Make sure that the custom replication instance you selected has network access to both endpoints; that is, the Security Group and Subnet are correct, the Postgres port is open, and if S3 is private, it has the necessary IAM role and policy or a VPC endpoint for S3 defined. In fact, a "Connection refused" error during the assessment phase usually indicates an issue with the replication instance’s access to the target or S3, not the endpoint test itself.