# Ensure DynamoDB table is encrypted at rest with AWS KMS

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292238500411-ensure-dynamodb-table-is-encrypted-at-rest-with-aws-kms
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon DynamoDB table is encrypted at rest with an AWS KMS key in your account, either the AWS managed key aws/dynamodb or a customer managed key, instead of the default AWS owned key. All DynamoDB tables are encrypted at rest; this setting only controls which type of key protects the data.

**Rationale**

With the default AWS owned key, you cannot see or control the key: there is no key policy to manage, no record of key usage in AWS CloudTrail, and no way to rotate or disable the key yourself. This limits least-privilege enforcement, auditing and incident response, and may not meet requirements for customer-controlled keys. Using a KMS key in your account, preferably a customer managed key for sensitive data, provides key-policy control, usage auditing and the ability to revoke access.

**Impact**

-   Adds key-policy based control and CloudTrail auditing of key usage
    
-   Helps meet compliance requirements for customer-controlled encryption keys
    
-   AWS KMS request charges apply, and customer managed keys also have a monthly key fee
    
-   If a customer managed key is disabled or scheduled for deletion, the table becomes inaccessible
    

**Default Value**

New DynamoDB tables are encrypted at rest with an AWS owned key unless a different key type is chosen when the table is created.

**Pre-Requisites**

-   IAM permissions: dynamodb:ListTables, dynamodb:DescribeTable, dynamodb:UpdateTable, kms:DescribeKey, kms:CreateGrant and kms:ListAliases
    
-   For a customer managed key: a symmetric KMS key in the same region whose key policy allows the principals that use the table to use the key through DynamoDB
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select **Tables**.
    
3.  Select a table and open the **Additional settings** tab.
    
4.  In the encryption section, check the key type.
    
5.  Repeat for each table in each region in use.
    
6.  If any table uses the key **Owned by Amazon DynamoDB**, follow the implementation steps.
    

**CLI:**

List the tables in a region:

aws dynamodb list-tables --region <REGION> --query "TableNames"

Show the encryption settings of a table:

aws dynamodb describe-table --table-name <TABLE\_NAME> --region <REGION> --query "Table.SSEDescription.\[Status,SSEType,KMSMasterKeyArn\]"

A table fails if SSEType is not KMS (an empty result means the AWS owned key is used).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select **Tables**.
    
3.  Select the table and open the **Additional settings** tab.
    
4.  In the encryption section, choose to manage the encryption settings.
    
5.  Select **AWS managed key** or **Stored in your account, and owned and managed by you** (customer managed key) and choose the key.
    
6.  Save the changes.
    
7.  Repeat for each affected table in each region in use.
    

**CLI:**

Encrypt the table with the AWS managed key aws/dynamodb:

aws dynamodb update-table --table-name <TABLE\_NAME> --region <REGION> --sse-specification Enabled=true,SSEType=KMS

Or encrypt the table with a customer managed key:

aws dynamodb update-table --table-name <TABLE\_NAME> --region <REGION> --sse-specification Enabled=true,SSEType=KMS,KMSMasterKeyId=<KMS\_KEY\_ARN>

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select the table.
    
3.  Open the **Additional settings** tab and choose to manage the encryption settings.
    
4.  Select **Owned by Amazon DynamoDB** and save the changes.
    

**CLI:**

aws dynamodb update-table --table-name <TABLE\_NAME> --region <REGION> --sse-specification Enabled=false

Note: rolling back removes your control over the encryption key and the CloudTrail record of its use. The table stays available while the encryption key is being changed.

**Reference**

-   [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html)
    
-   [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.howitworks.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.howitworks.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-table.html](https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-table.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.