DMS endpoints should use SSL¶

This control checks whether an AWS DMS endpoint uses an SSL connection. The control fails if the endpoint doesn't use SSL.

How to fix¶

Attribute ssl_mode of aws_dms_endpoint must be one of: "require", "verify-ca", "verify-full".

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_dms_endpoint.

resource "aws_dms_endpoint" "this" {
  endpoint_id   = "pofix-example-endpoint"
  endpoint_type = "source"
  engine_name   = "mysql"

  redis_settings {
    auth_type   = "none"
    port        = 6379
    server_name = "redis.example.com"
  }

  ssl_mode = "require"
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: dms_endpoint_ssl_configured

• AWS Config Managed Rule: DMS_ENDPOINT_SSL_CONFIGURED

• Checkov Check: CKV2_AWS_49

• Powerpipe Control: aws_compliance.control.dms_endpoint_ssl_configured