01 Run describe-replication-instances command (OSX/Linux/UNIX) using the ARN of the AWS DMS replication instance that you want to re-create (see Audit section part II to identify the right resource) to return the configuration metadata for the selected instance:
aws dms describe-replication-instances
--region us-east-1
--filters Name=replication-instance-arn,Values=arn:aws:dms:us-east-1:123456789012:rep:ABCDABCD12341234ABCDABCD1A
02 The command output should return the instance configuration metadata. This information is required later when the new AWS DMS replication instance is created:
{
"ReplicationInstances": [
{
"AvailabilityZone": "us-east-1a",
"ReplicationInstancePrivateIpAddress": "172.20.15.10",
"ReplicationInstanceArn": "arn:aws:dms:us-east-1:123456789012:rep:ABCDABCD12341234ABCDABCD1A",
"ReplicationInstancePrivateIpAddresses": [
"172.20.15.10"
],
"ReplicationInstanceClass": "dms.c4.large",
"VpcId": "vpc-abcd1234",
"SubnetGroupStatus": "Complete",
"ReplicationSubnetGroupIdentifier": "default-vpc-abcd1234"
},
...
"AutoMinorVersionUpgrade": true,
"ReplicationInstanceStatus": "available",
"VpcSecurityGroups": [
{
"Status": "active",
"VpcSecurityGroupId": "sg-01234abcd1234abcd"
}
],
"InstanceCreateTime": 1550737188.133,
"AllocatedStorage": 150,
"EngineVersion": "3.1.2",
"ReplicationInstanceIdentifier": "cc-mysql-replication-server",
"PubliclyAccessible": true,
"PreferredMaintenanceWindow": "thu:18:15-thu:18:45"
}
]
}
03 Run create-replication-instance command (OSX/Linux/UNIX) to create your new Amazon DMS replication instance using the configuration attributes returned at the previous step. Use --no-publicly-accessible command parameter to disable public accessibility for the new instance. During launch process, AWS DMS will skip attaching a public IP address to the instance in order to restrict public access, outside the instance’s VPC:
aws dms create-replication-instance
--region us-east-1
--replication-instance-identifier cc-private-replication-instance
--replication-instance-class dms.c4.large
--allocated-storage 150
--engine-version 3.1.2
--availability-zone us-east-1a
--replication-subnet-group-identifier default-vpc-abcd1234
--vpc-security-group-ids sg-01234abcd1234abcd
--no-publicly-accessible
04 The command output should return the metadata for the new AWS DMS replication instance:
{
"ReplicationInstances": [
{
"AvailabilityZone": "us-east-1a",
"ReplicationInstancePrivateIpAddress": "172.30.5.138",
"ReplicationInstanceArn": "arn:aws:dms:us-east-1:123456789012:rep:ABCDABCD12341234ABCDABCD1A",
"ReplicationInstancePrivateIpAddresses": [
"172.30.5.138"
],
"ReplicationInstanceClass": "dms.c4.large",
"VpcId": "vpc-abcd1234",
"SubnetGroupStatus": "Complete",
"ReplicationSubnetGroupIdentifier": "default-vpc-abcd1234"
},
...
"AutoMinorVersionUpgrade": true,
"ReplicationInstanceStatus": "available",
"VpcSecurityGroups": [
{
"Status": "active",
"VpcSecurityGroupId": "sg-01234abcd1234abcd"
}
],
"AllocatedStorage": 150,
"EngineVersion": "3.1.2",
"ReplicationInstanceIdentifier": "cc-private-replication-instance",
"ReplicationInstanceStatus": "creating",
"PreferredMaintenanceWindow": "thu:18:15-thu:18:45"
}
]
}
05 Update your database migration plan by creating a new migration task to include the newly launched AWS DMS replication instance.
06 (Optional) To stop adding charges for the old replication instance, run delete-replication-instance command (OSX/Linux/UNIX) to terminate the old AWS DMS instance:
aws dms delete-replication-instance
--region us-east-1
--replication-instance-arn arn:aws:dms:us-east-1:123456789012:rep:ABCDABCD12341234ABCDABCD1A
07 The command output should return the command request metadata:
{
"ReplicationInstances": [
{
"AvailabilityZone": "us-east-1a",
"ReplicationInstancePrivateIpAddress": "172.20.15.10",
"ReplicationInstanceClass": "dms.c4.large",
"AutoMinorVersionUpgrade": true,
"ReplicationInstanceStatus": "available",
...
"AllocatedStorage": 150,
"EngineVersion": "3.1.2",
"ReplicationInstanceIdentifier": "cc-mysql-replication-server",
"PubliclyAccessible": true,
"PreferredMaintenanceWindow": "thu:18:15-thu:18:45",
}
]
}
08 Repeat step no. 1 – 7 to disable public accessibility for other Amazon DMS replication instances available in the current region.
09 Change the AWS region by updating the --region command parameter value and repeat the remediation process for other regions.
Security 