# Ensure DynamoDB DAX cluster has encryption at rest enabled - Source: https://support.icompaas.com/support/solutions/articles/a_179329223726024-ensure-dynamodb-dax-cluster-has-encryption-at-rest-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon DynamoDB Accelerator (DAX) cluster has server-side encryption at rest enabled. With encryption at rest, the data that DAX keeps on disk, including the cache, configuration data and logs, is encrypted. **Rationale** Without encryption at rest, data cached by DAX and its logs could be read from the underlying storage by anyone who gains low-level access, for example through a compromised host or improperly retired storage media. This exposes copies of DynamoDB data outside the protections applied to the tables themselves. Encryption at rest closes this gap, and should be combined with encryption in transit, private network access and least privilege for DAX administration. **Impact** - Protects cached DynamoDB data and DAX logs on disk - Helps meet compliance requirements for encrypting data at rest - Encryption at rest can only be chosen when a cluster is created, so an existing cluster must be replaced by a new one and applications must be pointed to the new cluster endpoint - The cache of the new cluster starts empty, which temporarily increases reads from the DynamoDB tables **Default Value** Encryption at rest is enabled only if it is selected when the DAX cluster is created. The setting cannot be changed on an existing cluster. **Pre-Requisites** - IAM permissions: dax:DescribeClusters, dax:CreateCluster, dax:DeleteCluster and iam:PassRole - The IAM role that DAX uses to access DynamoDB, and the subnet group and security groups for the new cluster (these can be copied from the existing cluster) - A planned change window to switch applications to the new cluster endpoint **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon DynamoDB console and select **Clusters** under **DAX**. 3. Select a cluster and check its encryption at rest setting in the cluster details. 4. Repeat for each cluster in each region in use. 5. If encryption at rest is not enabled on any cluster, follow the implementation steps. **CLI:** Show the encryption settings of all DAX clusters in a region: aws dax describe-clusters --region --query "Clusters\[\].\[ClusterName,SSEDescription.Status,ClusterEndpointEncryptionType,IamRoleArn,SubnetGroup\]" --output table A cluster fails if SSEDescription.Status is not ENABLED. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon DynamoDB console and select **Clusters** under **DAX**. 3. Choose **Create cluster**. 4. Enter a cluster name and choose the node type and number of nodes (use the values of the existing cluster). 5. Select the same subnet group, security groups and IAM role as the existing cluster. 6. In the encryption settings, turn on encryption at rest (and encryption in transit if required). 7. Complete the wizard to create the cluster and wait until its status is **Available**. 8. Update your applications to use the new cluster endpoint. 9. When no application uses the old cluster anymore, select it and choose **Delete**. 10. Repeat for each affected cluster in each region in use. **CLI:** Create a new cluster with encryption at rest enabled: aws dax create-cluster --region --cluster-name --node-type --replication-factor --iam-role-arn --subnet-group-name --security-group-ids --sse-specification Enabled=true After applications have been moved to the new cluster endpoint, delete the old cluster: aws dax delete-cluster --region --cluster-name **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Update your applications to use the endpoint of the original cluster again, as long as it has not been deleted. 3. Open the Amazon DynamoDB console, select **Clusters** under **DAX**, select the new cluster and choose **Delete**. **CLI:** aws dax delete-cluster --region --cluster-name Note: a deleted DAX cluster cannot be restored. Keep the original cluster until the new cluster is confirmed to work, and remember that rolling back leaves cached data unencrypted at rest. **Reference** - [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionAtRest.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAXEncryptionAtRest.html) - [https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/dynamodb.html](https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/dynamodb.html) - [https://docs.aws.amazon.com/cli/latest/reference/dax/create-cluster.html](https://docs.aws.amazon.com/cli/latest/reference/dax/create-cluster.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.