AWS Requirements

DMC supports two AWS scan types: EC2 Scan (in-depth per-instance collection including guest OS data) and AWS Estate Discovery (agentless inventory and cost data across your entire estate). You can run both together in a single pass. Each has different IAM requirements.

Where DMC Runs¶

For AWS scans, DMC runs from a Windows machine with outbound HTTPS access to AWS APIs. The recommended placement is a small EC2 instance inside your AWS environment with an IAM instance role attached. DMC does not need to be installed on any target server.

If DMC runs on an EC2 instance with an instance role, you do not need to supply AWS access keys. DMC uses the standard AWS credential chain and will automatically pick up the instance role, environment variables, or a configured profile.

IAM Requirements¶

EC2 Scan¶

EC2 scanning uses an assume-role pattern. DMC assumes a role in each target account to discover and scan instances. In each account you want to scan, create an IAM role with the permissions below and a trust policy that allows the DMC collector identity to assume it.

Permission	Purpose
`ec2:DescribeInstances`	Enumerate EC2 instances
`ec2:DescribeInstanceTypes`	Resolve vCPU and memory from instance type
`ec2:DescribeVolumes`	Retrieve EBS volume sizes
`ec2:DescribeRegions`	Enumerate enabled regions
`cloudwatch:GetMetricData`	Retrieve CPU, disk, and network performance metrics
`sts:AssumeRole`	Assume into target accounts for multi-account scanning
`sts:GetCallerIdentity`	Verify the active identity
`ssm:SendCommand`	Run guest discovery commands via SSM (if using SSM)
`ssm:DescribeInstanceInformation`, `ssm:GetCommandInvocation`	Confirm SSM managed node status and retrieve command output
`s3:GetBucketLocation`, `s3:ListBucket`, `s3:GetObject`	Read SSM command output from the S3 output bucket (DMC host role)
`s3:PutObject`, `s3:GetEncryptionConfiguration`	Write SSM command output to the S3 output bucket (target instance profile)

The SSM permissions and S3 bucket are only required if you choose SSM as your guest access method. If you use SSH or WinRM instead, you can omit them. See EC2 Scan setup for the full IAM policy JSON and trust policy.

AWS Estate Discovery¶

Estate discovery uses AWS Config and the Cost Explorer API. No guest access or in-server credentials are required.

Permission	Purpose
`config:SelectAggregateResourceConfig`	Query an AWS Config aggregator for all resource types
`config:DescribeConfigurationRecorders`	Verify AWS Config is enabled per region
`ce:GetCostAndUsage`	Retrieve 30-day cost breakdown via Cost Explorer
`ce:GetCostAndUsageWithResources`	Retrieve per-resource cost breakdown (optional, enables resource-level cost data)
`organizations:ListAccounts`	Enumerate accounts for multi-account scanning
`sts:AssumeRole`	Assume into target accounts

AWS Config must be enabled and recording in each region you want to scan. Cost Explorer must be enabled in the management account. If either is not active, that portion of the collection will be skipped.

Guest Access Methods (EC2 Scan)¶

To collect software inventory, network dependencies, and SQL Server instances from inside each EC2 instance, DMC needs one of the following access methods configured per instance.

Method	Prerequisites	Network required
SSM (recommended)	SSM Agent installed and instance registered as a Managed Node; S3 output bucket with write permission on the instance profile	No inbound ports required
SSH	SSH enabled on target Linux instances; admin credentials available in DMC	Port 22 open from DMC host to target
WinRM	WinRM enabled on target Windows instances; admin credentials available in DMC	Port 5985/5986 open from DMC host to target

Optional Requirements¶

Requirement	Needed for
CloudWatch Agent installed on target instances	Memory utilisation metrics. Without it, memory data will not appear in scan results.
AWS Config enabled and recording in each region	Resource inventory via estate discovery
Cost Explorer enabled in the management account	Cost and usage data collection