Back to Checks
aws

DMS endpoint has SSL enabled

dms_endpoint_ssl_enabled
Service: dmsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsDmsEndpoint

AWS DMS endpoints have their SSL/TLS mode inspected; any value other than none denotes encrypted connections between the replication instance and databases.

Supported modes include require, verify-ca, and verify-full.

Prowler logoProwlerprowler-provider-aws

Risk

Without TLS, data in transit can be read or altered, affecting:

  • Confidentiality via packet sniffing and credential leakage
  • Integrity through MITM tampering of migration streams
  • Availability from session hijack or task disruption

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dms_endpoint_ssl_enabled

Recommendation

Configure endpoints to use SSL/TLS at least require; prefer verify-ca or verify-full where supported. Manage trusted CA material and rotate regularly. Apply defense in depth with private connectivity and strict IAM, and enforce this posture via policy-as-code and continuous validation.

Remediation

CLI

aws dms modify-endpoint --endpoint-arn <endpoint-arn> --ssl-mode require

Terraform

# Terraform: Set SSL on a DMS endpoint
resource "aws_dms_endpoint" "<example_resource_name>" {
  endpoint_id   = "<example_resource_name>"
  endpoint_type = "source"
  engine_name   = "sqlserver"
  server_name   = "<server_name>"
  port          = 1433
  username      = "<username>"
  password      = "<password>"

  ssl_mode = "require" # CRITICAL: enables SSL (not "none"), fixing the finding
}

NativeIaC

# CloudFormation: Set SSL on a DMS endpoint
Resources:
  <example_resource_name>:
    Type: AWS::DMS::Endpoint
    Properties:
      EndpointIdentifier: <example_resource_name>
      EndpointType: source
      EngineName: sqlserver
      ServerName: <server_name>
      Port: 1433
      Username: <username>
      Password: <password>
      SslMode: require  # CRITICAL: enables SSL (not "none"), fixing the finding

Other

1In the AWS DMS console, go to Endpoints
2Select the non-compliant endpoint and choose Modify
3Set SSL mode to Require (or Verify-ca/Verify-full if required by your engine and certificate is available)
4If Verify-ca/Verify-full is selected, choose the appropriate CA certificate
5Save changes, then Test connection to confirm

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dms.dms_client import dms_client


class dms_endpoint_ssl_enabled(Check):
    def execute(self):
        findings = []
        for endpoint in dms_client.endpoints.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=endpoint)

            if endpoint.ssl_mode == "none":
                report.status = "FAIL"
                report.status_extended = f"DMS Endpoint {endpoint.id} is not using SSL."
            else:
                report.status = "PASS"
                report.status_extended = f"DMS Endpoint {endpoint.id} is using SSL with mode: {endpoint.ssl_mode}."

            findings.append(report)

        return findings

References