DMS endpoints should require SSL/TLS

dms

Description

This control verifies if an AWS DMS endpoint is configured to use an SSL connection. The ssl_mode of the endpoint must set to either require, verify-ca or verify-full.

SSL/TLS connections enhance security by encrypting data exchanged between DMS replication instances and your database. Additionally, using certificates adds another layer of protection by ensuring the connection is established with the intended database through server certificate validation. The server certificate is automatically installed on all provisioned database instances. Enabling SSL on your DMS endpoints ensures data confidentiality during migration.

Remediation

For guidance on configuring SSL for DMS endpoints, please refer to the Using SSL with AWS Database Migration Service section of the AWS Database Migration Service User Guide.