# Ensure Authentication Mechanism Is Enabled for DMS Endpoints for MongoDB - Source: https://support.icompaas.com/support/solutions/articles/62000233440-ensure-authentication-mechanism-is-enabled-for-dms-endpoints-for-mongodb - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability** - **Level 2** #### **Description** Authentication mechanisms for MongoDB endpoints in AWS Database Migration Service (DMS) ensure that only authorized users can access the database during migration tasks. Enabling authentication mechanisms, such as SCRAM-SHA-1 or SCRAM-SHA-256, helps secure the connection and prevents unauthorized access to sensitive data. #### **Rationale** - Enhanced Security: Ensures that only authenticated users can access the MongoDB database. - Risk Mitigation: Reduces the risk of unauthorized access and data breaches. - Compliance: Aligns with security best practices and regulatory requirements. #### **Impact** **Pros:** - Protects sensitive data by requiring valid credentials for access. - Reduces the risk of unauthorized access during migration tasks. - Enhances overall security posture. **Cons:** - Requires proper configuration of authentication mechanisms on the MongoDB database. - May introduce complexity if credentials are not managed securely. #### **Default Value** By default, authentication mechanisms may not be enabled for MongoDB endpoints. They must be explicitly configured during endpoint creation or modification. #### **Pre-Requisite** IAM Permissions Required: - dms:DescribeEndpoints - dms:ModifyEndpoint - AWS CLI installed and configured. #### **Remediation** **Test Plan:** **Using AWS Console:** 1. Sign in to the AWS Management Console. 2. Navigate to Database Migration Service (DMS) > Endpoints. 3. Select the MongoDB endpoint and review its configuration. 4. Verify if an authentication mechanism, such as SCRAM-SHA-1 or SCRAM-SHA-256, is enabled. **Using AWS CLI:** 1. Describe the DMS endpoint: aws dms describe-endpoints --filters Name=endpoint-type,Values=source 2. Check the AuthMechanism field in the output. Ensure it is set to SCRAM-SHA-1 or SCRAM-SHA-256. **Implementation Steps:** **Using AWS Console:** 1. Navigate to Database Migration Service (DMS) > Endpoints. 2. Select the MongoDB endpoint to update. 3. Edit the endpoint configuration and set the Authentication Mechanism to SCRAM-SHA-1 or SCRAM-SHA-256. 4. Save the changes. **Using AWS CLI:** 1. Modify the DMS endpoint to enable an authentication mechanism: aws dms modify-endpoint \\ --endpoint-arn \\ --auth-mechanism SCRAM-SHA-256 \\ --username \\ --password 2. Verify the updated configuration: aws dms describe-endpoints --filters Name=endpoint-type,Values=source #### **Backout Plan** #### **Using AWS Console:** 1. #### If enabling authentication causes issues, sign in to the AWS Management Console. 2. #### Navigate to AWS DMS, select the MongoDB endpoint, and go to the Modify Endpoint settings. 3. #### Remove or disable the authentication mechanism by clearing the Authentication Mechanism field or using a different authentication method. 4. #### Save the changes and verify that the endpoint is now working without the authentication configuration. #### **Using AWS CLI:** 1. #### To remove the authentication mechanism, run the following command: aws dms modify-endpoint --endpoint-arn --mongodb-settings '{ "AuthenticationMechanism": "NONE" }' 2. #### Verify that the authentication mechanism has been removed by running: aws dms describe-endpoints --endpoint-arn #### **References** - [Using MongoDB as a Source for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MongoDB.html) - [Create Source and Target Endpoints for MongoDB Migration](https://docs.aws.amazon.com/dms/latest/sbs/chap-mongodb2documentdb.04.html) - [AWS DMS Security Best Practices](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html) #### **CIS Controls**

Version	Control ID	Control Description	IG1	IG2	IG3
v8	5.3	Securely Manage Network Infrastructure – Ensure network devices are resilient and fault-tolerant.	●	●	●
v8	13.2	Ensure Secure Network Communication – Implement measures that prevent disruption during network changes.	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.