DMS.10: DMS Neptune endpoints should have IAM auth

What does AWS Security Hub DMS.10 check?

DMS.10 checks whether a DMS endpoint whose target is an Amazon Neptune database has IAM authorization enabled. The backing AWS Config rule, DMS_NEPTUNE_IAM_AUTHORIZATION_ENABLED, reads the endpoint's IamAuthEnabled flag and marks the endpoint NON_COMPLIANT when IamAuthEnabled is false. Turning IAM auth on is what makes the endpoint authenticate to Neptune through a scoped service role (the role you supply in the ServiceAccessRoleArn parameter) rather than a weaker alternative.

Why does DMS.10 matter?

IAM authorization via a service role gives the endpoint short-lived, auditable, least-privilege access to the Neptune cluster instead of static or broad credentials. Without it, the endpoint's access is harder to scope and rotate. The risk lingers because DMS endpoints are sticky: they cost nothing and often outlive the migration that created them, quietly failing the control long after the replication instance is gone.

How do I fix DMS.10?

1. Inspect each Neptune target endpoint to confirm whether IamAuthEnabled is set to true.
2. Create or correct a scoped IAM role that grants the endpoint only the Neptune access it needs.
3. Enable IAM auth on the endpoint and reference the role through the ServiceAccessRoleArn parameter, then verify the connection with the AWS CLI.
4. Delete orphaned endpoints left over from completed migrations to clear stale findings.

# Move the highest-impact databases onto IAM authentication first (free, no reboot).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?IAMDatabaseAuthenticationEnabled==`false`].DBInstanceIdentifier' \
    --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --enable-iam-database-authentication --apply-immediately
  echo "$db: IAM database authentication enabled"
done

# Find every instance still using a default admin username (immutable; needs migration).
aws rds describe-db-instances \
  --query "DBInstances[?contains(['admin','postgres','root','sa','master','mysql','dbadmin'], MasterUsername)].[DBInstanceIdentifier,MasterUsername]" \
  --output table

# Recreate one of those with a non-default master username set explicitly at creation.
aws rds restore-db-cluster-from-snapshot \
  --db-cluster-identifier prod-orders-db-v2 \
  --snapshot-identifier prod-orders-db-pre-rename \
  --engine aurora-postgresql