AWS API Changes

2026/09/02 - Application Migration Service - 3 updated api methods

Changes AWS Transform for migrations adds a second network migration option - apply your source security posture to existing VPCs. Upload a source network file with firewall rules, tag the in-scope VPCs, and AWS Transform matches source subnets to them by CIDR and generates the security groups.

CreateNetworkMigrationDefinition (updated)

Link ¶
Changes (both)

{'cidrMappings': [{'originalCidr': 'string', 'updatedCidr': 'string'}],
 'vpcProvisioningStrategy': 'CREATE_NEW | USE_EXISTING'}

Creates a new network migration definition that specifies the source and target network configuration for a migration.

See also: AWS API Documentation

Request Syntax

client.create_network_migration_definition(
    name='string',
    description='string',
    sourceConfigurations=[
        {
            'sourceEnvironment': 'NSX'|'VSPHERE'|'FORTIGATE_FIREWALL'|'PALO_ALTO_FIREWALL'|'CISCO_ACI'|'LOGICAL_MODEL'|'MODELIZE_IT'|'AWS_DISCOVERY_COLLECTOR',
            'sourceS3Configuration': {
                's3Bucket': 'string',
                's3BucketOwner': 'string',
                's3Key': 'string'
            }
        },
    ],
    targetS3Configuration={
        's3Bucket': 'string',
        's3BucketOwner': 'string'
    },
    targetNetwork={
        'topology': 'ISOLATED_VPC'|'HUB_AND_SPOKE',
        'inboundCidr': 'string',
        'outboundCidr': 'string',
        'inspectionCidr': 'string'
    },
    targetDeployment='SINGLE_ACCOUNT'|'MULTI_ACCOUNT',
    vpcProvisioningStrategy='CREATE_NEW'|'USE_EXISTING',
    cidrMappings=[
        {
            'originalCidr': 'string',
            'updatedCidr': 'string'
        },
    ],
    tags={
        'string': 'string'
    },
    scopeTags={
        'string': 'string'
    }
)

type name:

string

param name:

[REQUIRED]

The name of the network migration definition.

type description:

string

param description:

A description of the network migration definition.

type sourceConfigurations:

list

param sourceConfigurations:

A list of source configurations for the network migration.

(dict) --

Configuration for a migration source environment.
- sourceEnvironment (string) -- [REQUIRED]
  
  The source environment type.
- sourceS3Configuration (dict) -- [REQUIRED]
  
  The S3 configuration for the source data.
  - s3Bucket (string) -- [REQUIRED]
    
    The name of the S3 bucket containing source data.
  - s3BucketOwner (string) -- [REQUIRED]
    
    The AWS account ID of the S3 bucket owner.
  - s3Key (string) -- [REQUIRED]
    
    The S3 key (path) for the source data.

type targetS3Configuration:

dict

param targetS3Configuration:

[REQUIRED]

The S3 configuration for storing the target network artifacts.

s3Bucket (string) -- [REQUIRED]

The name of the S3 bucket for target artifacts.
s3BucketOwner (string) -- [REQUIRED]

The AWS account ID of the S3 bucket owner.

type targetNetwork:

dict

param targetNetwork:

[REQUIRED]

The target network configuration including topology and CIDR ranges.

topology (string) -- [REQUIRED]

The network topology type for the target environment.
inboundCidr (string) --

The CIDR block for inbound traffic in the target network.
outboundCidr (string) --

The CIDR block for outbound traffic in the target network.
inspectionCidr (string) --

The CIDR block for inspection traffic in the target network.

type targetDeployment:

string

param targetDeployment:

The target deployment configuration for the migrated network.

type vpcProvisioningStrategy:

string

param vpcProvisioningStrategy:

Specifies whether to create new target VPCs or use existing ones. Set to CREATE_NEW to provision new target VPCs as part of the migration, or USE_EXISTING to migrate into existing VPCs in the target account.

type cidrMappings:

list

param cidrMappings:

A list of CIDR mappings that map original source CIDR ranges to updated target CIDR ranges. CIDR mappings can be provided only when vpcProvisioningStrategy is set to USE_EXISTING.

(dict) --

Maps a source CIDR range to the corresponding target CIDR range to use in the target network.
- originalCidr (string) -- [REQUIRED]
  
  The original CIDR range in the source network.
- updatedCidr (string) -- [REQUIRED]
  
  The updated CIDR range to use in the target network.

type tags:

dict

param tags:

Tags to assign to the network migration definition.

