Description

Ensure that Amazon DynamoDB Accelerator (DAX) clusters have Transport Layer Security (TLS) encryption in transit enabled, so that traffic between the application client and the DAX cluster nodes, as well as traffic between the cluster's nodes, is encrypted.

Rationale

Without encryption in transit, communication between the application and the DAX cluster (and between cluster nodes) travels unencrypted, potentially exposing cached application data, including sensitive DynamoDB table content, to interception if the network path is compromised or improperly segmented. Enabling TLS for the cluster protects data as it moves between the client, the cluster, and its nodes.

Impact

  • Protects potentially sensitive cached data while in transit between the client and the DAX cluster

  • Aligns DAX's transport security posture with that typically required for the underlying DynamoDB table

  • Encryption in transit can only be enabled at cluster creation time and cannot be changed on an existing cluster, and requires DAX client SDK support for TLS

Default Value

Encryption in transit is disabled by default for a newly created DAX cluster unless explicitly enabled at creation time.

Pre-Requisites

  • A DAX client SDK version that supports TLS connections

  • IAM permissions to view and create DAX clusters (dax:DescribeClusters, dax:CreateCluster)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > DAX clusters.

  3. Select the cluster to review.

  4. Review the cluster details for the Encryption in transit (TLS) field.

  5. Verify that TLS encryption in transit shows as Enabled.

  6. If encryption in transit is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > DAX clusters.

  3. Because encryption in transit cannot be enabled on an existing cluster, select Create cluster to create a new DAX cluster.

  4. Configure the new cluster's settings and enable Encryption in transit (TLS) under the cluster's advanced settings.

  5. Complete cluster creation, and update the application's DAX client SDK configuration to connect using TLS to the new cluster endpoint.

  6. Once traffic has cut over successfully, delete the old cluster.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > DAX clusters and select Create cluster.

  3. Create a new cluster without Encryption in transit enabled, if reverting is required.

  4. Update the application's DAX client configuration to connect to the new cluster and delete the previously encrypted cluster once traffic has cut over.

Reference