# Ensure Encryption in Transit for DMS Endpoints for Redis OSS - Source: https://support.icompaas.com/support/solutions/articles/62000233450-ensure-encryption-in-transit-for-dms-endpoints-for-redis-oss - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability** - **Level 2** #### **Description** Encryption in transit ensures that data moving between AWS Database Migration Service (DMS) and Redis OSS endpoints is protected from unauthorized access. By enabling Secure Socket Layer (SSL) or Transport Layer Security (TLS), you can secure the communication channel and safeguard sensitive data during migration tasks. #### **Rationale** - Enhanced Security: Protects data from interception and unauthorized access during transit. - Compliance: Aligns with security best practices and regulatory requirements. - Risk Mitigation: Reduces the risk of data breaches and man-in-the-middle attacks. #### **Impact** **Pros:** - Ensures secure communication between DMS and Redis OSS endpoints. - Reduces the risk of data interception and tampering. - Enhances overall security posture. **Cons:** - May require additional configuration for SSL/TLS certificates. - Could introduce slight performance overhead due to encryption. #### **Default Value** By default, encryption in transit is not enabled for Redis OSS endpoints. It must be explicitly configured. #### **Pre-Requisite** IAM Permissions Required: - dms:DescribeEndpoints - dms:ModifyEndpoint - AWS CLI installed and configured. #### **Remediation** **Test Plan:** **Using AWS Console:** 1. Sign in to the AWS Management Console. 2. Navigate to Database Migration Service (DMS) > Endpoints. 3. Select the Redis OSS endpoint and review its configuration. 4. Verify if SSL/TLS is enabled under the Encryption in Transit section. **Using AWS CLI:** 1. Describe the DMS endpoint: aws dms describe-endpoints --filters Name=endpoint-type,Values=source,target 2. Check the SslMode field in the output. Ensure it is set to require. **Implementation Steps:** **Using AWS Console:** 1. Navigate to Database Migration Service (DMS) > Endpoints. 2. Select the Redis OSS endpoint to update. 3. Edit the endpoint configuration and enable Encryption in Transit by setting the SSL mode to require. 4. Save the changes. **Using AWS CLI:** 1. Modify the DMS endpoint to enable encryption in transit: aws dms modify-endpoint \\ --endpoint-arn \\ --ssl-mode require \\ --certificate-arn # Optional if using custom certificates 2. Verify the updated configuration: aws dms describe-endpoints --filters Name=endpoint-type,Values=source,target #### **Backout Plan** #### **Using AWS Console:** 1. #### If enabling encryption in transit causes issues, sign in to the AWS Management Console. 2. #### Navigate to AWS DMS, select the Redis OSS endpoint, and go to the Modify Endpoint settings. 3. #### Disable Encryption in transit by selecting None for the encryption option. 4. #### Save the changes and verify that the endpoint is now functioning without encryption. #### **Using AWS CLI:** 1. To disable Encryption in transit, run the following command:\\ aws dms modify-endpoint --endpoint-arn --ssl-mode none 2. Verify that encryption has been disabled by running: aws dms describe-endpoints --endpoint-arn #### **References** - [Redis OSS Encryption in Transit Documentation](https://redis.io/kb/doc/2j6kk4yf86/does-redis-support-encryption-at-rest-and-in-transit) - [AWS DMS Security Best Practices](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.DataProtection.html) - [ElastiCache In-Transit Encryption Guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/in-transit-encryption.html) [](https://redis.io/kb/doc/2j6kk4yf86/does-redis-support-encryption-at-rest-and-in-transit) #### **CIS Controls**

Version	Control ID	Control Description	IG1	IG2	IG3
v8	5.3	Securely Manage Network Infrastructure – Ensure network devices are resilient and fault-tolerant.	●	●	●
v8	13.2	Ensure Secure Network Communication – Implement measures that prevent disruption during network changes.	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.