Question 1

Is repl_instance_kms_key_arn enforced for SOC 2?

Accepted Answer

Yes, Ensure the DMS replication instance sets kms_key_arn. The instance's storage volumes hold in-flight copies of every row moved between source and target endpoints. DMS already encrypts them when the attribute is omitted, using the AWS managed aws/dms key, so this control evidences that a key was deliberately chosen rather than that encryption is present - and it does not verify the key is customer managed.

Question 2

Is repl_instance_publicly_accessible enforced for SOC 2?

Accepted Answer

Yes, Manage access to the AWS Cloud by ensuring DMS replication instances cannot be publicly accessed.

AWS DMS Terraform module

Terraform Module Source