Check ID: dms_replication_task_target_logging_enabled
Provider: AWS
Service: dms
Severity: MEDIUM
Categories: logging
Resource type: AwsDmsReplicationTask
What this check verifies
AWS DMS replication tasks have target logging enabled, including TARGET_APPLY and TARGET_LOAD, each set to at least LOGGER_SEVERITY_DEFAULT.
Risk
Insufficient target logging limits visibility into load/apply activity, masking failures and anomalies. This risks data integrity (silent drift, partial loads) and availability (longer incident resolution), and reduces auditability of migration events.
Recommendation
Enable and maintain CloudWatch logging at LOGGER_SEVERITY_DEFAULT or higher for target components:
- Configure
TARGET_APPLY and TARGET_LOAD
- Enforce least-privilege log access
- Monitor logs/alerts for anomalies
- Standardize task settings and validate data for defense in depth
CLI
Terraform
Native IaC
Dashboard steps
aws dms modify-replication-task --replication-task-arn <task-arn> --replication-task-settings '{"Logging":{"EnableLogging":true,"LogComponents":[{"Id":"TARGET_APPLY","Severity":"LOGGER_SEVERITY_DEFAULT"},{"Id":"TARGET_LOAD","Severity":"LOGGER_SEVERITY_DEFAULT"}]}}'
# Enable DMS task logging for target components
resource "aws_dms_replication_task" "<example_resource_name>" {
replication_task_id = "<example_resource_id>"
replication_instance_arn = "<example_resource_arn>"
source_endpoint_arn = "<example_resource_arn>"
target_endpoint_arn = "<example_resource_arn>"
migration_type = "full-load"
table_mappings = jsonencode({ rules = [{
"rule-type" : "selection", "rule-id" : "1", "rule-name" : "1",
"object-locator" : { "schema-name" : "%", "table-name" : "%" },
"rule-action" : "include"
}]} )
# Critical: enables logging and sets TARGET_APPLY and TARGET_LOAD to minimum required severity
replication_task_settings = jsonencode({
Logging = {
EnableLogging = true
LogComponents = [
{ Id = "TARGET_APPLY", Severity = "LOGGER_SEVERITY_DEFAULT" },
{ Id = "TARGET_LOAD", Severity = "LOGGER_SEVERITY_DEFAULT" }
]
}
})
}
# CloudFormation: enable DMS task logging for target components
Resources:
<example_resource_name>:
Type: AWS::DMS::ReplicationTask
Properties:
ReplicationInstanceArn: <example_resource_arn>
SourceEndpointArn: <example_resource_arn>
TargetEndpointArn: <example_resource_arn>
MigrationType: full-load
TableMappings: |
{"rules":[{"rule-type":"selection","rule-id":"1","rule-name":"1","object-locator":{"schema-name":"%","table-name":"%"},"rule-action":"include"}]}
ReplicationTaskSettings: |
{"Logging":{"EnableLogging":true, "LogComponents":[
{"Id":"TARGET_APPLY","Severity":"LOGGER_SEVERITY_DEFAULT"}, # Critical: ensure TARGET_APPLY logging at default
{"Id":"TARGET_LOAD","Severity":"LOGGER_SEVERITY_DEFAULT"} # Critical: ensure TARGET_LOAD logging at default
]}}
- Open the AWS DMS console and go to Database migration tasks
- Select the replication task and choose Modify
- Expand Task settings (JSON) or Logging
- Enable CloudWatch logs (EnableLogging = true)
- Set log components:
- TARGET_APPLY severity: DEFAULT
- TARGET_LOAD severity: DEFAULT
- Save changes (Modify task), then rerun the task if required
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dms_replication_task_target_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks
