Pro ยท Lesson 3 of 11
A task can only move data the replication compute can reach. Endpoints, subnet groups, and security groups are that path.
Sign in to save your place.
The truck has to be allowed into both warehouses. A security group is the guard at the door. A subnet group is which street the truck is parked on. A secret in the endpoint is the key, and it should not be a password pasted into a screenshot.
A replication instance lives in a subnet group inside a VPC. The source and the target must accept connections from that instance, or from the elastic network interfaces DMS Serverless uses. On-premises databases need a private path such as VPN or Direct Connect, or a public endpoint you have chosen on purpose and locked down. Public and open is a common accident.
Test the endpoint connection in the console or the API before you start the task. A failed test is a network, authentication, or SSL problem. It is cheaper than a failed task at midnight.
Prefer AWS Secrets Manager for endpoint credentials. An IAM role lets DMS read the secret. A password in a ticket or a chat log will outlive the migration.
SSL settings depend on the engine. If the source requires TLS and the endpoint says none, the test connection fails. Match the engine's requirement. Do not disable TLS on a production database to make a lab green.
| Failure | Look at |
|---|---|
| Test connection timeout | Routes, NACLs, and security groups |
| Authentication failed | User, password or secret, and the database's auth mode |
| SSL error | The endpoint SSL mode versus what the database asks for |
Step 1 of 3The instance or the serverless ENI is the client.
Step 2 of 3The database security group must allow that client on the engine's port.
Step 3 of 3The database user needs the privileges the engine's DMS page lists.
Fill the blanks for a source you can actually describe. Do not invent CIDR blocks.
DMS compute lives in VPC ___ subnet group ___.
Source host ___ listens on port ___.
Security group ___ allows that compute on that port: yes/no/unknown.
Credentials come from Secrets Manager: yes/no.
Test connection result: not run yet.
Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.