DMS replication task logs SOURCE_CAPTURE and SOURCE_UNLOAD

Check ID: dms_replication_task_source_logging_enabled
Provider: AWS
Service: dms
Severity: MEDIUM
Categories: logging
Resource type: AwsDmsReplicationTask

What this check verifies

AWS DMS replication tasks have logging enabled and configure SOURCE_CAPTURE and SOURCE_UNLOAD with severity at least LOGGER_SEVERITY_DEFAULT (or higher: LOGGER_SEVERITY_DEBUG, LOGGER_SEVERITY_DETAILED_DEBUG).

Risk

Missing or low-severity source logs hinder visibility into CDC and full-load activity, risking undetected errors, stalls, or tampering. This can cause silent data drift, broken lineage, and failed recoveries, undermining integrity and availability and weakening auditability during investigations.

Recommendation

Enable and standardize task logging for SOURCE_CAPTURE and SOURCE_UNLOAD at LOGGER_SEVERITY_DEFAULT or higher.

Centralize logs and alert on anomalies
Enforce least privilege for log access
Set retention to support audits
Avoid prolonged DEBUG levels, except during troubleshooting, to balance visibility and cost

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dms modify-replication-task --replication-task-arn <example_resource_arn> --replication-task-settings '{"Logging":{"EnableLogging":true,"LogComponents":[{"Id":"SOURCE_CAPTURE","Severity":"LOGGER_SEVERITY_DEFAULT"},{"Id":"SOURCE_UNLOAD","Severity":"LOGGER_SEVERITY_DEFAULT"}]}}'

# Enable DMS source logging at minimum DEFAULT severity
resource "aws_dms_replication_task" "<example_resource_name>" {
  replication_instance_arn = "<example_resource_arn>"
  source_endpoint_arn      = "<example_resource_arn>"
  target_endpoint_arn      = "<example_resource_arn>"
  migration_type           = "full-load"
  table_mappings           = "{\"rules\":[]}"

  # Critical: Enables logging and sets SOURCE components to at least DEFAULT
  replication_task_settings = <<JSON
{
  "Logging": {
    "EnableLogging": true,
    "LogComponents": [
      {"Id": "SOURCE_CAPTURE", "Severity": "LOGGER_SEVERITY_DEFAULT"},
      {"Id": "SOURCE_UNLOAD", "Severity": "LOGGER_SEVERITY_DEFAULT"}
    ]
  }
}
JSON
}

# CloudFormation: enable DMS source logging at minimum DEFAULT severity
Resources:
  <example_resource_name>:
    Type: AWS::DMS::ReplicationTask
    Properties:
      ReplicationInstanceArn: <example_resource_arn>
      SourceEndpointArn: <example_resource_arn>
      TargetEndpointArn: <example_resource_arn>
      MigrationType: full-load
      TableMappings: '{"rules":[]}'
      # Critical: Enables logging and sets SOURCE components to at least DEFAULT
      ReplicationTaskSettings: |
        {
          "Logging": {
            "EnableLogging": true,
            "LogComponents": [
              {"Id": "SOURCE_CAPTURE", "Severity": "LOGGER_SEVERITY_DEFAULT"},
              {"Id": "SOURCE_UNLOAD", "Severity": "LOGGER_SEVERITY_DEFAULT"}
            ]
          }
        }

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_replication_task_source_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DMS replication instance is not Internet-exposed DMS replication task logs TARGET_APPLY and TARGET_LOAD

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires