Description

Ensure that every Amazon DynamoDB table is encrypted at rest with an AWS KMS key in your account, either the AWS managed key aws/dynamodb or a customer managed key, instead of the default AWS owned key. All DynamoDB tables are encrypted at rest; this setting only controls which type of key protects the data.

Rationale

With the default AWS owned key, you cannot see or control the key: there is no key policy to manage, no record of key usage in AWS CloudTrail, and no way to rotate or disable the key yourself. This limits least-privilege enforcement, auditing and incident response, and may not meet requirements for customer-controlled keys. Using a KMS key in your account, preferably a customer managed key for sensitive data, provides key-policy control, usage auditing and the ability to revoke access.

Impact

  • Adds key-policy based control and CloudTrail auditing of key usage

  • Helps meet compliance requirements for customer-controlled encryption keys

  • AWS KMS request charges apply, and customer managed keys also have a monthly key fee

  • If a customer managed key is disabled or scheduled for deletion, the table becomes inaccessible

Default Value

New DynamoDB tables are encrypted at rest with an AWS owned key unless a different key type is chosen when the table is created.

Pre-Requisites

  • IAM permissions: dynamodb:ListTables, dynamodb:DescribeTable, dynamodb:UpdateTable, kms:DescribeKey, kms:CreateGrant and kms:ListAliases

  • For a customer managed key: a symmetric KMS key in the same region whose key policy allows the principals that use the table to use the key through DynamoDB

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Tables.

  3. Select a table and open the Additional settings tab.

  4. In the encryption section, check the key type.

  5. Repeat for each table in each region in use.

  6. If any table uses the key Owned by Amazon DynamoDB, follow the implementation steps.

CLI:

List the tables in a region:

aws dynamodb list-tables --region <REGION> --query "TableNames"

Show the encryption settings of a table:

aws dynamodb describe-table --table-name <TABLE_NAME> --region <REGION> --query "Table.SSEDescription.[Status,SSEType,KMSMasterKeyArn]"

A table fails if SSEType is not KMS (an empty result means the AWS owned key is used).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Tables.

  3. Select the table and open the Additional settings tab.

  4. In the encryption section, choose to manage the encryption settings.

  5. Select AWS managed key or Stored in your account, and owned and managed by you (customer managed key) and choose the key.

  6. Save the changes.

  7. Repeat for each affected table in each region in use.

CLI:

Encrypt the table with the AWS managed key aws/dynamodb:

aws dynamodb update-table --table-name <TABLE_NAME> --region <REGION> --sse-specification Enabled=true,SSEType=KMS

Or encrypt the table with a customer managed key:

aws dynamodb update-table --table-name <TABLE_NAME> --region <REGION> --sse-specification Enabled=true,SSEType=KMS,KMSMasterKeyId=<KMS_KEY_ARN>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select the table.

  3. Open the Additional settings tab and choose to manage the encryption settings.

  4. Select Owned by Amazon DynamoDB and save the changes.

CLI:

aws dynamodb update-table --table-name <TABLE_NAME> --region <REGION> --sse-specification Enabled=false

Note: rolling back removes your control over the encryption key and the CloudTrail record of its use. The table stays available while the encryption key is being changed.

Reference