Fail back from Amazon RDS for Db2 to on-premises AIX Db2 using DMS

In this post, you learn how to set up CDC-only reverse replication from Amazon Relational Database Service (Amazon RDS) for Db2 back to your on-premises AIX Db2 instance using AWS Database Migration Service (AWS DMS).

After migrating your Db2 workload from on-premises AIX to Amazon RDS for Db2, you need a tested fail-back path that maintains data integrity if issues arise during the critical post-cutover validation window. A tested fail-back strategy helps you roll back quickly while preserving transactions that applications commit after cutover. Standard backup and restore approaches can take hours and might not capture the most recent changes. The setup described in this post takes approximately two to three hours to configure and validate.

You can configure a change data capture (CDC) only reverse replication path from Amazon Relational Database Service (Amazon RDS) for Db2 back to your on-premises AIX Db2 instance through DMS. This approach is designed to give you a bounded, time-limited safety net during your migration to AWS, helping to support reversion to your on-premises environment if issues arise after switching production workloads.

Forward migration patterns from on-premises Db2 to Amazon RDS have extensive documentation. For more information, refer to Migrate from self managed Db2 to Amazon RDS using DMS and Migrate from self managed Db2 to Amazon RDS using native tools. Reverse replication patterns for Db2 are less documented than forward migrations. With the approach in this post, you can implement a tested fail-back strategy specifically for Db2 workloads originating from AIX environments. Rolling back from a migration with AWS DMS.

For the conceptual framework on rollback strategies during migrations, see Rolling back from a migration with DMS, which describes four strategies: basic fallback, fall forward, dual write, and bidirectional replication. This post focuses on implementing the unidirectional reverse replication pattern for Db2, through a CDC only task to maintain a tested fail-back path.

Solution overview

During migration validation, you need confidence that you can safely roll back if issues arise. This reverse replication is designed to help provide that safety net. Every database migration to AWS follows a lifecycle: plan, migrate, validate, and complete. This reverse replication supports the validate phase. It runs only during the post cutover validation window (typically two to four weeks) and is decommissioned when validation succeeds. This is not an ongoing replication pattern; it is a temporary safety measure that gives you confidence to complete your migration. For cost details, see the Cost considerations section later in this post.

With this approach, you can help maintain a tested fail-back path by running an AWS DMS CDC only replication task with Amazon RDS as the source and an on-premises self managed AIX Db2 instance as the target. You replicate only ongoing changes (no full load), which avoids redundant data transfer. The on-premises database already contains the complete dataset from before the cutover. Connectivity remains private: no public subnets, no public IP addresses, and no internet gateway. Your data flows exclusively through AWS Direct Connect.

Notice how data flows through private connections with no internet gateway. The following diagram illustrates this architecture:

Figure 1: Solution architecture for CDC only reverse replication (private network only)

Key design decisions

• CDC only, no full load: Because the on-premises database already holds the complete dataset from before cutover, you avoid the time and cost of a full data reload. Only incremental changes made in Amazon RDS after cutover flow back.
• Private only network architecture: Your data doesn’t traverse the public internet. No public subnets, no public IP addresses on DMS or Amazon RDS instances. AWS service access is through Amazon Virtual Private Cloud (Amazon VPC) endpoints (AWS PrivateLink), and data transits through an AWS Direct Connect private VIF.
• Unidirectional reverse replication: During the post cutover validation window, applications write exclusively to Amazon RDS. The reverse CDC task replicates changes to the on-premises database.
• AWS Direct Connect for connectivity: A dedicated, private connection between your Amazon VPC and on-premises data center with no internet path involved.

Prerequisites

This walkthrough requires intermediate knowledge of Db2 administration and AWS networking. Allow approximately two to three hours to configure and validate the complete setup. Before you configure reverse replication, verify that you meet these requirements:

Required before you begin

• Forward migration is complete: You have successfully migrated your Db2 workload from on-premises AIX to Amazon RDS using DMS (full load + CDC) or native tools.
• Amazon RDS instance: A running Amazon RDS instance in an Amazon Virtual Private Cloud (Amazon VPC) with PubliclyAccessible set to false (private endpoint only).
• On-premises AIX Db2 instance: The original source database is intact and accessible, running Db2 LUW version 10.5 or later.
• AWS Direct Connect: An established AWS Direct Connect connection with a private virtual interface (VIF) between your on-premises data center and AWS. No VPN over the public internet.

Created in this walkthrough

• DMS replication instance: Version 3.5.4 or later, deployed in a private subnet with Publicly Accessible set to false.
• VPC endpoints: Interface endpoints for AWS Secrets Manager, Amazon CloudWatch Logs, and DMS, so the DMS instance can access AWS services without an internet gateway.
• AWS Identity and Access Management (IAM) permissions: An IAM role granting DMS access to Amazon RDS for Db2, AWS Secrets Manager, and Amazon CloudWatch.
• Database user privileges: Appropriate grants on both source (Amazon RDS for Db2) and target (on-premises AIX Db2) endpoints.

Network architecture: private only AWS Direct Connect connectivity

The entire network architecture uses private connectivity only. The architecture doesn’t include an internet gateway. You deploy the DMS replication instance and Amazon RDS in private subnets with no public IP addresses. Amazon VPC endpoints (AWS PrivateLink) connect to AWS services such as Amazon CloudWatch and AWS Secrets Manager. Data flows to the on-premises environment exclusively through AWS Direct Connect, using a private virtual interface.

Security group configuration

Create the following security groups to restrict communication to private subnets only.

DMS replication instance security group (dms-reverse-repl-sg):

# Create security group for DMS replication instance
aws ec2 create-security-group \
  --group-name dms-reverse-repl-sg \
  --description "SG for DMS reverse replication (private only)" \
  --vpc-id vpc-<vpc-id>

# Allow outbound to on-premises Db2 (port <db-port>) through AWS Direct Connect
aws ec2 authorize-security-group-egress \
  --group-id sg-dms-xxxxxxxxx \
  --protocol tcp --port <db-port> \
  --cidr <on-premises-db2-ip>/32

# Allow outbound to RDS for Db2 (port <db-port>) - private subnet
aws ec2 authorize-security-group-egress \
  --group-id sg-dms-xxxxxxxxx \
  --protocol tcp --port <db-port> \
  --cidr <private-subnet-cidr>

# Allow outbound HTTPS to Amazon VPC Endpoints (443)
aws ec2 authorize-security-group-egress \
  --group-id sg-dms-xxxxxxxxx \
  --protocol tcp --port 443 \
  --cidr <vpc-cidr>

Amazon RDS security group (rds-db2-sg):

# Allow inbound from DMS replication instance on port <db-port>
aws ec2 authorize-security-group-ingress \
  --group-id sg-rds-xxxxxxxxx \
  --protocol tcp --port <db-port> \
  --source-group sg-dms-xxxxxxxxx

VPC endpoints for private AWS service access

The Amazon VPC has no internet gateway, so create Amazon VPC endpoints so the DMS replication instance can access AWS services privately:

# Create Interface Amazon VPC Endpoints for DMS service access
for SERVICE in secretsmanager monitoring logs dms; do
  aws ec2 create-vpc-endpoint \
    --vpc-id vpc-<vpc-id> \
    --service-name com.amazonaws.<aws-region>.${SERVICE} \
    --vpc-endpoint-type Interface \
    --subnet-ids subnet-aaaaaaaaaa \
    --security-group-ids sg-vpce-xxxxxxxxx \
    --private-dns-enabled
done

VPC route table configuration

# Add route to on-premises network through VGW (private routing)
aws ec2 create-route \
  --route-table-id rtb-<route-table-id> \
  --destination-cidr-block <on-premises-cidr> \
  --gateway-id vgw-<vgw-id>

# Note: No route to internet gateway - traffic stays private

Connectivity verification

Before creating the DMS task, verify private connectivity between the DMS instance, source, and target:

1. Test reachability: Use Amazon VPC Reachability Analyzer to validate the network path from the DMS subnet to the on-premises IP () on port <db-port>.
2. Verify firewall rules: Confirm that the on-premises firewall accepts inbound TCP traffic on port <db-port> from the Amazon VPC CIDR range ().
3. Test endpoint connections: After creating the endpoints, use the DMS connection test:

aws dms test-connection \
  --replication-instance-arn arn:aws:dms:<aws-region>:<aws-account-id>:rep:my-instance \
  --endpoint-arn arn:aws:dms:<aws-region>:<aws-account-id>:endpoint:my-target

