I created a DMS instance in a public subnet without public access. Kafka is created as an MSK cluster in a private subnet, within the same VPC. No SSL.
Endpoint testing shows application error 1020912: failed to connect to database.
I can confirm that Kafka is running fine, and I can list topics via a bastion host in the same subnet as the DMS instance.