DMS MongoDB endpoint has an authentication mechanism enabled

Check ID: dms_endpoint_mongodb_authentication_enabled
Provider: AWS
Service: dms
Severity: MEDIUM
Categories: identity-access
Resource type: AwsDmsEndpoint

What this check verifies

AWS DMS MongoDB endpoints use an authentication mechanism. Configuration expects AuthType not no (e.g., password) with an authMechanism such as scram_sha_1 or mongodb_cr.

Risk

Without authentication, unauthenticated connections can access the source, degrading confidentiality and integrity. Adversaries could read or modify migrated documents, hijack CDC, inject data, or exfiltrate records during replication.

Recommendation

Enforce strong authentication on MongoDB endpoints: set AuthType to password and use authMechanism like scram_sha_1. Apply least privilege database accounts, store secrets in Secrets Manager, and pair with TLS for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dms modify-endpoint --endpoint-arn <endpoint-arn> --mongodb-settings '{"AuthType":"password"}' --username <username> --password <password>

# Terraform: enable authentication on a MongoDB DMS endpoint
resource "aws_dms_endpoint" "<example_resource_name>" {
  endpoint_id   = "<example_resource_name>"
  endpoint_type = "source"
  engine_name   = "mongodb"

  mongodb_settings {
    auth_type = "password"  # CRITICAL: enables authentication for the MongoDB endpoint
  }
}

# CloudFormation: enable authentication on a MongoDB DMS endpoint
Resources:
  <example_resource_name>:
    Type: AWS::DMS::Endpoint
    Properties:
      EndpointIdentifier: <example_resource_name>
      EndpointType: source
      EngineName: mongodb
      MongoDbSettings:
        AuthType: password  # CRITICAL: sets authentication mode to 'password' so auth is enabled

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_endpoint_mongodb_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Region with EBS snapshots has a snapshot lifecycle policy DMS endpoint for Neptune has IAM authorization enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires