Configure AWS DMS change data capture (CDC) from a self-managed SQL Server source without granting sysadmin to the endpoint login. This least-privilege pattern uses certificate-signed wrapper procedures, granular permissions, and AWS Secrets Manager to meet separation-of-duties requirements while preserving full CDC functionality.