All checks
Medium
DMS endpoints for Neptune databases should have IAM authorization enabled
Checks that a DMS endpoint for an Amazon Neptune target has IAM authorization enabled, so DMS reaches the Neptune cluster through the endpoint's service role and the IAM policy attached to it, which keeps the migration's access to the cluster least-privilege.
- service
- DMS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: With IAM authorization on, tasks cannot write to Neptune unless the service role's policy allows neptune-db actions on the target cluster.
In the console
Database Migration Service → Endpoints → the endpoint → Modify → Endpoint-specific settings
- IamAuthEnabled
- true
- ServiceAccessRoleArn
- A role that DMS and Neptune can both assume, with a policy allowing neptune-db actions on the target cluster
With the AWS CLI
aws dms modify-endpoint --endpoint-arn <endpoint-arn> --neptune-settings ServiceAccessRoleArn=<service-role-arn>,S3BucketName=<bucket-name>,S3BucketFolder=<bucket-folder>,IamAuthEnabled=true --region <region>See which of your accounts this check is failing on.
Book a live scan