# Cis AWS Database 4.6

> Ensure DynamoDB Streams and AWS Lambda for Automated Compliance Checking is Enabled

- Skill: `cyberstrikeus/cis-aws-database-4-6` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aws-database-4-6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aws-database-4-6/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aws-database-4-6

---


# 4.6 Ensure DynamoDB Streams and AWS Lambda for Automated Compliance Checking is Enabled

## Description

Enabling DynamoDB Streams and integrating AWS Lambda allows you to automate compliance checking and perform actions based on changes made to your DynamoDB data.

## Rationale

Enabling the DynamoDB with AWS Lambda allows the individual to either use an existing or create a new execution role that allows Lambda to access DynamoDB and write logs.

## Impact

N/A

## Audit Procedure

### Using AWS Console

1. Open DynamoDB Console
   - Sign in to the AWS Management Console and open the DynamoDB console at https://console.aws.amazon.com/dynamodb/.

2. Create or Select a DynamoDB Table
   - You can create a new DynamoDB table or select an existing one to enable DynamoDB Streams.

3. Enable DynamoDB Streams
   - In the DynamoDB console, select your table.
   - Click on the `Overview` tab.
   - Under the `DynamoDB Streams` section, click on `Manage stream`.
   - In the `Manage stream` dialog, choose `Enable` and select the desired view type (e.g., `New and old images`).
   - Click `Enable`.

4. Create an AWS Lambda Function
   - Open the AWS Management Console and navigate to the Lambda service at https://console.aws.amazon.com/lambda/.
   - Click `Create function` to create a new Lambda function.
   - Choose a function name, runtime (e.g., Node.js, Python), and other basic settings.
   - Under `Permissions`, choose an existing or create a new execution role that allows Lambda to access DynamoDB and write logs.
   - Click `Create function` to create the Lambda function.

5. Configure AWS Lambda with DynamoDB Stream
   - Scroll down to the `Designer` section in the Lambda function editor.
   - Click on `Add trigger`.
   - Select `DynamoDB` from the trigger list.
   - In the `Configure triggers` dialog, choose the DynamoDB table and the stream that you enabled in the previous step.
   - Define the batch size and starting position, if applicable.
   - Click "Add".

6. Write Lambda Function Code for Compliance Checking
   - In the Lambda function editor, scroll up to the code editor section.
   - Write your compliance-checking logic in the selected runtime language (e.g., Node.js, Python).
   - The code should handle the incoming DynamoDB stream records and perform the necessary compliance checks.
   - If needed, you can use the AWS SDKs or other libraries to interact with DynamoDB or other AWS services.

7. Configure Lambda Function Settings
   - Scroll down to the `Function overview` section.
   - Configure the memory, timeout, and other settings as per your requirements.
   - Click `Save` to save the Lambda function.

8. Test the Compliance Checking
   - You can test the compliance checking by changing the DynamoDB table and observing the Lambda function's behavior through the CloudWatch logs or other desired actions performed by the function.

## Expected Result

DynamoDB Streams are enabled and an AWS Lambda function is configured to process stream records for automated compliance checking.

## Remediation

### Using AWS Console

Follow the same steps as the audit procedure to enable DynamoDB Streams and create a Lambda function for automated compliance checking.

## Default Value

By default, DynamoDB Streams are not enabled and no Lambda triggers are configured.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control            | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------ | ---- | ---- | ---- |
| v8               | 3 Data Protection  |      |      |      |
| v7               | 13 Data Protection |      |      |      |

## Profile

Level 1 | Manual