Database Migration Service replication instances should not be public

How to fix it

• Replaces the resource: Public access is fixed at creation: create a private instance, move each task onto it, then delete this one, which is what clears the finding.
• Interrupts service: A task must be stopped before it can move, so its replication pauses until you restart it on the new instance.

In the console

Database Migration Service → Replication instances → Create replication instance → Publicly accessible

Publicly accessible

Cleared (it is selected by default)

Replication Subnet Group

Private subnets that reach the source and target databases (VPN, Direct Connect, peering or NAT)

Engine version

The same as this instance's or higher, so its tasks can move

With Terraform

resource "aws_dms_replication_instance" "this" {
  replication_instance_id     = var.replication_instance_id
  replication_instance_class  = var.replication_instance_class
  replication_subnet_group_id = var.private_subnet_group_id
  publicly_accessible         = false
}