Expected output:

{
  "Connection": {
    "ReplicationInstanceArn": "arn:aws:dms:<aws-region>:<aws-account-id>:rep:my-instance",
    "EndpointArn": "arn:aws:dms:<aws-region>:<aws-account-id>:endpoint:my-target",
    "Status": "testing",
    "LastFailureMessage": "",
    "EndpointIdentifier": "my-target",
    "ReplicationInstanceIdentifier": "my-instance"
  }
}

Configure Amazon RDS for Db2 as a CDC source

To prepare Amazon RDS as a CDC source, complete the following three configuration steps.

Connect to your Amazon RDS for Db2 instance using the master user (the administrative user you specified when creating the instance). The following commands require rdsadmin authorization, so a standard database user won’t have sufficient privileges.

Enable archive log retention

-- Increase archive log retention to 24 hours
CALL rdsadmin.set_archive_log_retention(?, 'PRODDB', '24');

Important: Set the archive log retention to at least 24 hours. If the DMS task falls behind and required logs have been purged, the task fails and must restart from a new position.

Enable DATA CAPTURE CHANGES

ALTER TABLE SCHEMA_NAME.TABLE_NAME DATA CAPTURE CHANGES INCLUDE LONGVAR COLUMNS;

Grant DMS user privileges

GRANT DBADM ON DATABASE TO USER dms_user;
GRANT DATAACCESS ON DATABASE TO USER dms_user;

Configure the on-premises AIX Db2 as a target

Prepare the on-premises target database to receive CDC changes from AWS DMS.

Connect to your on-premises AIX Db2 instance using a user with SYSADM or SECADM authority. The following GRANT statements require administrative privileges on the target database.

Grant target database privileges

GRANT DBADM ON DATABASE TO USER dms_user;
GRANT DATAACCESS ON DATABASE TO USER dms_user;

Prepare the target tables

1. Drop or disable foreign key constraints: AWS DMS applies changes in transaction log order, not in parent-child relationship order. Without disabling foreign keys, an INSERT into a child table might arrive before the corresponding parent row, causing referential integrity violations that fail the replication task. Re-enable constraints after you validate the fail-back.
2. Disable triggers: Helps prevent unintended side effects from CDC apply.

ALTER TABLE TARGET_SCHEMA.TABLE_NAME DEACTIVATE TRIGGERS;

3. Reset sequences: Capture current values from RDS source and reset on target:

SELECT 'ALTER SEQUENCE ' || TRIM(SEQSCHEMA) || '.' || TRIM(SEQNAME)
  || ' RESTART WITH ' || NEXTCACHEFIRSTVALUE || ';'
FROM SYSCAT.SEQUENCES
WHERE SEQSCHEMA IN ('APP_SCHEMA') AND SEQTYPE = 'S';

Step-by-step: Create the reverse CDC only replication

The following seven steps walk you through creating the DMS resources for reverse CDC only replication. In the following commands, replace placeholder values (such as vpc-xxxxxxxxx and sg-dms-xxxxxxxxx) with your actual resource identifiers.

Step 1: Create the IAM role

aws iam create-role --role-name dms-vpc-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect": "Allow",
      "Principal": {"Service": "dms.amazonaws.com"},
      "Action": "sts:AssumeRole"}]}'

aws iam attach-role-policy --role-name dms-vpc-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole

Step 2: Create the DMS replication instance (private)

aws dms create-replication-subnet-group \
  --replication-subnet-group-identifier db2-reverse-repl-subnet-group \
  --replication-subnet-group-description "Private subnets for reverse replication" \
  --subnet-ids subnet-aaaaaaaaaa subnet-bbbbbbbbbb

aws dms create-replication-instance \
  --replication-instance-identifier db2-reverse-repl-instance \
  --replication-instance-class dms.c6i.xlarge \
  --allocated-storage 100 \
  --vpc-security-group-ids sg-dms-xxxxxxxxx \
  --replication-subnet-group-identifier db2-reverse-repl-subnet-group \
  --no-multi-az --engine-version 3.5.4 \
  --no-publicly-accessible

Important: The --no-publicly-accessible flag is critical. The DMS instance is deployed in a private subnet with no public IP. Connectivity to on-premises is through AWS Direct Connect through the virtual private gateway (VGW).

