Skip to content

DMS endpoints should use SSL

Identifier

dms-use-ssl

Category

Protect > Data Protection > Encryption of data-in-transit

Description

This control checks whether AWS Database Migration Service (DMS) endpoints are configured to use SSL (Secure Sockets Layer) for encrypting data in transit between the DMS replication instance and the source or target database.

Encrypting data in transit ensures that sensitive information such as credentials, schema, and migrated data is protected from eavesdropping and man-in-the-middle attacks. The SSL configuration is specified using the ssl_mode attribute in the Terraform configuration of the aws_dms_endpoint resource.

Non Compliant Example

Terraform
1
2
3
4
5
6
7
8
resource "aws_dms_endpoint" "foo" {
  endpoint_id     = "foo"
  endpoint_type   = "source"
  engine_name     = "aurora"
  port            = 3306
  kms_key_arn     = "arn:aws:kms:us-east-1:123412341234:key/abcdabcd-abcd-abcd-abcd-abcdabcdabcd"
  ssl_mode        = "none"
}

Remediation

To enforce secure connections, set ssl_mode = "require" or a stronger mode supported by your database engine:

Terraform
1
2
3
4
5
6
7
8
resource "aws_dms_endpoint" "foo" {
  endpoint_id     = "foo"
  endpoint_type   = "source"
  engine_name     = "aurora"
  port            = 3306
  kms_key_arn     = "arn:aws:kms:us-east-1:123412341234:key/abcdabcd-abcd-abcd-abcd-abcdabcdabcd"
  ssl_mode        = "require"
}

Extra Resources