Terraform AWS DMS

Database Migration Service replication instances, source and target endpoints, replication tasks, subnet groups, logging, and controlled network placement for data migration.

Controls enforced

These compliance controls are checked at terraform plan time.

Quick start

module "dms" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

module "dms" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

module "dms" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

module "dms" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

module "dms" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

module "dms" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

module "dms" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

module "dms" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "dms" {
  source  = "terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"
}

module "dms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/dms/aws"
  version = ">= 2.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "dms" {
  source  = "terraform-aws-modules/dms/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

ACSC-EE-ML3-8.8: Regular backups ML3

DMS replication instances should not be publicly accessible

11.10(d) Limiting system access to authorized individuals

DMS replication instances should not be publicly accessible

3.3 Configure Data Access Control Lists

DMS replication instances should not be publicly accessible

Your Data-2

DMS replication instances should not be publicly accessible

12.1 Security

DMS replication instances should not be publicly accessible

Boundary Protection (SC-7)

DMS replication instances should not be publicly accessible

1 controls from this module are active under FedRAMP Moderate Baseline Rev 4.

D3.PC.Im.B.1

DMS replication instances should not be publicly accessible

Framework coverage

Which controls from this module are active under each framework endpoint.

Control	FedRAMP Moderate Baseline Rev 4	Controls v8.0 IG1	CISA Cyber Essentials	ACSC Essential Eight	Title 21 CFR Part 11	EU GMP Annex 11	FedRAMP Low Baseline Rev 4	FFIEC Cybersecurity Assessment Tool
DMS replication instances should have automatic minor version upgrade enabled	○	○	○	○	○	○	○	○
Dms Replication Instance Encryption Enabled	○	○	○	○	○	○	○	○
DMS replication instances should not be publicly accessible	○	●	●	●	●	●	●	●

● enforced by default · ○ not activated by this endpoint