Step 3: Create the source endpoint (Amazon RDS for Db2)

aws dms create-endpoint \
  --endpoint-identifier rds-db2-source-for-reverse \
  --endpoint-type source --engine-name db2 \
  --server-name mydb2instance.xxxx.<aws-region>.rds.amazonaws.com \
  --port <db-port> --database-name PRODDB \
  --username dms_user --password '<your-password>' \
  --ibm-db2-settings '{"CurrentLsn":"scan","SetDataCaptureChanges":true}' \
  --extra-connection-attributes "StartFromContext=NOW;"

Step 4: Create the target endpoint (on-premises AIX Db2)

aws dms create-endpoint \
  --endpoint-identifier aix-db2-target-for-reverse \
  --endpoint-type target --engine-name db2 \
  --server-name <on-premises-db2-ip> \
  --port <db-port> --database-name PRODDB \
  --username dms_user --password '<your-password>' \
  --ibm-db2-settings '{"LoadTimeout":1200,"MaxFileSize":1048576,"WriteBufferSize":1024}'

Step 5: Test endpoint connections

# Test both endpoints (must return "successful")
aws dms test-connection \
  --replication-instance-arn arn:aws:dms:...rep:db2-reverse-repl-instance \
  --endpoint-arn arn:aws:dms:...endpoint:rds-db2-source-for-reverse

aws dms test-connection \
  --replication-instance-arn arn:aws:dms:...rep:db2-reverse-repl-instance \
  --endpoint-arn arn:aws:dms:...endpoint:aix-db2-target-for-reverse

Step 6: Create the CDC only replication task

aws dms create-replication-task \
  --replication-task-identifier db2-reverse-cdc-task \
  --source-endpoint-arn arn:aws:dms:...endpoint:rds-db2-source-for-reverse \
  --target-endpoint-arn arn:aws:dms:...endpoint:aix-db2-target-for-reverse \
  --replication-instance-arn arn:aws:dms:...rep:db2-reverse-repl-instance \
  --migration-type cdc \
  --table-mappings '{"rules":[
    {"rule-type":"selection","rule-id":"1","rule-name":"exclude-sys",
     "object-locator":{"schema-name":"SYS%","table-name":"%"},
     "rule-action":"exclude"},
    {"rule-type":"selection","rule-id":"2","rule-name":"include-app",
     "object-locator":{"schema-name":"APP_SCHEMA","table-name":"%"},
     "rule-action":"include"}]}' \
  --cdc-start-position "scan"

Key replication task settings

Note: Pass these settings in the --replication-task-settings JSON parameter when creating the task. The CLI command in Step 6 uses a simplified form; adjust the JSON configuration to match your environment.

Step 7: Start the replication task

aws dms start-replication-task \
  --replication-task-arn arn:aws:dms:...task:db2-reverse-cdc-task \
  --start-replication-task-type start-replication

Monitoring and validation

After you start the replication task, monitor these key Amazon CloudWatch metrics. The following table shows the metrics, their thresholds, and recommended actions. You can also configure Amazon CloudWatch alarms that send notifications through Amazon Simple Notification Service (Amazon SNS) when metrics exceed thresholds.

aws cloudwatch put-metric-alarm \
  --alarm-name db2-reverse-cdc-latency \
  --metric-name CDCLatencySource --namespace AWS/DMS \
  --statistic Average --period 300 --threshold 120 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 3 \
  --alarm-actions arn:aws:sns:<aws-region>:<aws-account-id>:dms-alerts

Fail-back procedures

When you need to fail back to your on-premises environment, follow this procedure to minimize downtime and maintain data integrity.