(string) --
- (string) --

type scopeTags:

dict

param scopeTags:

Scope tags for the network migration definition to control access and organization.

(string) --
- (string) --

rtype:

dict

returns:

Response Syntax

{
    'arn': 'string',
    'networkMigrationDefinitionID': 'string',
    'name': 'string',
    'description': 'string',
    'sourceConfigurations': [
        {
            'sourceEnvironment': 'NSX'|'VSPHERE'|'FORTIGATE_FIREWALL'|'PALO_ALTO_FIREWALL'|'CISCO_ACI'|'LOGICAL_MODEL'|'MODELIZE_IT'|'AWS_DISCOVERY_COLLECTOR',
            'sourceS3Configuration': {
                's3Bucket': 'string',
                's3BucketOwner': 'string',
                's3Key': 'string'
            }
        },
    ],
    'targetS3Configuration': {
        's3Bucket': 'string',
        's3BucketOwner': 'string'
    },
    'targetNetwork': {
        'topology': 'ISOLATED_VPC'|'HUB_AND_SPOKE',
        'inboundCidr': 'string',
        'outboundCidr': 'string',
        'inspectionCidr': 'string'
    },
    'targetDeployment': 'SINGLE_ACCOUNT'|'MULTI_ACCOUNT',
    'vpcProvisioningStrategy': 'CREATE_NEW'|'USE_EXISTING',
    'cidrMappings': [
        {
            'originalCidr': 'string',
            'updatedCidr': 'string'
        },
    ],
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'tags': {
        'string': 'string'
    },
    'scopeTags': {
        'string': 'string'
    }
}

Response Structure

(dict) --
- arn (string) --
  
  The Amazon Resource Name (ARN) of the network migration definition.
- networkMigrationDefinitionID (string) --
  
  The unique identifier of the network migration definition.
- name (string) --
  
  The name of the network migration definition.
- description (string) --
  
  A description of the network migration definition.
- sourceConfigurations (list) --
  
  A list of source configurations for the network migration.
  - (dict) --
    
    Configuration for a migration source environment.
    - sourceEnvironment (string) --
      
      The source environment type.
    - sourceS3Configuration (dict) --
      
      The S3 configuration for the source data.
      - s3Bucket (string) --
        
        The name of the S3 bucket containing source data.
      - s3BucketOwner (string) --
        
        The AWS account ID of the S3 bucket owner.
      - s3Key (string) --
        
        The S3 key (path) for the source data.
- targetS3Configuration (dict) --
  
  The S3 configuration for storing the target network artifacts.
  - s3Bucket (string) --
    
    The name of the S3 bucket for target artifacts.
  - s3BucketOwner (string) --
    
    The AWS account ID of the S3 bucket owner.
- targetNetwork (dict) --
  
  The target network configuration including topology and CIDR ranges.
  - topology (string) --
    
    The network topology type for the target environment.
  - inboundCidr (string) --
    
    The CIDR block for inbound traffic in the target network.
  - outboundCidr (string) --
    
    The CIDR block for outbound traffic in the target network.
  - inspectionCidr (string) --
    
    The CIDR block for inspection traffic in the target network.
- targetDeployment (string) --
  
  The target deployment configuration for the migrated network.
- vpcProvisioningStrategy (string) --
  
  Indicates whether the migration creates new target VPCs or uses existing ones. CREATE_NEW provisions new target VPCs; USE_EXISTING migrates into existing VPCs in the target account.
- cidrMappings (list) --
  
  A list of CIDR mappings that map original source CIDR ranges to updated target CIDR ranges. CIDR mappings apply only when vpcProvisioningStrategy is set to USE_EXISTING.
  - (dict) --
    
    Maps a source CIDR range to the corresponding target CIDR range to use in the target network.
    - originalCidr (string) --
      
      The original CIDR range in the source network.
    - updatedCidr (string) --
      
      The updated CIDR range to use in the target network.
- createdAt (datetime) --
  
  The timestamp when the network migration definition was created.
- updatedAt (datetime) --
  
  The timestamp when the network migration definition was last updated.
- tags (dict) --
  
  Tags assigned to the network migration definition.
  - (string) --
    - (string) --
- scopeTags (dict) --
  
  Scope tags for the network migration definition.
  - (string) --
    - (string) --

GetNetworkMigrationDefinition (updated)

Link ¶
Changes (response)

{'cidrMappings': [{'originalCidr': 'string', 'updatedCidr': 'string'}],
 'vpcProvisioningStrategy': 'CREATE_NEW | USE_EXISTING'}

Retrieves the details of a network migration definition including source and target configurations.

