and associating credentials with them

Yes

Questionnaires

Managing Migration Projects

Creating an application migration project

Yes

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Importing Responses to the Architecture Survey

Importing architecture survey responses using a file

Yes

Architecture Survey – Selecting a Response File from an OBS Bucket

Selecting the file used to import architecture survey responses

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:object:GetObject",
                "obs:bucket:ListAllMyBuckets",
                "obs:bucket:ListBucket"
            ]
        }
    ]
}

Maturity Assessments

Maturity assessments

Yes

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Resource List

Resource Management

Querying resources (such as server, container, database, middleware, big data, network, and storage resources) in a specified migration project and managing these resources

Yes

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Application List

Associating Resources with Applications to Implement Resource Grouping

Querying applications in a specified migration project

Yes

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Creating or Modifying an Application
  1. Business Scenario – Intra-Cloud Migration – Cross-AZ Migration
  2. Business Scenario – Intra-Cloud Migration – Cross-Region Migration

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:availabilityZones:list"
            ]
        }
    ]
}

Assessment

Table 9 lists the functions and permissions required for assessment.

Table 9 Permissions required for assessment

Scenario

Function

Description

Mandatory

Action

TCO Analysis for On-Prem to Cloud Migration

Creating a Task

With the provided on-premises infrastructure details and assumptions, the system automatically matches source resources with equivalent Huawei Cloud products and usage, providing a cost comparison.

Yes

Assign the system policy MgC AssessAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.

Saving, Downloading, or Deleting a Report

Saving, downloading, or deleting a cost comparison report

Yes

TCO Analysis for Cross-Cloud Migration with Credentials

Creating or Deleting an Analysis Task

With the provided source cloud credentials, the system matches source resources with target alternatives and performs cost analysis, providing a comprehensive migration cost report.

Yes
  • Assign the system policy MgC AssessAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.
  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

Downloading Bills

By analyzing the source bills for a specified period, the system identifies product billing items and gathers details like product specifications, monthly average usage, and monthly average consumption.

Yes

Viewing Analysis Results

In terms of usage costs, the system compares the costs of the source cloud vendor and Huawei Cloud within a specified period.

Yes

Viewing Product Mappings

Viewing, adding, modifying, or deleting product mappings, and adjusting the predefined resource mapping logic to ensure the resulting resource specifications meet requirements

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServerFlavors:get",
                "evs:types:get",
                "ims:images:list"
            ]
        }
    ]
}

TCO Analysis for Cross-Cloud Migration with Bills

Creating an Analysis Task

By analyzing uploaded source bills, the system identifies what and how many source resources are used on the source cloud, matches the source resources with Huawei Cloud alternatives, and then compares the costs of source environment with the costs on Huawei Cloud.

Yes
  • Assign the system policy MgC AssessAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.
  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

Exporting or Deleting Analysis Results

Exporting or deleting analysis results

Yes

Migration Journeys (Old)

Creating or Deleting a Migration Journey

There are ready-to-use migration framework templates for complex scenarios, including database and LLM migrations.

Yes

Assign the system policy MgC AssessAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.

Cloud Migration Planning – Importing a Migration Plan

Importing a Migration Plan

Uploading migration assessment reports through the console. The uploaded files will be stored for 15 days.

Yes

Assign the system policy MgC AssessAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.

Cloud Migration Planning – Generating Target Recommendations

Creating or Deleting a Target Recommendation Task

The system can recommend right-sized Huawei Cloud resources based on the source resource specifications.

Yes
  • Assign the system policy MgC AssessAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.
  • Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

    For details about the actions included in the custom policies created by the system, see Agency Permissions.

Exporting Assessment Results

Exporting assessment results

Yes

Cross-Region and Cross-AZ Assessment

When applications configured for cross-AZ or cross-region migration are assessed using the intra-cloud migration assessment policy, target resources inherit the source specifications by default. If an exact match is unavailable, the system automatically identifies and selects the closest possible specifications for the target.

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:availabilityZones:list"
            ]
        }
    ]
}

Configuring Preferences – Servers

During target recommendation, the system gives priority to servers matching the configured preferences.

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServerFlavors:get",
                "deh:dedicatedHostTypes:list",
                "deh:dedicatedHosts:list",
                "deh:dedicatedHostResourceTypes:list",
                "deh:dedicatedHostResourcesType:get"
            ]
        }
    ]
}

Reassessing Source Resources

Modifying the assessment policy to generate target recommendations again

Yes

Modifying Resource Assessment Results

Changing the billing mode, product, and migration policy, and configuring specifications for a target server on the Custom page

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServerFlavors:get",
                "evs:types:get",
                "ims:images:list"
            ]
        }
    ]
}

Viewing Resource Details

Viewing resource details in the assessment report

Yes

Create the custom identity policy below and assign it to the IAM user.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecs:cloudServerFlavors:get",
                "vpc:vpcs:list",
                "vpc:securityGroups:get",
                "vpc:subnets:get"
            ]
        }
    ]
}

Cloud Migration Planning – Migration Risk Assessment

Creating, Exporting, and Deleting a Migration Risk Assessment

Creating a risk assessment to check for potential risks that may affect the migration in advance

Yes

Assign the system policy MgC AssessAccess to the IAM user. For details about the system-defined policies supported by MgC, see Table 1.

