Database Migration Service replication instances should not be public

How to fix it

Set at creation: fixing it means replacing the resource.

Replace the named replication instance with one that carries a private IP address only. Public access is fixed at creation, so build the replacement in a subnet group whose subnets are private, move each task onto it, and only then delete the public instance, which is what clears the finding. Public access is also the default, so state it off explicitly. A private instance reaches only what the VPC reaches, so any VPN connection, Direct Connect, peering or NAT path its source and target databases need has to exist before the cutover.

In the console

Database Migration Service → Replication instances → Create replication instance → Publicly accessible

With Terraform

resource "aws_dms_replication_instance" "this" {
  replication_instance_id     = var.replication_instance_id
  replication_instance_class  = var.replication_instance_class
  replication_subnet_group_id = var.private_subnet_group_id
  publicly_accessible         = false
}