# Ensure DynamoDB Accelerator (DAX) Encryption Enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000218530-ensure-dynamodb-accelerator-dax-encryption-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Description:

DAX is a DynamoDB-compatible caching service that enables you to benefit from fast in-memory performance for demanding applications. DAX supports server-side encryption. It also supports encryption in transit, ensuring that all requests and responses between your application and the cluster are encrypted by transport-level security (TLS), and connections to the cluster can be authenticated by verification of a cluster x509 certificate.

  

### Rational:

Amazon DynamoDB Accelerator (DAX) encryption at rest provides an additional layer of data protection by helping secure your data from unauthorized access to the underlying storage.

### Impact:

With encryption at rest, the data persisted by DAX on disk is encrypted using 256-bit Advanced Encryption Standard, also known as AES-256 encryption.

  

### Default value:

By default, encryption is enabled.

**NOTE** 

While creating the Cluster we have to mention the encryption if you want to enable or disable after creation of Cluster we cannot change it .

  

#### Pre-requisites:

1.  Sign in as an admin or IAM user with permissions required
    
2.  Need an IAM role
    
3.  Note down the configurations of the old DAX cluster
    
4.  If you notice the DAX cluster is not encrypted then only follow the implementation steps
    

  

### Remediation:

  

### Test Plan:

1.  Sign in to the AWS Management Console
    
2.  Navigate to DynamoDB service at [https://console.aws.amazon.com/dynamodb/](https://console.aws.amazon.com/dynamodb/ "https://console.aws.amazon.com/dynamodb/").
    
3.  **Under DAX,** click on **Clusters,** in the left navigation pane![](https://support.icompaas.com/assets/kb/cc43f182c98a9207.png)
    
4.  Select the AWS DAX cluster that you want to examine.![](https://support.icompaas.com/assets/kb/35f2950c05be1bfa.png)
    
5.  Click on the **settings tab  ![](https://support.icompaas.com/assets/kb/ca870933685389f3.png)**  
    
6.  **Under the Overview tab, go to the Encryption section and check whether the attribute value is set to DISABLED or Enabled.![](https://support.icompaas.com/assets/kb/1f76cd6a170a99f8.png)**
    

  

### Using AWS CLI:

Command is used to describe the cluster

aws dax describe-clusters
  --region us-east-1
  --output table
  --query 'Clusters\[\*\].ClusterName'

**Remediation:**

#### Implementation steps:

1.  Sign in to the AWS Management Console
    
2.  Navigate to DynamoDB service at [https://console.aws.amazon.com/dynamodb/](https://console.aws.amazon.com/dynamodb/ "https://console.aws.amazon.com/dynamodb/").
    
3.  **Under DAX,** click on **Clusters,** in the left navigation pane
    
    ![](https://support.icompaas.com/assets/kb/3fb12b131dfab093.png)
    
4.  Click on **Create cluster** button   
    ![](https://support.icompaas.com/assets/kb/3268f6ef3dc0beb4.png) 
    
5.  Perform the following steps on **Create a DynamoDB Accelerator (DAX) cluster** page 
    
    1.  Enter the name of your new DAX cluster in the **Cluster name** box![](https://support.icompaas.com/assets/kb/55e9a55f8ef0b6bc.png)
        
    2.  Select the node type from the **Node type** dropdown list.  
        ![](https://support.icompaas.com/assets/kb/9aa3c66f4c27139e.png)
        
    3.  Choose the number of nodes from the **Cluster size** dropdown list to create within the new cache cluster
        
        ![](https://support.icompaas.com/assets/kb/3bbcef7031d6ce9e.png)
        
    4.  Give a subnet group name and subnet ![](https://support.icompaas.com/assets/kb/a25f38165c58867b.png)
    5.  Check **Enable at rest** checkbox to enable Encryption, also you can enable encryption at transit by checking **Enable encryption in transit** checkBox  
        ![](https://support.icompaas.com/assets/kb/55aa83eec9aeae54.png)
        
    6.  From the **IAM role** dropdown list, choose whether to create a new IAM service role or select an existing role  
        ![](https://support.icompaas.com/assets/kb/d1e25efe69aeb77a.png)  
        To access the new cache cluster from your DynamoDB-based application, you must enable inbound access on port 8111 for the selected security group.
        

                   1. Select **Use default settings** checkbox to make use of the default settings provided by the DAX service or                            uncheck **Use default settings** checkbox, Within the **Cluster settings** section  
![](https://support.icompaas.com/assets/kb/baef50dd8dd7a836.png)

            2.Click on **Launch Cluster**

            3.Change the cluster endpoint within your DynamoDB application to reference the new resource.

           4.Remove the old and unencrypted DAX cache cluster. To terminate the necessary cluster, perform the following:

                       a. Select the cache cluster that you want to remove 

                       b. Click on the **Actions** and select **Delete**.

  

#### Using AWS CLI:

It will Enable the Encryption of the DynamoDB.  

aws dax create-cluster
  --region us-east-1
  --cluster-name cc-encrypted-cluster
  --node-type dax.r4.large
  --replication-factor 2
  --iam-role-arn arn:aws:iam::123456789012:role/service-role/DAXtoDynamoDB
  --security-group-ids sg-abcd1234
  --availability-zones "us-east-1a" "us-east-1b"
  --subnet-group-name cc-dax-subnet-group
  --sse-specification Enabled=true

  

#### Backout plan:

Once the DAX cluster is launched we can’t make modifications. Only we can delete and re-create the cluster.

  

### Reference:

[![](https://support.icompaas.com/assets/kb/f2ec676480003472.png)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.html)[In-Memory Acceleration with DynamoDB Accelerator (DAX) - Amazon DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.