DMS replication instance is publicly accessible

What this check finds

The Database Migration Service replication instance has PubliclyAccessible=true, giving it a public IP reachable from the internet. Replication instances sit between source and target databases and hold connection credentials; exposing one broadens the attack surface onto both databases it bridges.

Passing looks like: DMS replication instance not publicly accessible.

How to fix it

Recreate the replication instance with public accessibility disabled (it cannot be toggled in place), and place it in private subnets reachable only from the source/target databases. CLI reference: aws dms create-replication-instance --no-publicly-accessible.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs