Export data to Migration Center

After you've collected the data about your assets, you can then export it to Migration Center where you can do the following:

• View the collected assets in one place
• View and understand insights that Migration Center generates about your infrastructure
• Create groups of assets
• Generate total cost of ownership (TCO) reports for your infrastructure

This document describes how to export the data to Migration Center for an online assessment by using the Migration Center discovery client CLI.

Before you begin

1. Complete the steps to discover assets in your infrastructure.
2. From the Google Cloud console, activate Migration Center.

3. Enable the Cloud Resource Manager API.

   Enable the API

Review required roles and permissions

To get the permissions that you need to export the collected data to Migration Center, ask your administrator to grant you the Migration Center Admin (migrationcenter.admin) IAM role on the project. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to export the collected data to Migration Center. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to export the collected data to Migration Center:

• resourcemanager.projects.get
• migrationcenter.sources.create
• migrationcenter.sources.get
• migrationcenter.assets.reportFrames

You might also be able to get these permissions with custom roles or other predefined roles.

Set up authentication to Migration Center

To export the collected data to Migration Center, first you need to set up authentication to Migration Center with one of the following methods:

• Using a personal account.
• Using a service account.

To use these methods using the Google Cloud CLI as described in this document, you need to install and initialize the gcloud CLI.

Set up authentication using a personal account

• Provide your user credentials to Application Default Credentials (ADC):

  gcloud --project PROJECT_ID auth application-default login
  

  Replace PROJECT_ID with the name or ID of your project.

Set up authentication using a service account

Note: Service account keys are a security risk if not managed correctly. You should choose a more secure alternative to service account keys whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by Best practices for managing service account keys. If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see Managing secure-by-default organization resources.

1. If you have the required permissions, then create a service account:

   gcloud iam service-accounts create SA_NAME \
       --description='SA_DESCRIPTION' \
       --display-name='SA_DISPLAY_NAME'
   

   Replace the following:

   • SA_NAME: the name you want for the service account
   • SA_DESCRIPTION: an optional description for the service account
   • SA_DISPLAY_NAME: the display name for the service account

2. To grant the service account the required permissions, assign the migrationcenter.admin role:

   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member='serviceAccount:SA_NAME@PROJECT_ID.iam.gserviceaccount.com' \
       --role='roles/migrationcenter.admin'
   

   Replace PROJECT_ID with the name of your project.

3. Create a service account key:

   gcloud iam service-accounts keys create ~/sa-private-key.json \
    --iam-account=SA_NAME@PROJECT_ID.iam.gserviceaccount.com \
    --billing-project PROJECT_ID
   

   The key is saved in the specified path: ~/sa-private-key.json.

   Note: It is recommended that you set an expiration date for the service account key. If you don't set an expiration date for the service account key, the generated key has no expiration date and you must delete it manually. For more information, see the best practices for managing service account keys.

4. Copy the key file to the machine where you want to run the mcdc CLI.

Limitations

• Exporting data collected from AWS with an inventory discovery to Migration Center is not supported.

Export the collected data

After the data collection and authentication setup to Migration Center is complete, you can proceed to exporting the collected data to Migration Center.

• To export the collected data from your workstation to Migration Center, run the following command:

  Linux

  ./mcdc export mc --project PROJECT_ID

  Windows

  mcdc.exe export mc --project PROJECT_ID

  Replace PROJECT_ID with the name of your project.

• If you've set up authentication to Migration Center using a service account key, then you need to provide the path to the JSON key file using the --sa-key flag:

  Linux

  ./mcdc export mc --project PROJECT_ID --json-key PATH_TO_JSON_KEY

  Windows

  mcdc.exe export mc --project PROJECT_ID --json-key PATH_TO_JSON_KEY

  Replace PATH_TO_JSON_KEY with the path to the JSON key file.

  Optionally, if you want to wait for Migration Center to finish processing the assets, and check whether all the work is done successfully, then use the --wait flag with the export command.

After the export is complete, the discovery client prints a link that you can follow to see your assets in Migration Center.

What's next

• Learn how to manage the mcdc CLI.
• Learn how to view the collected assets in Migration Center.