# Ensure DMS Instances Are Not Publicly Accessible

- Source: https://support.icompaas.com/support/solutions/articles/62000233448-ensure-dms-instances-are-not-publicly-accessible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability**

-   **Level 2**

#### **Description**

Publicly accessible DMS replication instances can expose your data to unauthorized access over the internet, posing significant security risks. By disabling public accessibility, you can restrict access to the instances and ensure they are reachable only from within a secure network, such as a Virtual Private Cloud (VPC).

#### **Rationale**

-   Enhanced Security: Prevents unauthorized access to DMS instances from the internet.
    
-   Risk Mitigation: Reduces the risk of data exposure or compromise.
    
-   Compliance: Aligns with security best practices and regulatory requirements.
    

#### **Impact**

**Pros:**

-   Ensures that DMS instances are accessible only from trusted private networks.
    
-   Reduces the attack surface for data migration processes.
    
-   Improves compliance with security and governance frameworks.
    

**Cons:**

-   May require additional configuration for private network access or VPNs.
    
-   Restricts convenience for users needing direct internet access.
    

#### **Default Value**

By default, DMS replication instances are publicly accessible. You must explicitly disable this option during instance creation or modification.

#### **Pre-Requisite**

IAM Permissions Required:

-   dms:DescribeReplicationInstances
    
-   dms:ModifyReplicationInstance
    
-   AWS CLI installed and configured.
    

#### **Remediation**

**Test Plan:**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Database Migration Service (DMS) > Replication Instances.
    
3.  For each replication instance, check the Publicly Accessible field under the instance's configuration. Ensure it is set to No.
    

**Using AWS CLI:**

1.  Describe the replication instance:  
    
    aws dms describe-replication-instances --filters Name=replication-instance-id,Values=<instance-id>
    
2.  Check the PubliclyAccessible field in the output. Ensure it is set to false.
    

**Implementation Steps:**

**Using AWS Console:**

1.  Navigate to Database Migration Service (DMS) > Replication Instances.  
    ![](https://support.icompaas.com/assets/kb/c2b046b2d5752b5c.png) ![](https://support.icompaas.com/assets/kb/0a8a083b41c91873.png) 
    
2.  Click on create Replication Instances![](https://support.icompaas.com/assets/kb/91c1cc721dc75c53.png)
    
3.  Under connectivity and security set Publicly Accessible to No.![](https://support.icompaas.com/assets/kb/8ab3a77412e4e228.png)
    
4.  Click on create Replication Instances.
    

**Using AWS CLI:**

1.  Disable public accessibility for the replication instance:  
    
    aws dms modify-replication-instance \\
    --replication-instance-arn <instance-arn> \\
    --no-publicly-accessible
    

2.  Verify the updated configuration:  
    
    aws dms describe-replication-instances --filters Name=replication-instance-id,Values=<instance-id>
    

#### **Backout Plan**

#### **Using AWS Console:**

1.  #### If making the DMS instance non-public causes issues, sign in to the AWS Management Console.
    
2.  #### Navigate to AWS DMS, select the replication instance, which is not publicly accessible .  
    ![](https://support.icompaas.com/assets/kb/e303aca42066f6d7.png)![](https://support.icompaas.com/assets/kb/1411b56dda21907c.png) 
    
3.  #### Click actions and delete it .![](https://support.icompaas.com/assets/kb/488674f671340c77.png)
    
4.  #### Click on create Replication Instances   
    ![](https://support.icompaas.com/assets/kb/61948f919923b94f.png)  
    
5.  #### Under connectivity and security set Publicly Accessible back to Yes and save the changes.![](https://support.icompaas.com/assets/kb/c8107f2547cea355.png)
    
6.  #### Verify that the DMS instance is once again publicly accessible if needed.
    

#### **Using AWS CLI:**

1.  #### If you need to re-enable public access, run:  
    
    aws dms modify-replication-instance --replication-instance-arn <REPLICATION\_INSTANCE\_ARN> --publicly-accessible true
    
2.  #### Verify the changes by retrieving the instance details:  
    
    aws dms describe-replication-instances --replication-instance-arn <REPLICATION\_INSTANCE\_ARN>
    

#### **References**

-   [AWS DMS Replication Instance Configuration](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.html)
    
-   [Managing Public Accessibility for DMS Instances](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.Network.html)
    
-   [AWS Security Best Practices for DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.