# Ensure Logging Is Enabled for DMS Replication Tasks - Source: https://support.icompaas.com/support/solutions/articles/62000233464-ensure-logging-is-enabled-for-dms-replication-tasks - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability** - **Level 2** #### **Description** AWS Database Migration Service (DMS) replication tasks can generate logs that provide valuable insights into task performance, errors, and debugging information. Enabling logging ensures that you can monitor and troubleshoot replication tasks effectively, improving reliability and compliance with operational best practices. #### **Rationale** - Enhanced Monitoring: Provides detailed information about task execution and potential issues. - Improved Troubleshooting: Simplifies debugging by capturing task logs. - Compliance: Aligns with best practices for operational monitoring and auditing. #### **Impact** **Pros:** - Enables proactive monitoring and issue resolution. - Improves visibility into replication task performance. - Supports compliance with operational and security standards. **Cons:** - May incur additional costs for storing logs in Amazon CloudWatch. - Requires proper configuration to avoid excessive log generation. #### **Default Value** By default, logging is not enabled for DMS replication tasks. It must be explicitly configured. #### **Pre-Requisite** IAM Permissions Required: - dms:DescribeReplicationTasks - dms:ModifyReplicationTask - logs:PutLogEvents - AWS CLI installed and configured. #### **Remediation** #### **Test Plan:** **Using AWS Console:** 1. Sign in to the AWS Management Console. 2. Navigate to Database Migration Service (DMS) > Replication Tasks. 3. Select the replication task to check its configuration. 4. Under the Task Settings section, verify if Enable CloudWatch Logs is selected. **Using AWS CLI:** 1. Describe the replication task: aws dms describe-replication-tasks --filters Name=replication-task-id,Values= 2. Check the EnableCloudWatchLogsExports field in the output. Ensure it is set to true. #### **Implementation Steps:** **Using AWS Console:** 1. Navigate to Database Migration Service (DMS) > Replication Tasks. 2. Select the replication task to update. 3. Click Modify and enable CloudWatch Logs under the Task Settings section. 4. Save the changes. **Using AWS CLI:** 1. Enable logging for the replication task: aws dms modify-replication-task \\ --replication-task-arn \\ --enable-cloudwatch-logs-exports 2. Verify the updated configuration: aws dms describe-replication-tasks --filters Name=replication-task-id,Values= #### **Backout Plan** **Using AWS Console:** 1. If enabling logging causes issues, sign in to the AWS Management Console. 2. Navigate to AWS DMS, select the replication task, and go to the Modify settings. 3. Remove or disable the logging configuration by clearing the CloudWatch Logs or S3 configuration. 4. Save the changes and verify that logging is no longer enabled. **Using AWS CLI:** 1. To disable logging for a replication task, run the following command: aws dms modify-replication-task --replication-task-arn --cloudwatch-log-stream-arn "" --cloudwatch-log-group-arn "" 2. Verify that logging has been disabled by retrieving the task details: aws dms describe-replication-tasks --replication-task-arn #### **References** - [Monitoring AWS DMS Tasks](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Monitoring.html) - [Enable CloudWatch Logs for DMS Tasks](https://repost.aws/knowledge-center/manage-cloudwatch-logs-dms) - [AWS DMS Task Settings Documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html) #### **CIS Controls**

Version	Control ID	Control Description	IG1	IG2	IG3
v8	5.3	Securely Manage Network Infrastructure – Ensure network devices are resilient and fault-tolerant.	●	●	●
v8	13.2	Ensure Secure Network Communication – Implement measures that prevent disruption during network changes.	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.