Using secrets to access Amazon Database Migration Service endpoints

Sign in to the Amazon Web Services Management Console and open the Amazon Identity and Access Management console at https://console.amazonaws.cn/iam/.

Choose Users, then select the User ID used for making CreateEndpoint and ModifyEndpoint API calls.

From the Permissions tab, choose {} JSON.

Make sure the user has the permissions shown following.

{
	"Statement": [{
			"Effect": "Allow",
			"Action": [
				"iam:GetRole",
				"iam:PassRole"
			],
			"Resource": "SECRET_ACCESS_ROLE_ARN"
		},
		{
			"Effect": "Allow",
			"Action": "secretsmanager:DescribeSecret",
			"Resource": "SECRET_ARN"
		}
	]
}
                    

If the user doesn't have those permission, add the permissions.

If you're using an IAM Role for making DMS API calls, repeat the steps above for the respective role.

Open a terminal and use the Amazon CLI to validate that permissions are given correctly by assuming the Role or User used above.

1. Validate user’s permission on the SecretAccessRole using the IAM get-role command.

   aws iam get-role --role-name ROLE_NAME
                               

   Replace ROLE_NAME with the name of SecretsManagerAccessRole.

   If the command returns an error message, make sure the permissions were given correctly.

2. Validate user’s permission on the secret using the Secrets Manager describe-secret command.

   aws secretsmanager describe-secret --secret-id SECRET_NAME OR SECRET_ARN --region=REGION_NAME
                               

   User can be the friendly name, partial ARN or the full ARN. For more information, see describe-secret.

   If the command returns an error message, make sure the permissions were given correctly.

Sign in to the Amazon Web Services Management Console and open the Amazon Secrets Manager console at https://console.amazonaws.cn/secretsmanager/.

Choose Store a new secret.

Under Select secret type on the Store a new secret page, choose Other type of secrets, then choose Plaintext.

In the Plaintext field:

Select an Amazon KMS encryption key to encrypt the secret. You can accept the default encryption key created for your service by Amazon Secrets Manager or select a Amazon KMS key that you create.

Specify a name to reference this secret and an optional description. This is the friendly name that you use as the value for SecretsManagerSecretId or SecretsManagerOracleAsmSecretId.

If you want to enable automatic rotation in the secret, you need to select or create an Amazon Lambda function with permission to rotate the credentials for the secret as described. However, before setting automatic rotation to use your Lambda function, ensure that the configuration settings for the function add the following four characters to the value of the EXCLUDE_CHARACTERS environment variable.

;.:+{}

Amazon DMS doesn't allow these characters in passwords used for endpoint credentials. Configuring your Lambda function to exclude them prevents Amazon Secrets Manager from generating these characters as part of its rotated password values. After you set automatic rotation to use your Lambda function, Amazon Secrets Manager immediately rotates the secret to validate your secret configuration.

Review and store your secret in Amazon Secrets Manager. You can then look up each secret by its friendly name in Amazon Secrets Manager, then retrieve the secret ARN as the value for SecretsManagerSecretId or SecretsManagerOracleAsmSecretId as appropriate to authenticate access to your endpoint database connection and Oracle ASM (if used).

Sign in to the Amazon Web Services Management Console and open the Amazon Identity and Access Management (IAM) console at https://console.amazonaws.cn/iam/.

Choose Policies, then choose Create policy.

Choose JSON and enter the following policy to enable access to and decryption of your secret.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "secretsmanager:GetSecretValue",
            "Resource": secret_arn,
        },
        {
             "Effect": "Allow",
             "Action": [
                        "kms:Decrypt",
                        "kms:DescribeKey"
                      ],
             "Resource": kms_key_arn,
        }
     ]
}

Here, secret_arn is the ARN of your secret, which you can get from either SecretsManagerSecretId or SecretsManagerOracleAsmSecretId as appropriate, and kms_key_arn is the ARN of the Amazon KMS key that you are using to encrypt your secret, as in the following example.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "arn:aws:secretsmanager:us-east-2:123456789012:secret:MySQLTestSecret-qeHamH"
        },
        {
             "Effect": "Allow",
             "Action": [
                        "kms:Decrypt",
                        "kms:DescribeKey"
                      ],
             "Resource": "arn:aws:kms:us-east-2:123456789012:key/761138dc-0542-4e58-947f-4a3a8458d0fd"
        }
     ]
}

Review and create the policy with a friendly name and optional description.

Choose Roles, then choose Create role.

Choose Amazon service as the type of trusted entity.

Choose DMS from the list of services as the trusted service, then choose Next: Permissions.

Look up and attach the policy you created in step 4, then proceed through adding any tags and review your role. At this point, edit the trust relationships for the role to use your Amazon DMS regional service principal as the trusted entity. This principal has the following format.

dms.region-name.amazonaws.com

Here, region-name is the name of your region, such as us-east-1. Thus, an Amazon DMS regional service principal for this region follows.

dms.us-east-1.amazonaws.com

After editing the trusted entity for the role, create the role with a friendly name and optional description. You can now look up your new role by its friendly name in IAM, then retrieve the role ARN as the SecretsManagerAccessRoleArn or SecretsManagerOracleAsmAccessRoleArn value to authenticate your endpoint database connection.

Create a secret manager VPC endpoint and note the DNS for the endpoint. For more information about creating a secrets manager VPC endpoint, see Connecting to Secrets Manager through a VPC endpoint in the Amazon Secrets Manager User Guide.

Attach the replication instance security group to the secret manager VPC endpoint.

For the replication instance security group egress rules, allow all traffic for destination 0.0.0.0/0.

Set the endpoint extra connection attribute, secretsManagerEndpointOverride=secretsManager endpoint DNS to provide the secret manager VPC endpoint DNS, as shown in the following example.

secretsManagerEndpointOverride=vpce-1234a5678b9012c-12345678.secretsmanager.eu-west-1.vpce.amazonaws.com