search

aws-solutions / cloud-migration-factory-on-aws

The Cloud Migration Factory on AWS solution is designed to coordinate and automate manual processes for large-scale migrations. This solution helps enterprises improve performance and prevents long cutover windows by providing an orchestration platform for migrating workloads to AWS at scale.
https://aws.amazon.com/solutions/implementations/cloud-migration-factory-on-aws/
Apache License 2.0
60 stars 63 forks source link

Incorrect permissions to enable post-launch actions #37

Open Kirizan opened 3 weeks ago

Kirizan commented 3 weeks ago

Describe the bug The permissions defined for the role CMF-MGNAutomation deployed to the target accounts is missing permissions required to run post-launch actions.

To Reproduce Follow instructions here to remove vmware tools.

When a test cutover runs, the following error appears:

An error occurred (AccessDeniedException) when calling the GetDocument operation: User: arn:aws:sts:::assumed-role/CMF-MGNAutomation/cloud-migration-factory-prod-MGNLambdaRole is not authorized to perform: ssm:GetDocument on resource: arn:aws:ssm:us-east-1::document/AWS-RunPowerShellScript because no identity-based policy allows the ssm:GetDocument action

The ssm:GetDocument is not the only missing action, adding the ssm:GetDocument permission leads to the two following actions being missing also:

Expected behavior I expect the post-launch actions to run.

Please complete the following information about the solution:

To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0097) - AWS CloudEndure Migration Factory Solution. Version v1.1.0".

Screenshots None

Additional context PR Incoming to fix these issues.

Kirizan commented 3 weeks ago

I discovered that ssm:ListCommandInvocations was also missing from the list, so I added that to the PR.

Kirizan commented 3 weeks ago

I forgot to mention, the PR I submitted is based on the 3.3.5 template, not the 3.3.4 template. The only difference is the 3.3.5 template had already added the ssm:GetDocument permission in the policy MGNPostLaunchActions.

tbelmega commented 3 weeks ago

Thank you for bringing this to our attention! We're looking into it!