AWS Database Blog outlines a method to run change data capture migrations from self-managed SQL Server using AWS DMS without requiring sysadmin privileges for the endpoint login. The approach relies on certificate-signed wrapper procedures and granular permissions to maintain full CDC functionality while satisfying separation-of-duties compliance. AWS Secrets Manager is integrated to handle credential management securely within this restricted access model.
- Eliminate sysadmin requirement for DMS endpoint logins on SQL Server sources.
- Use certificate-signed wrapper procedures to grant minimal necessary permissions.
- Preserve full CDC capabilities while meeting strict separation-of-duties policies.
- Integrate AWS Secrets Manager for secure credential handling in the migration workflow.