AWS Requirements

DMC supports two AWS scan types: EC2 Scan (per-instance collection including guest OS data) and AWS Estate Discovery (agentless inventory and cost data across your estate). You can run both together in a single pass. Complete the setup on this page before running any AWS scan from Scan AWS.

Where DMC runs¶

DMC runs from a Windows machine inside your AWS environment, usually a small EC2 instance or jump box, with outbound HTTPS access to AWS APIs. It runs in memory, installs nothing on target servers, and stores no credentials after it closes. The host needs network line-of-sight to any servers you scan with SSH or WinRM.

If DMC runs on an EC2 instance with an IAM instance role, you do not need to supply AWS access keys. DMC uses the standard AWS credential chain and picks up the instance role, environment variables, or a configured profile automatically.

Network requirements¶

All connections start from the DMC host and go outbound. Nothing needs to connect in to the host.

From	To	Port	Needed for
DMC host	AWS service APIs	TCP 443	Always
DMC host	SSM output bucket (S3)	TCP 443	SSM guest access
DMC host	Linux instances	TCP 22	SSH guest access
DMC host	Windows instances	TCP 5986 (HTTPS)	WinRM guest access

IAM requirements¶

AWS scanning uses an assume-role pattern. A collector identity starts the scan and assumes a scan role in each target account to do the discovery. Create the collector identity once, then create a scan role with the same name in every account you want to scan.

Scanning one account only? You can give the collector identity the scan-role permissions directly and skip the assume-role step. For two or more accounts, use a scan role in each.

Collector identity¶

This is the IAM identity DMC uses to start the scan and reach into your target accounts. The simplest approach is an IAM role attached to the collector host (an EC2 instance role). Create it, then attach the policy for the scan types you run.

EC2 Scan (and Both):

collector-identity-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "AssumeScanRoleInTargetAccounts", "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/<SCAN_ROLE_NAME>" },
    { "Sid": "ResolveRegionsForDiscovery", "Effect": "Allow",
      "Action": "ec2:DescribeRegions", "Resource": "*" },
    { "Sid": "ListOrganizationAccounts", "Effect": "Allow",
      "Action": "organizations:ListAccounts", "Resource": "*" },
    { "Sid": "ValidateAndReadSsmOutputBucket", "Effect": "Allow",
      "Action": ["s3:GetBucketLocation","s3:ListBucket"],
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>" },
    { "Sid": "ReadSsmCommandOutput", "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>/dmc/*" }
  ]
}

AWS Estate Discovery only:

collector-identity-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "AssumeScanRoleInTargetAccounts", "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/<SCAN_ROLE_NAME>" },
    { "Sid": "ResolveRegionsForDiscovery", "Effect": "Allow",
      "Action": "ec2:DescribeRegions", "Resource": "*" },
    { "Sid": "ListOrganizationAccounts", "Effect": "Allow",
      "Action": "organizations:ListAccounts", "Resource": "*" }
  ]
}

Replace <SCAN_ROLE_NAME> with the name you give the scan role, and <OUTPUT_BUCKET> with the S3 bucket that receives SSM command output.

EC2 Scan role¶

In every AWS account you want to scan, create an IAM role with the same <SCAN_ROLE_NAME>. This role gives DMC read-only access to discover EC2 and run in-server collection. Attach the permissions policy and the trust policy.

Permissions policy:

scan-role-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "ValidateCallerIdentity", "Effect": "Allow",
      "Action": "sts:GetCallerIdentity", "Resource": "*" },
    { "Sid": "DiscoverEc2", "Effect": "Allow",
      "Action": ["ec2:DescribeInstances","ec2:DescribeRegions",
                 "ec2:DescribeVolumes","ec2:DescribeInstanceTypes"],
      "Resource": "*" },
    { "Sid": "ReadCloudWatchMetrics", "Effect": "Allow",
      "Action": "cloudwatch:GetMetricData", "Resource": "*" },
    { "Sid": "InspectAndPollSsm", "Effect": "Allow",
      "Action": ["ssm:DescribeInstanceInformation","ssm:GetCommandInvocation"],
      "Resource": "*" },
    { "Sid": "RunApprovedDmcDocuments", "Effect": "Allow",
      "Action": "ssm:SendCommand",
      "Resource": ["arn:aws:ssm:*::document/AWS-RunShellScript",
                   "arn:aws:ssm:*::document/AWS-RunPowerShellScript"] },
    { "Sid": "RunOnInstancesInThisAccount", "Effect": "Allow",
      "Action": "ssm:SendCommand",
      "Resource": "arn:aws:ec2:*:<ACCOUNT_ID>:instance/*" }
  ]
}

Trust policy (lets the collector identity assume this role):

scan-role-trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "TrustDmcCollectorPrincipal", "Effect": "Allow",
      "Principal": { "AWS": "<COLLECTOR_PRINCIPAL_ARN>" },
      "Action": "sts:AssumeRole" }
  ]
}

Replace <ACCOUNT_ID> with each target account ID and <COLLECTOR_PRINCIPAL_ARN> with the ARN of the collector identity.

