AWS DMS replication instance is publicly accessible misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_89
Category - Subcategory	Public Exposure - Database Endpoints
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	b6085a88-3c26-466d-9039-c225d754c5ae

Impact

AWS Database Migration Service (AWS DMS) is a service for migrating relational databases, data warehouses, NoSQL databases and other data stores. DMS can be used to migrate data into the AWS Cloud, between on-premises instances, or between combinations of cloud and on-premises environments. An AWS DMS replication instance can have one public IP address and one private IP address, just like an Amazon Elastic Compute Cloud (Amazon EC2) instance that has a public IP address. If you uncheck (disable) the box for Publicly accessible, then the replication instance has only a private IP address.

How to Fix

Resource: AWS::DMS::ReplicationInstance

• Arguments: Properties.PubliclyAccessible - (Optional, Default: false) Specifies the accessibility options for the replication instance.

A value of true represents an instance with a public IP address. A value of false represents an instance with a private IP address. [source,go]

Resources: ReplicationInstance: Type: AWS::DMS::ReplicationInstance Properties: ...

• PubliclyAccessible: False

---