# Ensure Logging Is Enabled for DMS Replication Tasks (Source Database)

- Source: https://support.icompaas.com/support/solutions/articles/62000233446-ensure-logging-is-enabled-for-dms-replication-tasks-source-database-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability**

-   **Level 2**

#### **Description**

AWS Database Migration Service (DMS) replication tasks can log activity and diagnostic information for the source database, enabling effective monitoring and troubleshooting. Enabling logging helps identify issues, track performance, and comply with operational best practices by providing detailed logs of task execution.

#### **Rationale**

-   Enhanced Monitoring: Provides insights into task progress, errors, and performance.
    
-   Improved Troubleshooting: Simplifies error identification and debugging.
    
-   Compliance: Supports operational monitoring requirements and auditing practices.
    

#### **Impact**

**Pros:**

-   Ensures visibility into the replication task for the source database.
    
-   Facilitates proactive troubleshooting and performance tracking.
    
-   Supports adherence to compliance and governance standards.
    

**Cons:**

-   May incur additional costs for storing logs in Amazon CloudWatch.
    
-   Requires appropriate configurations to manage and retain logs effectively.
    

#### **Default Value**

By default, logging is not enabled for DMS replication tasks. It must be explicitly configured.

#### **Pre-Requisite**

IAM Permissions Required:

-   dms:DescribeReplicationTasks
    
-   dms:ModifyReplicationTask
    
-   logs:PutLogEvents
    
-   AWS CLI installed and configured.
    

#### **Remediation**

#### **Test Plan:**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Database Migration Service (DMS) > Replication Tasks.
    
3.  Select the replication task associated with the source database.
    
4.  Under Task Settings, verify if Enable CloudWatch Logs is enabled.
    

**Using AWS CLI:**

1.  Describe the replication task:  
    
    aws dms describe-replication-tasks --filters Name=replication-task-id,Values=<task-id>
    
2.  Check the EnableCloudWatchLogsExports field in the output. Ensure it includes relevant log types for the source database (e.g., SOURCE\_UNLOAD, SOURCE\_CAPTURE).
    

#### **Implementation Steps:**

**Using AWS Console:**

1.  Navigate to Database Migration Service (DMS) > Replication Tasks.  
    ![](https://support.icompaas.com/assets/kb/01ae9ba9c6016441.png)![](https://support.icompaas.com/assets/kb/d692c4f94b070287.png)
    
2.  Select the replication task to update.
    
3.  Click Modify and enable CloudWatch Logs under the Task Settings section.
    
4.  Save the changes.
    

**Using AWS CLI:**

1.  Enable logging for the replication task:  
    
    aws dms modify-replication-task \\
    --replication-task-arn <task-arn> \\
    --enable-cloudwatch-logs-exports SOURCE\_UNLOAD,SOURCE\_CAPTURE
    

2.  Verify the updated configuration:  
    
    aws dms describe-replication-tasks --filters Name=replication-task-id,Values=<task-id>
    

#### **Backout Plan**

#### **Using AWS Console:**

1.  #### If enabling logging causes issues, sign in to the AWS Management Console.
    
2.  #### Navigate to AWS DMS, select the replication task, and go to the Task settings section.
    
3.  #### Disable logging by clearing the CloudWatch Logs or S3 configuration.
    
4.  #### Save the changes and confirm that logging is no longer enabled.
    

#### **Using AWS CLI:**

1.  #### To disable logging, run:  
    
    aws dms modify-replication-task --replication-task-arn <TASK\_ARN> --cloudwatch-log-stream-arn "" --cloudwatch-log-group-arn ""
    
2.  #### Verify that logging has been disabled by running:  
    
    aws dms describe-replication-tasks --replication-task-arn <TASK\_ARN>
    

#### **References**

-   [Monitoring DMS Tasks with CloudWatch Logs](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Monitoring.html)
    
-   [Enabling CloudWatch Logs for DMS Tasks](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html)
    
-   [AWS DMS Task Settings Documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.