DMS task to migrate from Aurora PostgreSQL to Redshift

Question

Not a question

I was working on a task to migrate the data from Aurora PostgreSQL to Redshift serverless. I created the connections, setup the IAM roles including dms-access-for-endpoint and created the migration task. The premigration tests ran successfully however the migration task failed with the error role/dms-access-for-endpoint is not associated to cluster

I don't think the docs are super clear on this setup, but this error basically means that your Redshift namespace has to be linked to this IAM role as well. If you look into the Trust Relationship for the role, there are 2 of them: one for DMS another for Redshift. So just add that role to the cluster and your migration task will complete successfully.

Not sure if this is super obvious or only I faced this issue, but documenting it here so that if anyone faces in future, they can read this for a quick fix instead of struggling for hours

I tried deleting and re-setting the DMS replication instance, connections and tasks. Also tried deleting and re-creating the IAM roles. Nothing seemed to work.

Answer 1

As the message implies, you need to associate dms-access-for-endpoint IAM role to the cluster.

The "cluster" in this context does not mean the DMS replication instance but the Redshift Serverless namespace.

When you create a namespace, you should be able to find the "Associate IAM roles" section. You can click "Associate IAM role" button and select dms-access-for-endpoint to associate it with the namespace.

If you don't find dms-access-for-endpoint appeared in the list, probably it's caused by the lack of trust policy.

Find the role in the IAM console, click "Edit trust policy" button in the "Trust relationships" tab and add the following item to the Statement field:

{
    "Sid": "2",
    "Effect": "Allow",
    "Principal": {
        "Service": "redshift.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
}

FYI here is how my entire trust policy look like:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "Service": "dms.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "Service": "redshift.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}