DMS endpoint for Neptune has IAM authorization enabled

Check ID: dms_endpoint_neptune_iam_authorization_enabled
Provider: AWS
Service: dms
Severity: MEDIUM
Categories: identity-access
Resource type: AwsDmsEndpoint

What this check verifies

DMS Neptune endpoints have IAM authorization enabled via the endpoint setting IamAuthEnabled.

Risk

Without IAM authorization, migration components can interact with Neptune using broad trust, enabling unauthorized data loads, reads, or alterations. This degrades confidentiality and integrity and increases the chance of privilege abuse and data exfiltration.

Recommendation

Enable IAM authorization on Neptune endpoints (IamAuthEnabled=true) and use a least privilege service role limited to minimal Neptune and S3 permissions. Apply defense in depth: restrict network paths, separate duties for migration roles, and monitor access with logs and alerts.

Remediation

CLI
Native IaC
Dashboard steps

aws dms modify-endpoint --endpoint-arn <endpoint-arn> --neptune-settings '{"IamAuthEnabled":true}'

# CloudFormation: Enable IAM authorization on a DMS Neptune endpoint
Resources:
  <example_resource_name>:
    Type: AWS::DMS::Endpoint
    Properties:
      EndpointType: target
      EngineName: neptune
      NeptuneSettings:
        ServiceAccessRoleArn: <example_resource_arn>
        S3BucketName: <example_resource_name>
        S3BucketFolder: <example_resource_name>
        IamAuthEnabled: true  # Critical: enables IAM authorization for the Neptune endpoint

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_endpoint_neptune_iam_authorization_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DMS MongoDB endpoint has an authentication mechanism enabled DMS endpoint for Redis OSS is encrypted in transit

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires