Project: KICS (Provisioning / Security & Compliance)
File: 030d3b18-1821-45b4-9e08-50efbe7becbb.md

title: Amazon DMS Replication Instance Is Publicly Accessible hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 030d3b18-1821-45b4-9e08-50efbe7becbb Query name: Amazon DMS Replication Instance Is Publicly Accessible Platform: Terraform Severity: <span style="color:#ff0000">Critical</span> Category: Access Control URL: Amazon DMS is publicly accessible, therefore exposing possible sensitive information. To prevent such a scenario, update the attribute 'PubliclyAccessible' to false.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="10" resource "awsdmsreplication_instance" "test" { allocated_storage = 20 apply_immediately = true autominorversion_upgrade = true availability_zone = "us-west-2c" engine_version = "3.1.4" kmskeyarn = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" multi_az = false preferredmaintenancewindow = "sun:10:30-sun:14:30" publicly_accessible = true replicationinstanceclass = "dms.t2.micro" replicationinstanceid = "test-dms-replication-instance-tf" replicationsubnetgroupid = awsdmsreplicationsubnet_group.test-dms-replication-subnet-group-tf.id vpcsecuritygroup_ids = [ "sg-12345678", ] depends_on = [ awsiamrolepolicyattachment.dms-access-for-endpoint-AmazonDMSRedshiftS3Role, awsiamrolepolicyattachment.dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole, awsiamrolepolicyattachment.dms-vpc-role-AmazonDMSVPCManagementRole ] } ``` ```tf title="Negative test num. 1 - tf file" resource "awsdmsreplication_instance" "test" { allocated_storage = 20 apply_immediately = true autominorversion_upgrade = true availability_zone = "us-west-2c" engine_version = "3.1.4" kmskeyarn = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" multi_az = false preferredmaintenancewindow = "sun:10:30-sun:14:30" replicationinstanceclass = "dms.t2.micro" replicationinstanceid = "test-dms-replication-instance-tf" replicationsubnetgroupid = awsdmsreplicationsubnet_group.test-dms-replication-subnet-group-tf.id vpcsecuritygroup_ids = [ "sg-12345678", ] depends_on = [ awsiamrolepolicyattachment.dms-access-for-endpoint-AmazonDMSRedshiftS3Role, awsiamrolepolicyattachment.dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole, awsiamrolepolicyattachment.dms-vpc-role-AmazonDMSVPCManagementRole ] } ``` ```tf title="Negative test num. 2 - tf file" resource "awsdmsreplication_instance" "test" { allocated_storage = 20 apply_immediately = true autominorversion_upgrade = true availability_zone = "us-west-2c" engine_version = "3.1.4" kmskeyarn = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" multi_az = false publicly_accessible = false preferredmaintenancewindow = "sun:10:30-sun:14:30" replicationinstanceclass = "dms.t2.micro" replicationinstanceid = "test-dms-replication-instance-tf" replicationsubnetgroupid = awsdmsreplicationsubnet_group.test-dms-replication-subnet-group-tf.id vpcsecuritygroup_ids = [ "sg-12345678", ] depends_on = [ awsiamrolepolicyattachment.dms-access-for-endpoint-AmazonDMSRedshiftS3Role, awsiamrolepolicyattachment.dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole, awsiamrolepolicyattachment.dms-vpc-role-AmazonDMSVPCManagementRole ] } ```