Back to Checks
aws

DMS endpoint for Redis OSS is encrypted in transit

dms_endpoint_redis_in_transit_encryption_enabled
Service: dmsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsDmsEndpoint

DMS Redis OSS endpoints are assessed for the presence of TLS in their endpoint settings, such as ssl-encryption, indicating encrypted connections between the DMS replication instance and Redis.

Prowler logoProwlerprowler-provider-aws

Risk

Without TLS, traffic between DMS and Redis can be intercepted or altered, compromising confidentiality and integrity.

Attackers can perform man-in-the-middle interception, steal auth tokens, and inject or corrupt migrated data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dms_endpoint_redis_in_transit_encryption_enabled

Recommendation

Enable TLS on Redis OSS endpoints (e.g., ssl-encryption) and require server certificate validation. Prohibit plaintext connections, prefer private networking, and enforce least privilege for DMS roles to strengthen defense in depth.

Remediation

Terraform

# Enable TLS for Redis OSS DMS endpoint
resource "aws_dms_endpoint" "<example_resource_name>" {
  endpoint_id   = "<example_resource_id>"
  endpoint_type = "target"
  engine_name   = "redis"

  redis_settings {
    server_name           = "<example_resource_name>"
    port                  = 6379
    auth_type             = "none"
    ssl_security_protocol = "ssl-encryption" # Critical: enables TLS for in-transit encryption
  }
}

NativeIaC

# CloudFormation: Enable TLS for Redis OSS DMS endpoint
Resources:
  <example_resource_name>:
    Type: AWS::DMS::Endpoint
    Properties:
      EndpointIdentifier: <example_resource_name>
      EndpointType: target
      EngineName: redis
      RedisSettings:
        ServerName: <example_resource_name>
        Port: 6379
        AuthType: none
        SslSecurityProtocol: ssl-encryption  # Critical: enables TLS for in-transit encryption

Other

1In the AWS Console, go to Database Migration Service > Endpoints
2Select the Redis OSS endpoint and click Modify
3Set SSL security protocol (Encryption in transit) to "SSL encryption"
4Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dms.dms_client import dms_client


class dms_endpoint_redis_in_transit_encryption_enabled(Check):
    """
    Check if AWS DMS Endpoints for Redis OSS have TLS enabled.

    This class verifies whether each AWS DMS Endpoint configured for Redis OSS is encrypted in transit
    by checking the `TlsEnabled` property in the endpoint's configuration. The check ensures that
    TLS is enabled to secure data in transit, preventing unauthorized access and ensuring data integrity.
    """

    def execute(self) -> List[Check_Report_AWS]:
        """
        Execute the DMS Redis TLS enabled check.

        Iterates over all DMS Endpoints and generates a report indicating whether
        each Redis OSS endpoint is encrypted in transit.

        Returns:
            List[Check_Report_AWS]: A list of report objects with the results of the check.
        """
        findings = []
        for endpoint in dms_client.endpoints.values():
            if endpoint.engine_name == "redis":
                report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)
                report.status = "FAIL"
                report.status_extended = f"DMS Endpoint {endpoint.id} for Redis OSS is not encrypted in transit."
                if endpoint.redis_ssl_protocol == "ssl-encryption":
                    report.status = "PASS"
                    report.status_extended = f"DMS Endpoint {endpoint.id} for Redis OSS is encrypted in transit."

                findings.append(report)

        return findings

References