Back to Checks
aws

DMS MongoDB endpoint has an authentication mechanism enabled

dms_endpoint_mongodb_authentication_enabled
Service: dmsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsDmsEndpoint

AWS DMS MongoDB endpoints use an authentication mechanism. Configuration expects AuthType not no (e.g., password) with an authMechanism such as scram_sha_1 or mongodb_cr.

Prowler logoProwlerprowler-provider-aws

Risk

Without authentication, unauthenticated connections can access the source, degrading confidentiality and integrity. Adversaries could read or modify migrated documents, hijack CDC, inject data, or exfiltrate records during replication.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dms_endpoint_mongodb_authentication_enabled

Recommendation

Enforce strong authentication on MongoDB endpoints: set AuthType to password and use authMechanism like scram_sha_1. Apply least privilege database accounts, store secrets in Secrets Manager, and pair with TLS for defense in depth.

Remediation

CLI

aws dms modify-endpoint --endpoint-arn <endpoint-arn> --mongodb-settings '{"AuthType":"password"}' --username <username> --password <password>

Terraform

# Terraform: enable authentication on a MongoDB DMS endpoint
resource "aws_dms_endpoint" "<example_resource_name>" {
  endpoint_id   = "<example_resource_name>"
  endpoint_type = "source"
  engine_name   = "mongodb"

  mongodb_settings {
    auth_type = "password"  # CRITICAL: enables authentication for the MongoDB endpoint
  }
}

NativeIaC

# CloudFormation: enable authentication on a MongoDB DMS endpoint
Resources:
  <example_resource_name>:
    Type: AWS::DMS::Endpoint
    Properties:
      EndpointIdentifier: <example_resource_name>
      EndpointType: source
      EngineName: mongodb
      MongoDbSettings:
        AuthType: password  # CRITICAL: sets authentication mode to 'password' so auth is enabled

Other

1In the AWS Console, go to Database Migration Service > Endpoints
2Select the MongoDB endpoint and click Modify
3Under MongoDB settings, set Authentication mode to Password
4Enter Username and Password
5Click Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dms.dms_client import dms_client


class dms_endpoint_mongodb_authentication_enabled(Check):
    """
    Check if AWS DMS Endpoints for MongoDB have an authentication mechanism enabled.

    This class verifies whether each AWS DMS Endpoint configured for MongoDB has an authentication
    mechanism enabled by checking the `AuthType` property in the endpoint's configuration. The check
    ensures that the `AuthType` is not set to "no", indicating that an authentication method is in place.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """
        Execute the DMS MongoDB authentication type configured check.

        Iterates over all DMS Endpoints and generates a report indicating whether
        each MongoDB endpoint has an authentication mechanism enabled.

        Returns:
            List[Check_Report_AWS]: A list of report objects with the results of the check.
        """
        findings = []
        for endpoint in dms_client.endpoints.values():
            if endpoint.engine_name == "mongodb":
                report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
                report.status = "FAIL"
                report.status_extended = f"DMS Endpoint '{endpoint.id}' for MongoDB does not have an authentication mechanism enabled."
                if endpoint.mongodb_auth_type != "no":
                    report.status = "PASS"
                    report.status_extended = f"DMS Endpoint '{endpoint.id}' for MongoDB has {endpoint.mongodb_auth_type} as the authentication mechanism."

                findings.append(report)

        return findings

References