Description

Ensure that every Amazon DynamoDB Accelerator (DAX) cluster has server-side encryption at rest enabled. With encryption at rest, the data that DAX keeps on disk, including the cache, configuration data and logs, is encrypted.

Rationale

Without encryption at rest, data cached by DAX and its logs could be read from the underlying storage by anyone who gains low-level access, for example through a compromised host or improperly retired storage media. This exposes copies of DynamoDB data outside the protections applied to the tables themselves. Encryption at rest closes this gap, and should be combined with encryption in transit, private network access and least privilege for DAX administration.

Impact

  • Protects cached DynamoDB data and DAX logs on disk

  • Helps meet compliance requirements for encrypting data at rest

  • Encryption at rest can only be chosen when a cluster is created, so an existing cluster must be replaced by a new one and applications must be pointed to the new cluster endpoint

  • The cache of the new cluster starts empty, which temporarily increases reads from the DynamoDB tables

Default Value

Encryption at rest is enabled only if it is selected when the DAX cluster is created. The setting cannot be changed on an existing cluster.

Pre-Requisites

  • IAM permissions: dax:DescribeClusters, dax:CreateCluster, dax:DeleteCluster and iam:PassRole

  • The IAM role that DAX uses to access DynamoDB, and the subnet group and security groups for the new cluster (these can be copied from the existing cluster)

  • A planned change window to switch applications to the new cluster endpoint

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Clusters under DAX.

  3. Select a cluster and check its encryption at rest setting in the cluster details.

  4. Repeat for each cluster in each region in use.

  5. If encryption at rest is not enabled on any cluster, follow the implementation steps.

CLI:

Show the encryption settings of all DAX clusters in a region:

aws dax describe-clusters --region <REGION> --query "Clusters[].[ClusterName,SSEDescription.Status,ClusterEndpointEncryptionType,IamRoleArn,SubnetGroup]" --output table

A cluster fails if SSEDescription.Status is not ENABLED.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Clusters under DAX.

  3. Choose Create cluster.

  4. Enter a cluster name and choose the node type and number of nodes (use the values of the existing cluster).

  5. Select the same subnet group, security groups and IAM role as the existing cluster.

  6. In the encryption settings, turn on encryption at rest (and encryption in transit if required).

  7. Complete the wizard to create the cluster and wait until its status is Available.

  8. Update your applications to use the new cluster endpoint.

  9. When no application uses the old cluster anymore, select it and choose Delete.

  10. Repeat for each affected cluster in each region in use.

CLI:

Create a new cluster with encryption at rest enabled:

aws dax create-cluster --region <REGION> --cluster-name <NEW_CLUSTER_NAME> --node-type <NODE_TYPE> --replication-factor <NODE_COUNT> --iam-role-arn <DAX_ROLE_ARN> --subnet-group-name <SUBNET_GROUP_NAME> --security-group-ids <SECURITY_GROUP_ID> --sse-specification Enabled=true

After applications have been moved to the new cluster endpoint, delete the old cluster:

aws dax delete-cluster --region <REGION> --cluster-name <OLD_CLUSTER_NAME>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Update your applications to use the endpoint of the original cluster again, as long as it has not been deleted.

  3. Open the Amazon DynamoDB console, select Clusters under DAX, select the new cluster and choose Delete.

CLI:

aws dax delete-cluster --region <REGION> --cluster-name <NEW_CLUSTER_NAME>

Note: a deleted DAX cluster cannot be restored. Keep the original cluster until the new cluster is confirmed to work, and remember that rolling back leaves cached data unencrypted at rest.

Reference