See also: AWS API Documentation

Request Syntax

client.get_network_migration_definition(
    networkMigrationDefinitionID='string'
)

type networkMigrationDefinitionID:

string

param networkMigrationDefinitionID:

[REQUIRED]

The unique identifier of the network migration definition to retrieve.

rtype:

dict

returns:

Response Syntax

{
    'arn': 'string',
    'networkMigrationDefinitionID': 'string',
    'name': 'string',
    'description': 'string',
    'sourceConfigurations': [
        {
            'sourceEnvironment': 'NSX'|'VSPHERE'|'FORTIGATE_FIREWALL'|'PALO_ALTO_FIREWALL'|'CISCO_ACI'|'LOGICAL_MODEL'|'MODELIZE_IT'|'AWS_DISCOVERY_COLLECTOR',
            'sourceS3Configuration': {
                's3Bucket': 'string',
                's3BucketOwner': 'string',
                's3Key': 'string'
            }
        },
    ],
    'targetS3Configuration': {
        's3Bucket': 'string',
        's3BucketOwner': 'string'
    },
    'targetNetwork': {
        'topology': 'ISOLATED_VPC'|'HUB_AND_SPOKE',
        'inboundCidr': 'string',
        'outboundCidr': 'string',
        'inspectionCidr': 'string'
    },
    'targetDeployment': 'SINGLE_ACCOUNT'|'MULTI_ACCOUNT',
    'vpcProvisioningStrategy': 'CREATE_NEW'|'USE_EXISTING',
    'cidrMappings': [
        {
            'originalCidr': 'string',
            'updatedCidr': 'string'
        },
    ],
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'tags': {
        'string': 'string'
    },
    'scopeTags': {
        'string': 'string'
    }
}

Response Structure

(dict) --
- arn (string) --
  
  The Amazon Resource Name (ARN) of the network migration definition.
- networkMigrationDefinitionID (string) --
  
  The unique identifier of the network migration definition.
- name (string) --
  
  The name of the network migration definition.
- description (string) --
  
  A description of the network migration definition.
- sourceConfigurations (list) --
  
  A list of source configurations for the network migration.
  - (dict) --
    
    Configuration for a migration source environment.
    - sourceEnvironment (string) --
      
      The source environment type.
    - sourceS3Configuration (dict) --
      
      The S3 configuration for the source data.
      - s3Bucket (string) --
        
        The name of the S3 bucket containing source data.
      - s3BucketOwner (string) --
        
        The AWS account ID of the S3 bucket owner.
      - s3Key (string) --
        
        The S3 key (path) for the source data.
- targetS3Configuration (dict) --
  
  The S3 configuration for storing the target network artifacts.
  - s3Bucket (string) --
    
    The name of the S3 bucket for target artifacts.
  - s3BucketOwner (string) --
    
    The AWS account ID of the S3 bucket owner.
- targetNetwork (dict) --
  
  The target network configuration including topology and CIDR ranges.
  - topology (string) --
    
    The network topology type for the target environment.
  - inboundCidr (string) --
    
    The CIDR block for inbound traffic in the target network.
  - outboundCidr (string) --
    
    The CIDR block for outbound traffic in the target network.
  - inspectionCidr (string) --
    
    The CIDR block for inspection traffic in the target network.
- targetDeployment (string) --
  
  The target deployment configuration for the migrated network.
- vpcProvisioningStrategy (string) --
  
  Indicates whether the migration creates new target VPCs or uses existing ones. CREATE_NEW provisions new target VPCs; USE_EXISTING migrates into existing VPCs in the target account.
- cidrMappings (list) --
  
  A list of CIDR mappings that map original source CIDR ranges to updated target CIDR ranges. CIDR mappings apply only when vpcProvisioningStrategy is set to USE_EXISTING.
  - (dict) --
    
    Maps a source CIDR range to the corresponding target CIDR range to use in the target network.
    - originalCidr (string) --
      
