Terraform AWS DMS

Database Migration Service replication instances, source and target endpoints, replication tasks, subnet groups, logging, and controlled network placement for data migration.

Quick start

module "dms" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

module "dms" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

module "dms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

module "dms" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

module "dms" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

module "dms" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

module "dms" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

module "dms" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "dms" {
  source  = "terraform-aws-modules/dms/aws"
  version = "~> 2.6"
}

module "dms" {
  source  = "soc2.compliance.tf/terraform-aws-modules/dms/aws"
  version = "~> 2.6"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "dms" {
  source  = "terraform-aws-modules/dms/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 5 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
DMS endpoints for MongoDB should have an authentication mechanism enabled	Low
DMS endpoints should use SSL	Low
DMS replication instances should have automatic minor version upgrade enabled	Low
DMS replication instances should specify a KMS key for storage encryption	Not rated
DMS replication instances should not be publicly accessible	Low

Mapped compliance frameworks

Clause	Controls from this module
PR.DS-2	DMS endpoints should use SSL

Clause	Controls from this module
2.2.7: System components are configured and managed securely.	DMS endpoints should use SSL
4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained	DMS endpoints should use SSL
4.2.1: PAN is protected with strong cryptography during transmission.	DMS endpoints should use SSL
8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components	DMS endpoints should use SSL

Clause	Controls from this module
CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives	DMS replication instances should specify a KMS key for storage encryption
CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.	DMS replication instances should not be publicly accessible

Clause	Controls from this module
ACSC-EE-ML3-8.8: Regular backups ML3	DMS replication instances should not be publicly accessible

Clause	Controls from this module
11.10(d) Limiting system access to authorized individuals	DMS replication instances should not be publicly accessible

Clause	Controls from this module
3.3 Configure Data Access Control Lists	DMS replication instances should not be publicly accessible

Clause	Controls from this module
Your Data-2	DMS replication instances should not be publicly accessible

Clause	Controls from this module
12.1 Security	DMS replication instances should not be publicly accessible

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	PCI DSS v4.0	SOC 2
DMS endpoints for MongoDB should have an authentication mechanism enabled	Not active	Not active
DMS endpoints should use SSL	Enforced	Not active
DMS replication instances should have automatic minor version upgrade enabled	Not active	Not active
DMS replication instances should specify a KMS key for storage encryption	Not active	Enforced
DMS replication instances should not be publicly accessible	Not active	Enforced

5 controls enforced with a source URL change.

Start free trial Get started