AWS Database Migration Service

What authentication does the AWS DMS API use?

DMS uses AWS Signature Version 4 (HMAC) signing with an AWS access key ID and secret access key. Through Jentic, those credentials live encrypted in your Jentic One instance and are injected into signed requests at execution time, so the agent never sees the raw secret access key.

Can I run change-data-capture between two databases with this API?

Yes. Set MigrationType to cdc or full-load-and-cdc on CreateReplicationTask. DMS continuously replicates committed changes from the source endpoint to the target until the task is stopped, enabling near-zero-downtime cutover.

What are the rate limits for the AWS DMS API?

DMS shares standard AWS service quotas, which are managed per account and region rather than published as fixed per-second limits in the spec. Account-level limits also apply to the number of replication instances and tasks; ThrottlingException responses should trigger backoff.

How do I orchestrate a migration through Jentic?

Search Jentic for 'create a DMS replication task', load CreateReplicationTask, execute it with the source endpoint ARN, target endpoint ARN, ReplicationInstanceArn, and TableMappings JSON. Run pip install jentic and use the async search and execute pattern.

Does this API include the data conversion logic, or just the orchestration?

DMS itself performs both - it executes the replication and applies built-in data type conversion as part of running the task. The API exposes orchestration: defining endpoints, replication instances, and tasks, and starting and stopping them.

Can I limit what my agent is allowed to do with the AWS DMS API?

Yes. Because you self-host Jentic One, your own rules decide which DMS operations and AWS credentials the agent may use, and DMS dispatches every action through a single endpoint with the operation named in the request, so you can scope the agent to just the operations it needs, such as CreateReplicationTask or StartReplicationTaskAssessmentRun. Destructive operations like DeleteReplicationInstance and DeleteEndpoint stay outside that set unless you explicitly add them. The AWS access keys are held encrypted by your instance and injected only when a permitted request is signed, so the agent never sees the raw secret.