      The original CIDR range in the source network.
    - updatedCidr (string) --
      
      The updated CIDR range to use in the target network.
- createdAt (datetime) --
  
  The timestamp when the network migration definition was created.
- updatedAt (datetime) --
  
  The timestamp when the network migration definition was last updated.
- tags (dict) --
  
  Tags assigned to the network migration definition.
  - (string) --
    - (string) --
- scopeTags (dict) --
  
  Scope tags for the network migration definition.
  - (string) --
    - (string) --

UpdateNetworkMigrationDefinition (updated)

Link ¶
Changes (both)

{'cidrMappings': [{'originalCidr': 'string', 'updatedCidr': 'string'}],
 'vpcProvisioningStrategy': 'CREATE_NEW | USE_EXISTING'}

Updates an existing network migration definition with new source or target configurations.

See also: AWS API Documentation

Request Syntax

client.update_network_migration_definition(
    networkMigrationDefinitionID='string',
    name='string',
    description='string',
    sourceConfigurations=[
        {
            'sourceEnvironment': 'NSX'|'VSPHERE'|'FORTIGATE_FIREWALL'|'PALO_ALTO_FIREWALL'|'CISCO_ACI'|'LOGICAL_MODEL'|'MODELIZE_IT'|'AWS_DISCOVERY_COLLECTOR',
            'sourceS3Configuration': {
                's3Bucket': 'string',
                's3BucketOwner': 'string',
                's3Key': 'string'
            }
        },
    ],
    targetS3Configuration={
        's3Bucket': 'string',
        's3BucketOwner': 'string'
    },
    targetNetwork={
        'topology': 'ISOLATED_VPC'|'HUB_AND_SPOKE',
        'inboundCidr': 'string',
        'outboundCidr': 'string',
        'inspectionCidr': 'string'
    },
    targetDeployment='SINGLE_ACCOUNT'|'MULTI_ACCOUNT',
    vpcProvisioningStrategy='CREATE_NEW'|'USE_EXISTING',
    cidrMappings=[
        {
            'originalCidr': 'string',
            'updatedCidr': 'string'
        },
    ],
    scopeTags={
        'string': 'string'
    }
)

type networkMigrationDefinitionID:

string

param networkMigrationDefinitionID:

[REQUIRED]

The unique identifier of the network migration definition to update.

type name:

string

param name:

The updated name of the network migration definition.

type description:

string

param description:

The updated description of the network migration definition.

type sourceConfigurations:

list

param sourceConfigurations:

The updated list of source configurations.

(dict) --

Configuration for a migration source environment.
- sourceEnvironment (string) -- [REQUIRED]
  
  The source environment type.
- sourceS3Configuration (dict) -- [REQUIRED]
  
  The S3 configuration for the source data.
  - s3Bucket (string) -- [REQUIRED]
    
    The name of the S3 bucket containing source data.
  - s3BucketOwner (string) -- [REQUIRED]
    
    The AWS account ID of the S3 bucket owner.
  - s3Key (string) -- [REQUIRED]
    
    The S3 key (path) for the source data.

type targetS3Configuration:

dict

param targetS3Configuration:

The updated S3 configuration for storing the target network artifacts.

s3Bucket (string) --

The updated name of the S3 bucket.
s3BucketOwner (string) --

The updated AWS account ID of the S3 bucket owner.

type targetNetwork:

dict

param targetNetwork:

The updated target network configuration.

topology (string) --

The updated network topology type.
inboundCidr (string) --

The updated CIDR block for inbound traffic.
outboundCidr (string) --

The updated CIDR block for outbound traffic.
inspectionCidr (string) --

The updated CIDR block for inspection traffic.

type targetDeployment:

string

param targetDeployment:

The updated target deployment configuration.

type vpcProvisioningStrategy:

string

param vpcProvisioningStrategy:

Updates whether the migration creates new target VPCs or uses existing ones. Set to USE_EXISTING to migrate into existing VPCs in the target account, or to CREATE_NEW to provision new target VPCs.

type cidrMappings:

list

param cidrMappings:

The updated list of CIDR mappings that map original source CIDR ranges to updated target CIDR ranges. CIDR mappings can be provided only when vpcProvisioningStrategy is set to USE_EXISTING.

