Back to Checks
aws

DMS endpoint for Neptune has IAM authorization enabled

dms_endpoint_neptune_iam_authorization_enabled
Service: dmsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsDmsEndpoint

DMS Neptune endpoints have IAM authorization enabled via the endpoint setting IamAuthEnabled.

Prowler logoProwlerprowler-provider-aws

Risk

Without IAM authorization, migration components can interact with Neptune using broad trust, enabling unauthorized data loads, reads, or alterations.

This degrades confidentiality and integrity and increases the chance of privilege abuse and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dms_endpoint_neptune_iam_authorization_enabled

Recommendation

Enable IAM authorization on Neptune endpoints (IamAuthEnabled=true) and use a least privilege service role limited to minimal Neptune and S3 permissions.

Apply defense in depth: restrict network paths, separate duties for migration roles, and monitor access with logs and alerts.

Remediation

CLI

aws dms modify-endpoint --endpoint-arn <endpoint-arn> --neptune-settings '{"IamAuthEnabled":true}'

NativeIaC

# CloudFormation: Enable IAM authorization on a DMS Neptune endpoint
Resources:
  <example_resource_name>:
    Type: AWS::DMS::Endpoint
    Properties:
      EndpointType: target
      EngineName: neptune
      NeptuneSettings:
        ServiceAccessRoleArn: <example_resource_arn>
        S3BucketName: <example_resource_name>
        S3BucketFolder: <example_resource_name>
        IamAuthEnabled: true  # Critical: enables IAM authorization for the Neptune endpoint

Other

1In the AWS Console, go to Database Migration Service > Endpoints
2Select the Neptune endpoint and click Modify
3Expand Endpoint settings (Neptune settings) and set IAM authorization to Enabled
4Ensure Service access role ARN is set, then click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dms.dms_client import dms_client


class dms_endpoint_neptune_iam_authorization_enabled(Check):
    """
    Check if AWS DMS Endpoints for Neptune have IAM authorization enabled.

    This class verifies whether each AWS DMS Endpoint configured for Neptune has IAM authorization enabled
    by checking the `NeptuneSettings.IamAuthEnabled` property in the endpoint's configuration.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """
        Execute the DMS Neptune IAM authorization enabled check.

        Iterates over all DMS Endpoints and generates a report indicating whether
        each Neptune endpoint has IAM authorization enabled.

        Returns:
            List[Check_Report_AWS]: A list of report objects with the results of the check.
        """
        findings = []
        for endpoint in dms_client.endpoints.values():
            if endpoint.engine_name == "neptune":
                report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
                report.status = "FAIL"
                report.status_extended = f"DMS Endpoint {endpoint.id} for Neptune databases does not have IAM authorization enabled."
                if endpoint.neptune_iam_auth_enabled:
                    report.status = "PASS"
                    report.status_extended = f"DMS Endpoint {endpoint.id} for Neptune databases has IAM authorization enabled."

                findings.append(report)

        return findings

References