Estate Discovery scan role¶

Estate discovery reads inventory, RDS and S3 configuration, AWS Config records, and Cost Explorer. No guest access or in-server credentials are required. Create the scan role with the same <SCAN_ROLE_NAME> and attach the permissions policy and the trust policy.

Permissions policy:

scan-role-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "ValidateCallerIdentity", "Effect": "Allow",
      "Action": "sts:GetCallerIdentity", "Resource": "*" },
    { "Sid": "DiscoverEc2", "Effect": "Allow",
      "Action": ["ec2:DescribeInstances","ec2:DescribeRegions",
                 "ec2:DescribeVolumes","ec2:DescribeInstanceTypes"],
      "Resource": "*" },
    { "Sid": "ReadCloudWatchMetrics", "Effect": "Allow",
      "Action": "cloudwatch:GetMetricData", "Resource": "*" },
    { "Sid": "ListS3Buckets", "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets", "Resource": "*" },
    { "Sid": "InspectS3BucketConfiguration", "Effect": "Allow",
      "Action": ["s3:GetBucketLocation","s3:GetBucketVersioning",
                 "s3:GetLifecycleConfiguration","s3:GetEncryptionConfiguration",
                 "s3:GetReplicationConfiguration","s3:GetBucketPublicAccessBlock",
                 "s3:GetBucketObjectLockConfiguration","s3:GetBucketNotification",
                 "s3:GetBucketTagging","s3:GetMetricsConfiguration",
                 "s3:GetBucketWebsite","s3:GetBucketCORS"],
      "Resource": "arn:aws:s3:::*" },
    { "Sid": "DiscoverRds", "Effect": "Allow",
      "Action": ["rds:DescribeDBInstances","rds:DescribeDBClusters",
                 "rds:ListTagsForResource"], "Resource": "*" },
    { "Sid": "ReadAwsConfigInventory", "Effect": "Allow",
      "Action": ["config:DescribeConfigurationRecorders",
                 "config:DescribeConfigurationRecorderStatus",
                 "config:SelectResourceConfig",
                 "config:DescribeConfigurationAggregators",
                 "config:SelectAggregateResourceConfig"], "Resource": "*" },
    { "Sid": "ReadCostExplorer", "Effect": "Allow",
      "Action": ["ce:GetCostAndUsage","ce:GetCostAndUsageWithResources",
                 "ce:GetDimensionValues"], "Resource": "*" }
  ]
}

Trust policy (lets the collector identity assume this role):

scan-role-trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "TrustDmcCollectorPrincipal", "Effect": "Allow",
      "Principal": { "AWS": "<COLLECTOR_PRINCIPAL_ARN>" },
      "Action": "sts:AssumeRole" }
  ]
}

Replace <COLLECTOR_PRINCIPAL_ARN> with the ARN of the collector identity.

organizations:ListAccounts is an AWS Organizations API ↗, not a plain IAM-scoped call. AWS only permits it from the organization's management account, or from an account registered as a delegated administrator for AWS Organizations ↗. Granting the IAM action alone is not enough: if the DMC identity lives in an ordinary member account, AWS rejects the call regardless of IAM policy, and only that account appears when adding an AWS identity in DMC.

To enable multi-account discovery from a member account, ask your AWS administrator to register that account as a delegated administrator for AWS Organizations. Alternatively, run DMC from the management account, or supply the target account IDs directly during setup instead of relying on automatic discovery.

SSM output bucket (SSM method only)¶

SSM writes its command output to an S3 bucket so DMC can collect it. Create (or pick) a bucket, then attach this policy to the instance profile on your target EC2 servers so they can write their output:

ssm-output-bucket-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "WriteDmcSsmOutput", "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>/dmc/*" },
    { "Sid": "ReadOutputBucketEncryptionConfiguration", "Effect": "Allow",
      "Action": "s3:GetEncryptionConfiguration",
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>" }
  ]
}

Cross-account SSM output: if the output bucket is in the collector account and the EC2 instance is in another AWS account, this target instance profile policy is only one side of the permission. The bucket policy on <OUTPUT_BUCKET> must also allow s3:PutObject from the target account instance profile, or from the target account root principal, to arn:aws:s3:::<OUTPUT_BUCKET>/dmc/*.

Confirm the DMC identity can read the objects after they are written. For cross-account writes, use S3 bucket owner enforced object ownership where possible. DMC does not configure KMS for SSM output. If the bucket already uses SSE-KMS, AWS requires the KMS key policy to allow the target instance profile to write encrypted output and the DMC identity to read and decrypt it.

Permissions at a glance¶

Every IAM action DMC uses for an AWS scan, and why. All are read-only except ssm:SendCommand (which runs approved discovery commands) and s3:PutObject (which writes scan output to your bucket). DMC reads its own SSM output from the configured bucket; it does not read customer application S3 objects, database records or application data.