(dict) --

Maps a source CIDR range to the corresponding target CIDR range to use in the target network.
- originalCidr (string) -- [REQUIRED]
  
  The original CIDR range in the source network.
- updatedCidr (string) -- [REQUIRED]
  
  The updated CIDR range to use in the target network.

type scopeTags:

dict

param scopeTags:

The updated scope tags for the network migration definition.

(string) --
- (string) --

rtype:

dict

returns:

Response Syntax

{
    'arn': 'string',
    'networkMigrationDefinitionID': 'string',
    'name': 'string',
    'description': 'string',
    'sourceConfigurations': [
        {
            'sourceEnvironment': 'NSX'|'VSPHERE'|'FORTIGATE_FIREWALL'|'PALO_ALTO_FIREWALL'|'CISCO_ACI'|'LOGICAL_MODEL'|'MODELIZE_IT'|'AWS_DISCOVERY_COLLECTOR',
            'sourceS3Configuration': {
                's3Bucket': 'string',
                's3BucketOwner': 'string',
                's3Key': 'string'
            }
        },
    ],
    'targetS3Configuration': {
        's3Bucket': 'string',
        's3BucketOwner': 'string'
    },
    'targetNetwork': {
        'topology': 'ISOLATED_VPC'|'HUB_AND_SPOKE',
        'inboundCidr': 'string',
        'outboundCidr': 'string',
        'inspectionCidr': 'string'
    },
    'targetDeployment': 'SINGLE_ACCOUNT'|'MULTI_ACCOUNT',
    'vpcProvisioningStrategy': 'CREATE_NEW'|'USE_EXISTING',
    'cidrMappings': [
        {
            'originalCidr': 'string',
            'updatedCidr': 'string'
        },
    ],
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'tags': {
        'string': 'string'
    },
    'scopeTags': {
        'string': 'string'
    }
}

Response Structure

(dict) --
- arn (string) --
  
  The Amazon Resource Name (ARN) of the network migration definition.
- networkMigrationDefinitionID (string) --
  
  The unique identifier of the network migration definition.
- name (string) --
  
  The name of the network migration definition.
- description (string) --
  
  A description of the network migration definition.
- sourceConfigurations (list) --
  
  A list of source configurations for the network migration.
  - (dict) --
    
    Configuration for a migration source environment.
    - sourceEnvironment (string) --
      
      The source environment type.
    - sourceS3Configuration (dict) --
      
      The S3 configuration for the source data.
      - s3Bucket (string) --
        
        The name of the S3 bucket containing source data.
      - s3BucketOwner (string) --
        
        The AWS account ID of the S3 bucket owner.
      - s3Key (string) --
        
        The S3 key (path) for the source data.
- targetS3Configuration (dict) --
  
  The S3 configuration for storing the target network artifacts.
  - s3Bucket (string) --
    
    The name of the S3 bucket for target artifacts.
  - s3BucketOwner (string) --
    
    The AWS account ID of the S3 bucket owner.
- targetNetwork (dict) --
  
  The target network configuration including topology and CIDR ranges.
  - topology (string) --
    
    The network topology type for the target environment.
  - inboundCidr (string) --
    
    The CIDR block for inbound traffic in the target network.
  - outboundCidr (string) --
    
    The CIDR block for outbound traffic in the target network.
  - inspectionCidr (string) --
    
    The CIDR block for inspection traffic in the target network.
- targetDeployment (string) --
  
  The target deployment configuration for the migrated network.
- vpcProvisioningStrategy (string) --
  
  Indicates whether the migration creates new target VPCs or uses existing ones. CREATE_NEW provisions new target VPCs; USE_EXISTING migrates into existing VPCs in the target account.
- cidrMappings (list) --
  
  A list of CIDR mappings that map original source CIDR ranges to updated target CIDR ranges. CIDR mappings apply only when vpcProvisioningStrategy is set to USE_EXISTING.
  - (dict) --
    
    Maps a source CIDR range to the corresponding target CIDR range to use in the target network.
    - originalCidr (string) --
      
      The original CIDR range in the source network.
    - updatedCidr (string) --
      
      The updated CIDR range to use in the target network.
- createdAt (datetime) --
  
  The timestamp when the network migration definition was created.
- updatedAt (datetime) --
  
  The timestamp when the network migration definition was last updated.
- tags (dict) --
  
  Tags assigned to the network migration definition.
  - (string) --
    - (string) --
- scopeTags (dict) --
  
  Scope tags for the network migration definition.
  - (string) --
    - (string) --