EC2 Scan

Provide a collector host

DMC runs from a machine inside your AWS environment — usually a small EC2 instance or jump box. It runs in memory, installs nothing permanent, and stores no credentials after it closes.

Requirements:

• Windows host you control, with network line-of-sight to the servers you want to scan.
• Outbound HTTPS (port 443) to AWS service endpoints.

Create the collector identity

This is the IAM identity DMC uses to start the scan and reach into your target accounts. The simplest approach is an IAM role attached to the collector host (an EC2 instance role).

Create the identity, then attach the policy below.

{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "AssumeScanRoleInTargetAccounts", "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::*:role/<SCAN_ROLE_NAME>" },
    { "Sid": "ResolveRegionsForDiscovery", "Effect": "Allow",
      "Action": "ec2:DescribeRegions", "Resource": "*" },
    { "Sid": "ListOrganizationAccounts", "Effect": "Allow",
      "Action": "organizations:ListAccounts", "Resource": "*" },
    { "Sid": "ValidateAndReadSsmOutputBucket", "Effect": "Allow",
      "Action": ["s3:GetBucketLocation","s3:ListBucket"],
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>" },
    { "Sid": "ReadSsmCommandOutput", "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>/dmc/*" }
  ]
}

Replace <SCAN_ROLE_NAME> with the name you’ll use in step 3, and <OUTPUT_BUCKET> with the S3 bucket from step 4.

Create a scan role in each target account

In every AWS account you want to scan, create an IAM role with the same name (the one you used in step 2). This role gives DMC read-only access to discover EC2 and run in-server collection. Attach two things to it: the permissions policy and a trust policy that lets your collector identity assume it.

Permissions policy:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "ValidateCallerIdentity", "Effect": "Allow",
      "Action": "sts:GetCallerIdentity", "Resource": "*" },
    { "Sid": "DiscoverEc2", "Effect": "Allow",
      "Action": ["ec2:DescribeInstances","ec2:DescribeRegions",
                 "ec2:DescribeVolumes","ec2:DescribeInstanceTypes"],
      "Resource": "*" },
    { "Sid": "ReadCloudWatchMetrics", "Effect": "Allow",
      "Action": "cloudwatch:GetMetricData", "Resource": "*" },
    { "Sid": "InspectAndPollSsm", "Effect": "Allow",
      "Action": ["ssm:DescribeInstanceInformation","ssm:GetCommandInvocation"],
      "Resource": "*" },
    { "Sid": "RunApprovedDmcDocuments", "Effect": "Allow",
      "Action": "ssm:SendCommand",
      "Resource": ["arn:aws:ssm:*::document/AWS-RunShellScript",
                   "arn:aws:ssm:*::document/AWS-RunPowerShellScript"] },
    { "Sid": "RunOnInstancesInThisAccount", "Effect": "Allow",
      "Action": "ssm:SendCommand",
      "Resource": "arn:aws:ec2:*:<ACCOUNT_ID>:instance/*" }
  ]
}

Trust policy (lets the collector identity assume this role):

{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "TrustDmcCollectorPrincipal", "Effect": "Allow",
      "Principal": { "AWS": "<COLLECTOR_PRINCIPAL_ARN>" },
      "Action": "sts:AssumeRole" }
  ]
}

Replace <ACCOUNT_ID> with each target account ID and <COLLECTOR_PRINCIPAL_ARN> with the ARN of your collector identity from step 2.

Set up how DMC reaches inside your servers

An EC2 scan looks inside the operating system, so DMC needs a way to run discovery commands on each server. Pick the one method that matches your environment. AWS Systems Manager (SSM) is recommended because it needs no inbound ports opened to your servers.

If you use SSM — add an output bucket and writer permission

SSM writes its command output to an S3 bucket so DMC can collect it. Create (or pick) a bucket, then attach this policy to the instance profile on your target EC2 servers so they can write their output:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "WriteDmcSsmOutput", "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>/dmc/*" },
    { "Sid": "ReadOutputBucketEncryptionConfiguration", "Effect": "Allow",
      "Action": "s3:GetEncryptionConfiguration",
      "Resource": "arn:aws:s3:::<OUTPUT_BUCKET>" }
  ]
}

Provide admin credentials for your servers

The in-server scan reads software, processes, network connections and patch levels. Some of that data is only visible to an administrator, so DMC needs admin-level credentials for the servers it scans.

Open the required network ports

All connections start from the collector host and go outbound — nothing needs to connect in to the collector.

Run the scan and export

Launch DMC on the collector host, choose EC2 Scan, select your accounts, regions and in-server method, then run. When it finishes, DMC produces a password-protected ZIP of the collected data. Hand that file to your Dr Migrate contact, or import it into Dr Migrate yourself.

Confirm it worked

Before you finish, check these — they catch the most common issues:

• The collector host can reach AWS APIs on port 443
• The collector identity can assume the scan role with no “access denied”
• Your target instances appear (and show as Managed if using SSM)
• A test server returns software and network data — not just the EC2 record
• The export ZIP is created and you have its password