Description

Ensure that Amazon DynamoDB tables use an AWS KMS customer-managed key for encryption at rest, rather than relying solely on the AWS-owned or AWS-managed default encryption key.

Rationale

DynamoDB encrypts all table data at rest by default using an AWS-owned key, providing no additional charge but also no organizational control over the key. For tables holding sensitive data, using a customer-managed KMS key provides direct control over key rotation, access policy, and the ability to audit and, if necessary, revoke access to the data by disabling the key, which is often required by compliance frameworks.

Impact

  • Provides organizational control over the encryption key protecting table data at rest

  • Enables the ability to revoke access to table data by disabling or restricting the KMS key

  • Introduces a dependency on the KMS key's availability and correct permissions for the table to remain accessible

Default Value

DynamoDB tables are encrypted at rest by default using an AWS-owned key at no additional cost; a customer-managed KMS key must be explicitly selected to change this.

Pre-Requisites

  • An AWS KMS customer-managed key with a key policy granting DynamoDB the necessary permissions

  • IAM permissions to update table encryption settings (dynamodb:UpdateTable)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the table to review.

  3. Open the Additional settings tab and review the Encryption section.

  4. Verify that the KMS key type shown is a customer-managed key rather than AWS owned key or AWS managed key.

  5. If a customer-managed key is required by policy but not in use, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS KMS and create (or identify) a customer-managed key with a key policy granting DynamoDB the required permissions.

  3. Navigate to Amazon DynamoDB > Tables and select the table to update.

  4. Open the Additional settings tab and select Manage encryption (or Edit) in the Encryption section.

  5. Select Stored in your account, and choose customer managed key, then select the KMS key created above.

  6. Save the changes and confirm the table's encryption details now reflect the customer-managed key.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the affected table.

  3. Open the Additional settings tab and select Manage encryption.

  4. Select AWS owned key or AWS managed key to revert.

  5. Save the changes.

Reference