# Ensure DynamoDB Table Encrypted with KMS

- Source: https://support.icompaas.com/support/solutions/articles/62000218554-ensure-dynamodb-table-encrypted-with-kms
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Description:

Amazon DynamoDB is a fully managed, scalable NoSQL database service. DynamoDB integrates with AWS Key Management Service (AWS KMS) to support the encryption at rest server-side encryption feature.

  

### Rational:

By encrypting all of your data at rest with encryption keys maintained in AWS Key Management Service (AWS KMS), DynamoDB encryption at rest provides greater security. This feature aids in reducing the operational burden and complexity of safeguarding sensitive data.

  

### Impact:

With encryption at rest, DynamoDB transparently encrypts all customer data in a DynamoDB table, including its primary key and local and global secondary indexes, whenever the table is persisted to disk.

  

### Default Value:

By default DynamoDB tables are encrypted at rest with AWS-owned CMKs, using AWS-managed CMKs or customer-managed CMKs provides additional functionality via AWS KMS, such as viewing key policies, auditing usage, and rotating cryptographic material.

  

### Audit:

1.  Sign in to AWS Management Console
    
2.  Navigate to DynamoDB service at [https://console.aws.amazon.com/dynamodb](https://console.aws.amazon.com/dynamodb "https://console.aws.amazon.com/dynamodb")
    
3.  Click on the **Tables** in the left navigation pane.![](https://support.icompaas.com/assets/kb/332cc084e4bf0a21.png)
    
4.  Click on the table name you want to examine
5.  In the **overview** tab under the **Table details,** check the **Encryption Type** column![](https://support.icompaas.com/assets/kb/d66c1c198f4f17bd.png)
6.  If you notice the Encryption Type is DEFAULT, follow the implementation steps to encrypt using AWS KMS
    

**CLI COMMANDS**

aws dynamodb describe-table
  --region us-east-1
  --table-name cc-rule-definitions
  --query 'Table.SSEDescription.SSEType'

### Remediation:

#### Pre-requisites:

1.  Sign as a Admin or IAM user with required permissions
    
2.  Need KMS key for encryption
    

#### Implementation Steps:

1.  Sign in to AWS Management Console
    
2.  Navigate to DynamoDB service at [https://console.aws.amazon.com/dynamodb](https://console.aws.amazon.com/dynamodb "https://console.aws.amazon.com/dynamodb")
    
3.  Click on the **Tables** in the left navigation pane
    
4.  Click on the table name you want to modify
    
5.  In the **Additional Settings** tab **, scroll down** to see encryption click on Manage Encryption.![](https://support.icompaas.com/assets/kb/77ffc7811e9fc50d.png)
    
6.  Manage Encryption wizard will be opened and select the encryption type you want from the options available and choose the key![](https://support.icompaas.com/assets/kb/d2b7a41fe32d6785.png)
    
7.  Click on **Save**
    

#### Via CLI:

aws dynamodb update-table 
--table-name <value>
--sse-specification Enabled=true,SSEType=KMS,KMSMasterKeyId=abcd1234-abcd-1234-a123-ab1234a1b234

#### Backout plan:

To revoke the changes made, follow the same steps in the Implementation section and in step 6 select the previous option (i.e, you want to roll back).

### Reference:

[https://docs.aws.amazon.com/kms/latest/developerguide/services-dynamodb.html](https://docs.aws.amazon.com/kms/latest/developerguide/services-dynamodb.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.