Cloud Migration Planning – Storage Migration Assessment

Creating, Exporting, and Deleting a Storage Migration Assessment

Creating a storage migration assessment to automatically calculate the migration cluster specifications, network bandwidth, and migration costs required for the migration and generate different migration solutions

Yes

Cloud Migration Planning – Big Data Migration Assessment

Creating, Exporting, and Deleting a Big Data Migration Assessment

Assessing how much cluster queue resources are required based on the number of tables and partition changes to be processed

Yes

Migration Journeys (New)

Configure the required permissions based on the migration journey functions you need.

Server Migration Journey

Before using the server migration journey, configure the required permissions based on Table 10.

Table 10 Permissions required for functions related to the server migration journey

Scenario

Function

Description

Action

Server Migration Journey

Managing Resource List

Adding or deleting resources

Assign the following system policies to the IAM user: MgC DiscoveryAccess, MgC AppDiscoveryAccess, MgC JourneyAccess, MgC MigrateAccess, and MgC AssessAccess. For details about the system-defined policies supported by MgC, see Table 1.

Create the following custom policies for global cloud services and project-level cloud services, and grant the permissions to the IAM user.
  • Project-level cloud service permissions 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "vpc:securityGroups:get",
                "vpc:subnets:get",
                "vpc:vpcs:list",
                "vpc:vpcs:get",
                "vpc:ports:get",
                "vpc:securityGroups:create",
                "vpc:securityGroupRules:create",
                "vpc:vpcs:create",
                "vpc:publicIps:create",
                "vpc:subnets:create",
                "deh:dedicatedHosts:list",
                "deh:dedicatedHostTypes:list",
                "ims:images:get",
                "ims:images:list",
                "ecs:cloudServerFlavors:get",
                "ecs:availabilityZones:list",
                "ecs:cloudServers:list",
                "ecs:cloudServers:create",
                "ecs:cloudServers:attach",
                "ecs:cloudServers:detachVolume",
                "ecs:cloudServers:start",
                "ecs:cloudServers:stop",
                "ecs:cloudServers:delete",
                "ecs:cloudServers:reboot",
                "ecs:cloudServers:updateMetadata",
                "ecs:serverPasswords:manage",
                "ecs:serverKeypairs:delete",
                "ecs:diskConfigs:use",
                "ecs:servers:setMetadata",
                "ecs:serverVolumes:use",
                "ecs:serverKeypairs:create",
                "ecs:serverInterfaces:use",
                "ecs:serverGroups:manage",
                "ecs:securityGroups:use",
                "ecs:servers:unlock",
                "ecs:servers:rebuild",
                "ecs:servers:lock",
                "ecs:servers:reboot",
                "evs:types:get",
                "evs:volumes:list",
                "evs:volumes:use",
                "evs:volumes:create",
                "evs:volumes:update",
                "evs:volumes:delete",
                "evs:volumes:attach",
                "evs:volumes:detach",
                "evs:snapshots:create",
                "evs:snapshots:delete",
                "evs:snapshots:rollback",
                "ecs:*:get*",
                "ecs:*:list*",
                "evs:*:get*",
                "evs:*:list*",
                "vpc:*:list*",
                "vpc:*:get*",
                "ims:*:get*",
                "ims:*:list*",
                "kms:cmk:get",
                "kms:cmk:list",
                "kms:dek:create",
                "kms:dek:decrypt",
                "smn:topic:list"
            ]
        }
    ]
}
  • Global cloud service permissions 
    {
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "obs:bucket:ListAllMyBuckets",
                "obs:bucket:ListBucket",
                "tms:predefineTags:list",
                "eps:enterpriseProjects:list",
                "eps:enterpriseProjects:get",
                "sms:server:migrationServer",
                "sms:server:registerServer",
                "sms:server:queryServer"
            ]
        }
    ]
}

Managing Migration Batches

Creating, removing, deleting, or associating migration batches

Creating a Batch Server Migration Plan

Creating a server migration plan, planning server migration batches, and configuring migration parameters

Associating Existing Target Servers

Associating a source server with a Huawei Cloud target server

Getting Target Recommendations

The system can recommend right-sized Huawei Cloud servers based on source server specifications.

Creating a Batch Server Migration Task

Creating and executing a batch server migration task

Checking Resource Quotas

Checking whether the resource quota of the migration account in the target region meets the requirements

Through agency authorization, the system automatically creates custom policies when the IAM user uses specific functions, eliminating the need for manual setup. However, the IAM user must have the required agency authorization permissions listed in Table 1.

For details about the automatically created custom policies and their allowed actions, see Server Migration Journey.

Adding a Post-migration Stage and Script

Adding a stage or step to a migration task

Online Discovery - SMS Server Synchronization

Synchronizing server information collected by SMS to MgC
Parent Topic: Permissions Management