DMS replication instance is not Internet-exposed

​

What this check verifies

​

Risk

• Confidentiality: migration data and credentials can be intercepted or exfiltrated.
• Integrity: attackers may alter tasks or inject records.
• Availability: abuse or DDoS can stall replication and delay cutovers.

​

Recommendation

• Disable PubliclyAccessible; place instances in private subnets.
• Enforce least privilege security groups (no 0.0.0.0/0); allow only required sources/ports.
• Provide access via VPN, peering, or Direct Connect.
• Layer controls (ACLs, monitoring) and restrict IAM to necessary actions.

​

Remediation

# DMS instance not publicly accessible
resource "aws_dms_replication_instance" "<example_resource_name>" {
  replication_instance_id    = "<example_resource_id>"
  replication_instance_class = "dms.t3.micro"
  publicly_accessible        = false  # Critical: disables public access to prevent Internet exposure
}

# CloudFormation: DMS instance not publicly accessible
Resources:
  <example_resource_name>:
    Type: AWS::DMS::ReplicationInstance
    Properties:
      ReplicationInstanceClass: dms.t3.micro
      PubliclyAccessible: false  # Critical: disables public access to prevent Internet exposure

​

References

• https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html#dms-1
• https://docs.aws.amazon.com/amazonq/detector-library/terraform/restrict-public-access-dms-terraform/
• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/DMS/publicly-accessible.html
• https://support.icompaas.com/support/solutions/articles/62000233448-ensure-dms-instances-are-not-publicly-accessible

​

Where this check fires