Collector identity policy

Action	What it does
`sts:AssumeRole`	Assume the scan role in each target account
`ec2:DescribeRegions`	Discover which regions to scan
`organizations:ListAccounts`	List accounts when scanning an AWS Organization
`s3:GetBucketLocation`, `s3:ListBucket`	Locate and validate the SSM output bucket (EC2 Scan)
`s3:GetObject`	Read SSM command output from the bucket (EC2 Scan)

EC2 Scan role policy

Action	What it does
`sts:GetCallerIdentity`	Confirm which account the scan is running in
`ec2:DescribeInstances`	Discover EC2 instances and their details
`ec2:DescribeRegions`	Confirm regions in the target account
`ec2:DescribeVolumes`	Discover attached storage volumes
`ec2:DescribeInstanceTypes`	Read instance sizing for right-sizing analysis
`cloudwatch:GetMetricData`	Read CPU, memory and other performance metrics
`ssm:DescribeInstanceInformation`	Check which instances are SSM-managed nodes
`ssm:SendCommand`	Run approved discovery commands inside the servers
`ssm:GetCommandInvocation`	Retrieve the results of those commands

Estate Discovery scan role policy

Action	What it does
`sts:GetCallerIdentity`	Confirm which account the scan is running in
`ec2:DescribeInstances`, `ec2:DescribeRegions`, `ec2:DescribeVolumes`, `ec2:DescribeInstanceTypes`	Discover EC2 instances, regions, volumes and sizing
`cloudwatch:GetMetricData`	Read performance and storage metrics
`s3:ListAllMyBuckets`	List S3 buckets in the account
`s3:GetBucket*` / configuration reads	Read bucket settings: encryption, versioning, lifecycle, public access, replication, tags and more
`rds:DescribeDBInstances`, `rds:DescribeDBClusters`	Discover RDS databases and clusters
`rds:ListTagsForResource`	Read RDS tags for ownership and cost attribution
`config:Describe`, `config:Select`	Read the AWS Config resource inventory across the estate
`ce:GetCostAndUsage`, `ce:GetCostAndUsageWithResources`, `ce:GetDimensionValues`	Read Cost Explorer spend and usage data

Scan role trust policy

Action	What it does
`sts:AssumeRole`	Allow the collector identity to assume this scan role

Target EC2 instance profile (SSM only)

Action	What it does
`s3:PutObject`	Write SSM command output to the approved bucket
`s3:GetEncryptionConfiguration`	Check the bucket's encryption before writing

Guest access methods (EC2 Scan)¶

An EC2 Scan looks inside the operating system, so DMC needs one way to run discovery commands on each server. Pick the one method that matches your environment. AWS Systems Manager (SSM) is recommended because it needs no inbound ports opened to your servers.

Method	Use when	What it needs
SSM (recommended)	Your EC2 instances are managed by Systems Manager	SSM Agent running, instances show as Managed nodes, and an S3 output bucket (above)
SSH (Linux)	SSM isn't available and direct Linux access is allowed	Network path on TCP 22 from the DMC host, plus Linux credentials
WinRM (Windows)	SSM isn't available and direct Windows access is allowed	WinRM listener on TCP 5986 (HTTPS), plus Windows credentials

Server admin credentials¶

The in-server scan reads software, processes, network connections and patch levels. Some of that data is only visible to an administrator, so DMC needs admin-level credentials for the servers it scans with SSH or WinRM. SSM runs as SYSTEM (Windows) or root (Linux) and needs no credentials here.

Server type	Required credential
Windows	An account with local administrator rights
Linux	root, or a user with passwordless sudo

Why full admin? Lower-privilege accounts return incomplete data, which leads to gaps and rework in your migration plan. Providing admin credentials up front gives you a complete, accurate scan the first time.

AWS Config and Cost Explorer (Estate Discovery)¶

Turn on AWS Config¶

AWS Config gives DMC the full inventory of supported resource types across your estate, the backbone of estate discovery. Enable Config in each target account (or use an existing organization-wide aggregator) and confirm it is recording. This covers compute, containers, storage, databases, networking and more, for example EC2, Lambda, ECS/EKS, EBS, S3, RDS, DynamoDB, VPCs, load balancers and CloudFront.

Required for a complete picture. Without Config recording, estate discovery returns only the resources reachable through direct APIs and your inventory will have gaps. Enable it before you scan.

Turn on Cost Explorer¶

Cost Explorer provides your spend and usage by account, service, and region: the cost profile that makes estate discovery useful for planning and prioritization. Enable Cost Explorer and confirm it has finished its first data refresh.

For a single account, enable it in that account.
For multiple accounts, enable it in the management or payer account for a consolidated view.

Optional requirements¶

Requirement	Needed for
CloudWatch Agent installed on target instances	Memory utilization metrics. Without it, memory data will not appear in scan results.
AWS Config enabled and recording in each region	Resource inventory via estate discovery (see above)
Cost Explorer enabled in the management account	Cost and usage data collection (see above)

Run the scan¶

Run an AWS scan

Choose EC2 Scan, AWS Estate Discovery, or both, and walk through the wizard.