DMS endpoint has SSL enabled

Check ID: dms_endpoint_ssl_enabled
Provider: AWS
Service: dms
Severity: HIGH
Categories: encryption
Resource type: AwsDmsEndpoint

What this check verifies

AWS DMS endpoints have their SSL/TLS mode inspected; any value other than none denotes encrypted connections between the replication instance and databases. Supported modes include require, verify-ca, and verify-full.

Risk

Without TLS, data in transit can be read or altered, affecting:

Confidentiality via packet sniffing and credential leakage
Integrity through MITM tampering of migration streams
Availability from session hijack or task disruption

Recommendation

Configure endpoints to use SSL/TLS at least require; prefer verify-ca or verify-full where supported. Manage trusted CA material and rotate regularly. Apply defense in depth with private connectivity and strict IAM, and enforce this posture via policy-as-code and continuous validation.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dms modify-endpoint —endpoint-arn <endpoint-arn> —ssl-mode require

# Terraform: Set SSL on a DMS endpoint
resource "aws_dms_endpoint" "<example_resource_name>" {
  endpoint_id   = "<example_resource_name>"
  endpoint_type = "source"
  engine_name   = "sqlserver"
  server_name   = "<server_name>"
  port          = 1433
  username      = "<username>"
  password      = "<password>"

  ssl_mode = "require" # CRITICAL: enables SSL (not "none"), fixing the finding
}

# CloudFormation: Set SSL on a DMS endpoint
Resources:
  <example_resource_name>:
    Type: AWS::DMS::Endpoint
    Properties:
      EndpointIdentifier: <example_resource_name>
      EndpointType: source
      EngineName: sqlserver
      ServerName: <server_name>
      Port: 1433
      Username: <username>
      Password: <password>
      SslMode: require  # CRITICAL: enables SSL (not "none"), fixing the finding

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_endpoint_ssl_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DMS endpoint for Redis OSS is encrypted in transit DMS replication instance auto-upgrades minor versions

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires