# Ensure IAM Authorization Is Enabled for DMS Endpoints for Neptune Databases - Source: https://support.icompaas.com/support/solutions/articles/62000233465-ensure-iam-authorization-is-enabled-for-dms-endpoints-for-neptune-databases - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability** - **Level 2** #### **Description** IAM authorization for Amazon Neptune databases allows you to use AWS Identity and Access Management (IAM) credentials to authenticate and manage access to your database resources. Enabling IAM authorization for DMS endpoints ensures secure and controlled access to Neptune databases during migration tasks. #### **Rationale** - Enhanced Security: Ensures that only authorized IAM users and roles can access Neptune databases. - Risk Mitigation: Reduces the risk of unauthorized access and data breaches. - Compliance: Aligns with security best practices and regulatory requirements. #### **Impact** **Pros:** - Provides centralized access control using IAM policies. - Simplifies user management and auditing. - Enhances security by eliminating the need for hardcoded credentials. **Cons:** - Requires additional configuration for IAM roles and policies. - May introduce complexity if IAM permissions are not properly managed. #### **Default Value** By default, IAM authorization is disabled for Neptune databases. It must be explicitly enabled. #### **Pre-Requisite** IAM Permissions Required: - dms:DescribeEndpoints - dms:ModifyEndpoint - neptune-db:Connect - AWS CLI installed and configured. #### **Remediation** #### **Test Plan:** **Using AWS Console:** 1. Sign in to the AWS Management Console. 2. Navigate to Database Migration Service (DMS) > Endpoints. 3. Select the endpoint associated with the Neptune database. 4. Check the IAM Authorization setting under the endpoint configuration. **Using AWS CLI:** 1. Describe the DMS endpoint: aws dms describe-endpoints --filters Name=endpoint-type,Values=target 2. Verify the EnableIAMDatabaseAuthentication field in the output. Ensure it is set to true. #### **Implementation Steps:** **Using AWS Console:** 1. Navigate to Database Migration Service (DMS) > Endpoints. 2. Select the Neptune endpoint to update. 3. Edit the endpoint configuration and enable IAM Database Authentication. 4. Save the changes. **Using AWS CLI:** 1. Modify the DMS endpoint to enable IAM authorization: aws dms modify-endpoint --endpoint-arn --enable-iam-database-authentication 2. Verify the updated configuration: aws dms describe-endpoints --filters Name=endpoint-type,Values=target #### **Backout Plan** #### **Using AWS Console:** 1. #### If enabling IAM authorization causes issues, sign in to the AWS Management Console. 2. #### Navigate to AWS DMS, select the Neptune endpoint, and go to the Modify settings. 3. #### Disable IAM authorization by selecting None for IAM authentication. 4. #### Save the changes and verify that the endpoint is now using the original authentication method. #### **Using AWS CLI:** 1. #### To disable IAM authorization, run: aws dms modify-endpoint --endpoint-arn --neptune-settings '{"IamAuthEnabled": false}' 2. #### Verify that IAM authorization has been disabled: aws dms describe-endpoints --endpoint-arn #### **References** - [Enabling IAM Database Authentication in Amazon Neptune](https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth-enable.html) - [AWS DMS Endpoint Configuration Documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Endpoints.html) - [IAM Policies for Neptune Databases](https://docs.aws.amazon.com/neptune/latest/userguide/iam-auth.html) #### **CIS Controls**

Version	Control ID	Control Description	IG1	IG2	IG3
v8	5.3	Securely Manage Network Infrastructure – Ensure network devices are resilient and fault-tolerant.	●	●	●
v8	13.2	Ensure Secure Network Communication – Implement measures that prevent disruption during network changes.	●	●

- ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.