AWS Database Migration Service (DMS)
AWS Database Migration Service (DMS) is a managed service that moves data between databases, data warehouses, and other data stores. Arpio replicates the full DMS resource graph (endpoints, replication instances, and replication tasks) so that recovery environments can run the same migration pipelines as the primary environment.
DMS Endpoint
An endpoint defines how DMS connects to a data store, whether as a source or a target. Each endpoint carries the engine type, connection details, authentication configuration, and any engine-specific settings. Arpio supports both source and target endpoint types across all engines that DMS supports.
The following attributes are translated during replication:
|
Attribute |
Translation |
|---|---|
|
KMS Key |
Translated to the corresponding KMS key that Arpio manages in the recovery environment |
|
Service Access Role |
Translated to the corresponding IAM role that Arpio manages in the recovery environment |
|
Certificate ARN |
Translated to the corresponding DMS Certificate in the recovery environment |
|
Secrets Manager Secret |
For relational engines using Secrets Manager credentials, translated to the corresponding secret that Arpio manages in the recovery environment |
|
Secrets Manager Access Role |
For relational engines using Secrets Manager credentials, translated to the corresponding IAM role that Arpio manages in the recovery environment |
|
S3 Bucket Name |
Translated to the corresponding S3 bucket that Arpio manages in the recovery environment, for S3 endpoints |
|
Server Name |
For endpoints that reference RDS Databases or Clusters, this is translated to the corresponding endpoint value for the RDS Database or Cluster that Arpio manages in the recovery environment |
The following resources are automatically selected when a DMS Endpoint is selected:
- The KMS key used for encryption, when configured
- The IAM roles referenced by the endpoint
- The DMS Certificate referenced by the endpoint, when configured
- The Secrets Manager secrets referenced by the endpoint, when using Secrets Manager credentials
- S3 Buckets referenced by the endpoint
- RDS Databases and Clusters referenced by the endpoint
Inline credentials
If an endpoint stores credentials inline (a Username is present on the source endpoint), Arpio cannot read the password from the source environment. Before the recovery task can complete, you must populate a Secrets Manager secret named /Arpio/DmsEndpoint/{endpoint-identifier}/Password in the recovery account with the endpoint password. Arpio surfaces an actionable issue if this secret is missing or inaccessible.
DMS Certificate
DMS certificates store the SSL/TLS material used to encrypt connections between a replication instance and an endpoint. They are not mandatory for DMS to function. A certificate is only required when the endpoint's SSL mode is set to verify-ca or verify-full, which perform certificate-based server authentication. The other SSL modes (none and require) do not require a certificate to be present.
The certificate data (PEM content) is replicated as-is and does not require any translation, since it is not region-specific.
DMS Replication Subnet Group
A replication subnet group is a named collection of VPC subnets that DMS uses to determine where replication instances can be placed
The following attributes are translated during replication:
|
Attribute |
Translation |
|---|---|
|
Subnet IDs |
Remapped to corresponding subnets that Arpio manages in the recovery environment |
The following resources are automatically selected when a DMS Replication Subnet Group is selected:
- The subnets belonging to the group
DMS Replication Instance
A replication instance is the managed compute resource responsible for executing replication tasks. It connects to source and target endpoints and performs the actual data movement. Instance class, engine version, allocated storage, Multi-AZ configuration, and public accessibility settings are all preserved as configured on the source.
The following attributes are translated during replication:
|
Attribute |
Translation |
|---|---|
|
Replication Subnet Group |
Translated to the corresponding subnet group that Arpio manages in the recovery environment |
|
KMS Encryption Key |
Translated to the corresponding KMS key that Arpio manages in the recovery environment (multi-region keys required for customer-managed encryption) |
|
VPC Security Groups |
Translated to corresponding security groups that Arpio manages in the recovery environment |
The following resources are automatically selected when a DMS Replication Instance is selected:
- The DMS Replication Subnet Group used by the instance
- The KMS key used for storage encryption, when encryption is enabled
- The VPC security groups associated with the instance
DMS Replication Task
A replication task defines the data movement job between a source endpoint and a target endpoint, executed by a replication instance. It includes the migration type, the table selection and transformation rules (table mappings), and optional task-level settings.
Arpio supports all three migration types: full-load (one-time bulk load), cdc (ongoing change capture only), and full-load-and-cdc (bulk load followed by ongoing replication). The CDC start position and start time are preserved, so ongoing replication tasks can resume from the same checkpoint after recovery.
The following attributes are translated during replication:
|
Attribute |
Translation |
|---|---|
|
Replication Instance |
Translated to the corresponding DMS Replication Instance that Arpio manages in the recovery environment |
|
Source Endpoint |
Translated to the corresponding DMS Endpoint that Arpio manages in the recovery environment |
|
Target Endpoint |
Translated to the corresponding DMS Endpoint that Arpio manages in the recovery environment |
The following resources are automatically selected when a DMS Replication Task is selected:
- The DMS Replication Instance used by the task
- The source DMS Endpoint referenced by the task
- The target DMS Endpoint referenced by the task