DMS endpoints should use SSL

How to fix it

• Can break clients: Tasks using this endpoint fail to connect if the database does not accept SSL or the CA certificate does not match, so run Test connection before restarting them.

In the console

Database Migration Service → Endpoints → the endpoint → Modify

SSL mode

verify-full where the engine supports it, otherwise verify-ca or require; AWS's SSL page lists each engine's modes

CA certificate

The certificate bundle that signed the database's server certificate, needed for verify-ca and verify-full

With the AWS CLI

aws dms modify-endpoint --endpoint-arn <endpoint-arn> --ssl-mode <ssl-mode> --certificate-arn <ca-certificate-arn> --region <region>

With Terraform

resource "aws_dms_endpoint" "this" {
  endpoint_id     = var.endpoint_id
  endpoint_type   = var.endpoint_type
  engine_name     = var.engine_name
  ssl_mode        = var.ssl_mode
  certificate_arn = var.ca_certificate_arn
}