Setup guide

Blanket read-only across EC2, RDS, ELB, S3 listings and CloudWatch so the inventory step can enumerate every resource class without a bespoke policy per service.

↳ Prefer an inline policy granting only tag:GetResources, ec2:Describe*, rds:DescribeDBInstances, elasticloadbalancing:Describe*, s3:ListAllMyBuckets, s3:GetBucketLocation, cloudwatch:GetMetricStatistics, ce:GetCostAndUsage, savingsplans:DescribeSavingsPlans — ViewOnlyAccess also exposes unrelated service metadata.

Drives the mechanical inventory sweep ('aws resourcegroupstaggingapi get-resources') that produces the raw JSON under inventory/ before any per-service describe calls.

↳ Cannot be narrowed by resource ARN — the Resource Groups Tagging API only supports Resource: "*"; scope it with a Condition on aws:RequestedRegion instead.

Enumerates compute flavours for the service-equivalence map, block volume size/type/IOPS for the storage cost model, and existing Reserved Instance commitments that dominate the go/no-go math.

↳ EC2 Describe* actions do not support resource-level permissions; restrict with a Condition on aws:RequestedRegion to the regions actually in scope.

Captures engine, version and instance class per managed database so the plan can price the managed-service premium and flag Aurora-only features with no target equivalent.

↳ Scope Resource to arn:aws:rds:<region>:<account>:db:* if only a subset of accounts is in migration scope.

Maps ALB/NLB listeners and target groups onto Hetzner lb11/lb21/lb31 or OVHcloud Octavia load balancers and checks per-size target and service caps.

↳ Add elasticloadbalancing:DescribeTargetGroups only if you need per-target detail; otherwise leave it out.

Discovers every bucket and its region so the transfer plan can size data per bucket and confirm the source region for egress pricing.

↳ s3:ListAllMyBuckets is account-wide by definition; if the bucket list is already known, drop it and grant only s3:GetBucketLocation on the specific bucket ARNs.

Reads AWS/S3 BucketSizeBytes and NumberOfObjects so data volume comes from metrics rather than from an expensive full object listing.

↳ CloudWatch read actions do not support resource-level scoping; constrain with a Condition on cloudwatch:namespace equal to AWS/S3 and AWS/EC2.

Pulls three months of billing detail grouped by USAGE_TYPE — the only way to separate internet egress from inter-AZ transfer and NAT processing, which is the core of the egress cost model.

↳ No narrower alternative exists; ce:GetCostAndUsage is already the single most limited Cost Explorer read action. Do not substitute ce:* — it includes budget and anomaly-monitor mutations.

Retrieves active Savings Plans and their end dates so the cost comparison is against the committed rate, not on-demand list price.

↳ Pair with ce:GetSavingsPlansUtilization only if utilisation history is genuinely needed; the plan inventory alone is usually sufficient.

Grants the rclone 'awssrc' remote the reads it needs to sync and then checksum-verify every object during the bulk migration passes.

↳ Scope Resource to the exact bucket ARNs being migrated (arn:aws:s3:::bucket and arn:aws:s3:::bucket/*) rather than "*"; add s3:GetObjectVersion only if versioned history must move.

Required on the GCP source path for 'gcloud asset search-all-resources', which is the GCP equivalent of the tagging-API inventory sweep.

↳ Grant at the project scope being migrated rather than at the organization; roles/viewer also works but is far broader.

Required on the Azure source path so 'az graph query' can project name, type, location and sku for every resource in the subscription.

↳ Assign at the specific subscription or resource-group scope rather than the management group; Resource Graph results are already filtered to what the principal can read.

Lets the skill list existing servers, volumes, networks and load balancers and confirm project quota headroom before the pilot.

↳ Use a Read token for the discovery and quota-verification phase and only mint a Read & Write token at the moment you run 'terraform apply'; tokens are project-scoped, so create a dedicated migration project rather than reusing production.

Needed for the reference landing zone: creating hcloud_network, hcloud_network_subnet, hcloud_server, hcloud_load_balancer and its network/target/service attachments.

↳ No finer-grained scopes exist in the Hetzner Cloud API — the only real containment is project isolation plus revoking the token immediately after cutover.

OVHcloud Public Cloud user role that permits creating instances, volumes and networks in the target project and reading quotas via 'openstack quota show'.

↳ Use ObjectStore Operator alone for a storage-only migration, and Network Operator alone for the private-network prerequisites; avoid Administrator, which also grants billing and user management.

