DMS replication instance should not be publicly accessible

What it checks

DMS replication instance: public address capability is enabled or not explicitly disabled.

Where it applies

Terraform: aws_dms_replication_instance

CloudFormation: AWS::DMS::ReplicationInstance

How to fix it

1. Set publicly_accessible = false and place the replication instance in private subnets. It reaches source/target databases over the VPC (or VPC peering / VPN), not the public internet. publicly_accessible is set at creation, so an existing public instance must be recreated.

Frameworks

• NIST 800-53 rev5 SC-7
• SOC 2 CC6.6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules