Cis AWS Database 4.3

4.3 Ensure DynamoDB Encryption at Rest

Description

Encryption at rest in Amazon DynamoDB enhances the security of your data by encrypting it using AWS Key Management Service (AWS KMS) keys. Here is how to enable encryption at rest while creating a DynamoDB table.

Rationale

Once the user is in their AWS account, they should open the DynamoDB to create the table and enable encryption. A key would be required to be created to enable encryption. Only the authorized user would always have access to this key. Enabling encryption would keep the user's data private and stored securely, which would only allow them to access it with their key.

Impact

Add an additional layer of security by preventing any unauthorized personnel from accessing the data since both IAM access to the data and access to the encryption key would be required.

Audit Procedure

Using AWS Console

1. Open DynamoDB Console

   • Sign in to the AWS Management Console and open the DynamoDB console at https://console.aws.amazon.com/dynamodb/.

2. Create DynamoDB Table

   • Click Create table. This will bring you to the Create DynamoDB table page.

3. Specify Table Details

   • Enter a Table name and Primary key.
   • The primary key consists of a partition key and, optionally, a sort key.
   • Fill in these details according to your requirements.

4. Enable Encryption

   • Under the Settings section, check the Enable encryption at rest.
   • By default, DynamoDB uses an AWS-owned CMK to encrypt your data.
   • To use an AWS-managed CMK or a customer-managed CMK instead, select AWS-managed CMK or Customer-managed CMK from the dropdown menu, then choose the desired CMK.

5. Create a Table

   • Click Create.
   • This will create your DynamoDB table with encryption at rest enabled.

Note:

1. The setting for encryption at rest applies to all DynamoDB data associated with the table, including primary key data and indexes.
2. If you need to apply encryption at rest to an existing table, you can modify the table settings. However, modifying settings on large tables could take time and impact performance during the transition.
3. Ensure you have the necessary permissions in AWS KMS when choosing an AWS-managed CMK or a customer-managed CMK.

Expected Result

DynamoDB tables have encryption at rest enabled using AWS KMS keys (AWS-owned, AWS-managed, or customer-managed CMK).

Remediation

Using AWS Console

Follow the same steps as the audit procedure to enable encryption at rest for DynamoDB tables. For existing tables, modify the table settings to enable encryption.

Default Value

By default, DynamoDB uses an AWS-owned CMK to encrypt data at rest. Encryption at rest is enabled by default for all DynamoDB tables.

References

1. https://aws.amazon.com/products/databases/
2. https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys

CIS Controls

Profile

Level 1 | Manual