Cause: Either the ce:GetCostAndUsage action is missing from the policy, or IAM access to Billing information was never activated in the management account — the IAM policy alone is not sufficient.

Fix: Attach ce:GetCostAndUsage on Resource "*", then in the management account go to Billing and Cost Management > Account settings > IAM user and role access to Billing information > Edit > Activate IAM Access > Update.

Cause: Cost Explorer was only just enabled, or the requested time period predates the account's available cost data. Backfill takes up to 24 hours.

Fix: Wait for the initial Cost Explorer preparation to finish, then re-run with a Start date inside the range the console itself displays; shorten the window to the last full month if unsure.

Cause: An STS assume-role or IAM Identity Center session expired mid-inventory; ASIA-prefixed keys are short-lived (1-12 hours).

Fix: Re-run 'aws sso login --profile <p>' or 'aws sts assume-role --duration-seconds 3600 ...' and re-export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN together — a stale AWS_SESSION_TOKEN left in the environment is the usual cause.

Cause: The principal lacks ec2:DescribeInstances, or a permissions boundary / SCP on the organizational unit denies the action in that region.

Fix: Attach ViewOnlyAccess (or the explicit ec2:Describe* inline policy), then check AWS Organizations > Policies > Service control policies for a Deny with a aws:RequestedRegion condition excluding your AWS_REGION.

Cause: s3:ListAllMyBuckets is missing, or the bucket policy / S3 Block Public Access configuration denies the cross-account principal.

Fix: Add s3:ListAllMyBuckets on Resource "*" plus s3:ListBucket and s3:GetObject on the specific bucket ARNs; for cross-account inventory also add an allow for the principal in the bucket policy.

Cause: rclone is signing for the wrong region or using virtual-host addressing against an S3-compatible endpoint that expects path style — very common against Hetzner Object Storage and OVHcloud.

Fix: In the dsttgt remote set provider = Other, region to the endpoint's location (e.g. fsn1 or gra), and force_path_style = true; confirm RCLONE_CONFIG_DSTTGT_ENDPOINT has no trailing slash and no bucket name in the path.

Cause: The object-storage key pair was generated in a different Hetzner/OVHcloud project or location than the endpoint being addressed — these credentials are scoped per project and per region.

Fix: Regenerate the S3 credentials inside the same project and location as the target bucket and point RCLONE_CONFIG_DSTTGT_ENDPOINT at that location's endpoint.

Cause: HCLOUD_TOKEN is empty, truncated, revoked, or belongs to a different Hetzner Cloud project than the resources in state.

Fix: Regenerate the token at Cloud Console > project > Security > API tokens and re-export it; verify with 'curl -H "Authorization: Bearer $HCLOUD_TOKEN" https://api.hetzner.cloud/v1/servers' returning 200 before re-running terraform.

Cause: The Hetzner Cloud project's default server, volume, floating-IP or load-balancer quota was hit mid-apply — new projects start with low limits.

Fix: Request a limit increase for the project before the pilot and re-run 'terraform apply'; partially created resources remain in state, so do not taint or destroy blindly.

Cause: CREATE PUBLICATION mig FOR ALL TABLES requires superuser on PostgreSQL 15 and earlier; the RDS master user is not a true superuser.

Fix: Grant rds_superuser to the migration role on RDS, or on PostgreSQL 16+ grant pg_create_subscription and use an explicit FOR TABLES IN SCHEMA public publication instead of FOR ALL TABLES.

Cause: The source instance is still running with wal_level = replica; on RDS this is controlled by the static parameter rds.logical_replication.

Fix: Set rds.logical_replication = 1 in a custom DB parameter group, apply it and reboot the instance (a static parameter change is not dynamic), then re-check with SHOW wal_level.

Cause: Sequences were not resynchronised after promotion — PostgreSQL logical replication copies rows but not sequence values, so the target restarts allocation from 1.

Fix: Immediately after promotion run setval() for every sequence from max(id) on the corresponding column, before the application is allowed to write; generate the statements from pg_sequences rather than by hand.

Cause: The principal lacks cloudasset.assets.searchAllResources at the requested scope, or the scope string is malformed (must be projects/<id>, folders/<id> or organizations/<id>).

Fix: Grant roles/cloudasset.viewer at the exact scope being searched and confirm the Cloud Asset API is enabled for the project with 'gcloud services enable cloudasset.googleapis.com'.

Cause: Azure Resource Graph is a CLI extension and is not installed by default.

Fix: Run 'az extension add --name resource-graph', then re-run the query; if the extension is present but returns no rows, the principal is missing Reader at the subscription scope.