Check ID: dms_endpoint_redis_in_transit_encryption_enabled
Provider: AWS
Service: dms
Severity: MEDIUM
Categories: encryption
Resource type: AwsDmsEndpoint

​
What this check verifies

DMS Redis OSS endpoints are assessed for the presence of TLS in their endpoint settings, such as ssl-encryption, indicating encrypted connections between the DMS replication instance and Redis.

​
Risk

Without TLS, traffic between DMS and Redis can be intercepted or altered, compromising confidentiality and integrity. Attackers can perform man-in-the-middle interception, steal auth tokens, and inject or corrupt migrated data.

​
Recommendation

Enable TLS on Redis OSS endpoints (e.g., ssl-encryption) and require server certificate validation. Prohibit plaintext connections, prefer private networking, and enforce least privilege for DMS roles to strengthen defense in depth.

​
Remediation

# Enable TLS for Redis OSS DMS endpoint
resource "aws_dms_endpoint" "<example_resource_name>" {
  endpoint_id   = "<example_resource_id>"
  endpoint_type = "target"
  engine_name   = "redis"

  redis_settings {
    server_name           = "<example_resource_name>"
    port                  = 6379
    auth_type             = "none"
    ssl_security_protocol = "ssl-encryption" # Critical: enables TLS for in-transit encryption
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_endpoint_redis_in_transit_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks