DMS endpoints for Neptune databases should have IAM authorization enabled
Description
This control checks whether an AWS DMS endpoint for an Amazon Neptune database is configured with IAM authorization. The control fails if the DMS endpoint doesn't have IAM authorization enabled. AWS Identity and Access Management (IAM) provides fine-grained access control across AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions. By enabling IAM authorization on AWS DMS endpoints for Neptune databases, you can grant authorization privileges to IAM users by using a service role specified by the ServiceAccessRoleARN parameter.
Remediation
Enable IAM authorization for your DMS endpoints that connect to Neptune databases to ensure fine-grained access control.
Steps
- Navigate to the AWS DMS console
- Go to the Endpoints section
- Select the Neptune endpoint that needs IAM authorization
- Modify the endpoint configuration
- In the 'Authentication' section, enable 'IAM database authentication'
- Configure the 'Service access role ARN' parameter
- Ensure the IAM role has appropriate permissions for Neptune access
- Save the configuration changes
- Verify that IAM authorization is now enabled for the Neptune endpoint