Description

Ensure that Amazon DynamoDB Accelerator (DAX) clusters have server-side encryption at rest enabled, so that cached data stored by the DAX cluster nodes is encrypted.

Rationale

DAX provides an in-memory caching layer in front of DynamoDB to reduce read latency, and the cached data may include the same sensitive application data stored in the underlying DynamoDB table. Without encryption at rest enabled, this cached data (persisted to node-local storage as part of normal DAX operation) is not encrypted, which may not meet the confidentiality requirements applied to the underlying table's data.

Impact

  • Protects potentially sensitive cached data at rest on DAX cluster nodes

  • Supports compliance requirements consistent with those applied to the underlying DynamoDB table

  • Encryption at rest can only be enabled at cluster creation time and cannot be changed on an existing cluster

Default Value

Encryption at rest is disabled by default for a newly created DAX cluster unless explicitly enabled at creation time.

Pre-Requisites

  • IAM permissions to view and create DAX clusters (dax:DescribeClusters, dax:CreateCluster)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > DAX clusters.

  3. Select the cluster to review.

  4. Review the Encryption field in the cluster details.

  5. Verify that encryption at rest shows as Enabled.

  6. If encryption at rest is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > DAX clusters.

  3. Because encryption at rest cannot be enabled on an existing cluster, select Create cluster to create a new DAX cluster.

  4. Configure the new cluster's settings and enable Encryption at rest under the cluster's advanced settings.

  5. Complete cluster creation and update the application's DAX client endpoint configuration to point to the new, encrypted cluster.

  6. Once traffic has cut over successfully, delete the old, unencrypted cluster.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > DAX clusters and select Create cluster.

  3. Create a new cluster without Encryption at rest enabled, if reverting is required.

  4. Update the application's DAX client endpoint configuration to point to the new cluster and delete the previously encrypted cluster once traffic has cut over.

Reference