Figure 3: Fail-back execution procedure

Pre fail-back checklist

1. Verify CDC latency is near zero: CDCLatencySource and CDCLatencyTarget ≈ 0
2. Confirm data validation passes: Tables show Validated state
3. Stop application writes to RDS: Quiesce the application tier
4. Confirm the CDC task has drained: CDCIncomingChanges = 0

Fail-back execution

1. Stop the reverse CDC task.
2. Re-enable foreign key constraints on the target.
3. Re-enable triggers on target tables.
4. Reset sequences to current values from Amazon RDS for Db2.
5. Update application connection strings to point to on-premises Db2 (:).
6. Run smoke tests against the on-premises database.
7. Optional: Set up forward replication again for remigration.

Clean up resources

This reverse replication exists only to support the migration validation phase. It is not designed for ongoing use. Plan to decommission when the application runs two to four weeks without issues, relevant teams sign off, and change management approves. After decommissioning, delete the DMS replication instance, endpoints, and associated IAM roles to stop incurring charges.

aws dms stop-replication-task --replication-task-arn arn:aws:dms:...
aws dms delete-replication-task --replication-task-arn arn:aws:dms:...
aws dms delete-endpoint --endpoint-arn arn:aws:dms:...
aws dms delete-replication-instance --replication-instance-arn arn:aws:dms:...

After decommissioning, revert the archive log retention on your Amazon RDS for Db2 instance to the default value if you no longer need extended retention. This reduces storage costs from retained archive logs.

-- Revert archive log retention to default (1 hour)
CALL rdsadmin.set_archive_log_retention(?, 'PRODDB', '1');

Limitations

• DMS supports IBM Db2 for LUW as a CDC source. In this architecture, the on-premises AIX Db2 instance is configured as a target endpoint, which receives changes through standard Db2 connectivity.
• DMS doesn’t support full large object (LOB) mode for Db2 LUW targets. Use limited LOB mode instead.
• DMS doesn’t support the Boolean data type in Db2 LUW sources.
• DMS ignores DECFLOAT column changes during replication.
• DMS doesn’t replicate certain DDL operations (partitioned table ALTER, RENAME COLUMN). Apply these manually on the target.
• Multidimensional clustering (MDC) table updates appear as INSERT + DELETE pairs.
• DMS doesn’t replicate sequence values. Synchronize them manually before fail-back.
• CDC doesn’t capture the Db2 LOAD utility’s page level loads. Use IMPORT instead.

Cost considerations

Consider the following cost factors when you plan your reverse replication setup:

• DMS replication instance hours (based on instance class).
• Data transfer through AWS Direct Connect.
• VPC endpoint charges per hour per Availability Zone.
• Amazon CloudWatch metrics and alarms.
• AWS Secrets Manager secret storage and API calls.

For current pricing, see the DMS pricing page, the AWS Direct Connect pricing page, and the AWS PrivateLink pricing page. Because this is a temporary migration safety measure, you can minimize costs by decommissioning the replication infrastructure after the validation window closes.

Best practices

• Before your production cutover, dry run the complete fail-back procedure in a non-production environment to validate each step.
• Store database credentials in AWS Secrets Manager with auto-rotation enabled. This approach improves your security posture by removing hard-coded passwords.
• Set up Amazon CloudWatch alarms on CDCLatencySource and CDCLatencyTarget metrics so you’re alerted when replication lag increases beyond acceptable thresholds.
• Maintain archive log retention at 24 hours or longer. If required logs are purged before DMS reads them, the task fails and you must restart from a new position.
• After 48 to 72 hours of stable replication, reduce the DMS log verbosity from DETAILED_DEBUG to DEFAULT to lower Amazon CloudWatch Logs costs.
• For sizing, a c6i.xlarge instance handles fewer than 1,000 transactions per second (TPS). If your workload exceeds that, scale up to a c6i.2xlarge.
• Schedule weekly data validation with independent row count and checksum comparisons between source and target databases.

Conclusion

In this post, you learned how to configure CDC-only reverse replication from Amazon RDS for Db2 to an on-premises AIX Db2 instance using AWS DMS over a private-only network. You set up VPC interface endpoints, configured source and target Db2 endpoints, created a CDC-only replication task, and validated the data flow through AWS Direct Connect. This temporary fail-back path helps you meet strict RTO and RPO requirements during migration cutover windows. After your migration stabilizes, decommission the reverse replication and transition to your permanent architecture on AWS.

About the authors