Check provider logo

DMS replication task has TARGET_APPLY and TARGET_LOAD logging enabled with at least default severity

dms_replication_task_target_logging_enabled

Severitymedium
Servicedms
by Prowler
logging

AWS DMS replication tasks have target logging enabled, including TARGET_APPLY and TARGET_LOAD, each set to at least LOGGER_SEVERITY_DEFAULT.

Risk

Insufficient target logging limits visibility into load/apply activity, masking failures and anomalies. This risks data integrity (silent drift, partial loads) and availability (longer incident resolution), and reduces auditability of migration events.

Run this check with Prowler CLI

prowler aws --checks dms_replication_task_target_logging_enabled

Run in Prowler Cloud

Recommendation

Enable and maintain CloudWatch logging at LOGGER_SEVERITY_DEFAULT or higher for target components:

  • Configure TARGET_APPLY and TARGET_LOAD
  • Enforce least-privilege log access
  • Monitor logs/alerts for anomalies
  • Standardize task settings and validate data for defense in depth

Remediation

CLI

aws dms modify-replication-task --replication-task-arn <task-arn> --replication-task-settings '{"Logging":{"EnableLogging":true,"LogComponents":[{"Id":"TARGET_APPLY","Severity":"LOGGER_SEVERITY_DEFAULT"},{"Id":"TARGET_LOAD","Severity":"LOGGER_SEVERITY_DEFAULT"}]}}'

Native IaC
Terraform
Other
  1. Open the AWS DMS console and go to Database migration tasks
  2. Select the replication task and choose Modify
  3. Expand Task settings (JSON) or Logging
  4. Enable CloudWatch logs (EnableLogging = true)
  5. Set log components:
    • TARGET_APPLY severity: DEFAULT
    • TARGET_LOAD severity: DEFAULT
  6. Save changes (Modify task), then rerun the task if required

Source Code

Resource Type

AwsDmsReplicationTask

References