Skip to content

Terraform AWS DMS

Database Migration Service replication instances, source and target endpoints, replication tasks, subnet groups, logging, and controlled network placement for data migration.

3 controls enforced16 frameworks

Controls Enforced

The following compliance controls are enforced by this module at terraform plan time.

Quick Start

module "dms" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "awscontroltower.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "awsgenai.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "cisv140.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "cis.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "gdpr.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "nis2.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

module "dms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/dms/aws"
  version = "<version>"

  # ... your arguments here
}

See the Get Started guide to get started and read the Features section for more details on how to customize the module for your requirements.

Migration from Upstream

Already using terraform-aws-modules? Change only the source URL:

module "dms" {
  source  = "terraform-aws-modules/dms/aws"
  version = "1.0"
}

module "dms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/dms/aws"
  version = "1.0"
}

Same arguments. Same outputs. Compliance controls are enforced automatically at terraform plan. If a required value is missing, you get a clear validation error telling you what to set.

See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL to the upstream path:

module "dms" {
  source  = "terraform-aws-modules/dms/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

ACSC-EE-ML3-8.8: Regular backups ML3

11.10(k) Use of appropriate controls over systems documentation that includes adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance

3.3 Configure Data Access Control Lists

Your Data-2

Boundary Protection (SC-7)

D3.PC.Im.B.1

164.312(e)(1) Transmission security

PR.AC-3

500.07 Access Privileges and Management

1.2.8: Network security controls (NSCs) are configured and maintained.

1.3.1: Network access to and from the cardholder data environment is restricted.

1.3.2: Network access to and from the cardholder data environment is restricted.

1.4.2: Network connections between trusted and untrusted networks are controlled.

1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks

1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.

3.5.1.3: Primary account number (PAN) is secured wherever it is stored.

10.3.2: Audit logs are protected from destruction and unauthorized modifications.

A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.

A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.

A3.4.1: Logical access to the cardholder data environment is controlled and managed.

Annex I (1.3)

8.I Basic Security Aspects

CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.

Framework Coverage

Which controls from this module are active under each framework endpoint. ● enforced by default · ○ not activated by this endpoint

ControlACSC Essential EightTitle 21 CFR Part 11CIS Controls v8.0 IG1CISA Cyber EssentialsFedRAMP Low Baseline Rev 4FedRAMP Moderate Baseline Rev 4FFIEC Cybersecurity Assessment ToolHIPAA Omnibus Rule 2013
DMS replication instances should have automatic minor version upgrade enabled○○○○○○○○
Dms Replication Instance Encryption Enabled○○○○○○○○
DMS replication instances should not be publicly accessible●●●●●●●●

Showing top 8 frameworks by coverage. All framework endpoints →