title: Cross Account DMS Replication for RDS instances behind Bastion machines
body: <p>I have production stacks inside a Production account and development stacks inside a Development account. The stacks are identical and are setup as follows:</p>
  
  <ul>
  <li>Each stack as its own VPC.</li>
  <li>Within the VPC are two public subnets spanning to AZs and two private subnets spanning to AZs.</li>
  <li>The private Subnets contain the RDS instance.</li>
  <li>The public Subnets contain a Bastion EC2 instance which can access the RDS instance.</li>
  </ul>
  
  <p>To access the RDS instance, I either have to SSH into the Bastion machine and access it from there, or I create an SSH tunnel via the Bastion to access it through a Database client application such as PGAdmin.</p>
  
  <p><strong>Current DMS setup:</strong></p>
  
  <p>I would like to be able to use DMS (Database Migration Service) to replication an RDS instance from Production into Development. So far I am trying the following but cannot get it to work:</p>
  
  <p>Create a VPC peering connection between Development VPC and Production VPC
  Create a replication instance in the private subnet of the Development VPC
  Update the private subnet route tables in the development VPC to route traffic to the CIDR of the production VPC through the VPC peering connection
  Ensure the Security group for the replication instance can access both RDS instances.</p>
  
  <p><strong>Main Problem:</strong></p>
  
  <p>When creating the source endpoint in DMS, the wizard only shows RDS instances from the same account and the same region, and only allows RDS instances to be configured using server names and ports, however, the RDS instances in my stacks can only be accessed via Bastion machines using tunnelling. Therefore the test endpoint connection always fails.</p>
  
  <p>Any ideas of how to achieve this cross account replication?</p>
  
  <p>Any good step by step blogs that detail how to do this? I have found a few but they don't seem to have RDS instances sitting behind bastion machines and so they all assume the endpoint configuration wizard can be populated using server names and ports.</p>
  
  <p>Many thanks.</p>