DynamoDB Accelerator (DAX) Cluster Should Be Encrypted

Using Console

Below are the console steps. Because DAX does not support turning on encryption for an existing cluster, you must create a new encrypted cluster and then cut over your application.

1. Check current DAX cluster encryption status

Sign in to the AWS Management Console.
Go to DynamoDB.
In the left navigation pane, choose DAX (or go directly to the DAX console: https://console.aws.amazon.com/dax/home).
Select the DAX cluster in question.
On the Details tab, check:
- Encryption / Encryption at rest: If it says Disabled or Not encrypted, you need a new encrypted cluster.

2. Prepare a KMS key (if you don’t want to use the AWS-managed key)

If you’re OK with the AWS-managed key for DAX, you can skip this.

Go to the AWS KMS console.
Choose Customer managed keys → Create key.
Select Symmetric and Encrypt and decrypt.
Configure:
- Key administrators (who can manage the key).
- Key users (roles your DAX cluster and applications will use).
Finish key creation and note the KMS Key ID / ARN.

3. Create a new encrypted DAX cluster

Go to the DAX console.
Click Create cluster.
Configure:
- Cluster name: New name (e.g., my-app-dax-encrypted).
- Node type, Number of nodes, and Replication factor to match your existing cluster (or adjust as required).
Under Security / Encryption:
- Turn Encryption at rest to Enabled.
- For KMS key, choose:
  - AWS owned key or
  - Customer managed key you created (recommended if you need key control).
Choose the appropriate:
- VPC, subnet group, security groups, and IAM role so it can reach your DynamoDB tables and your application can reach DAX.
Click Create.
Wait until the new cluster status is Available.

4. Point your application to the new encrypted DAX cluster

In the DAX console, open the new encrypted cluster.
Copy the Cluster endpoint (e.g., my-app-dax-encrypted.xxxxxx.clustercfg.dax.use1.cache.amazonaws.com:8111).
In your application configuration:
- Update the DAX endpoint in your SDK/client configuration to the new cluster endpoint.
Deploy/restart your application so it connects to the new DAX cluster.
Monitor:
- DAX metrics (hit rate, CPU, latency) for the new cluster.
- Application logs for connection or timeout errors.

5. Decommission the old unencrypted cluster

Once you confirm the application is functioning correctly and traffic is fully on the new cluster:

Go to the DAX console.
Select the old (unencrypted) DAX cluster.
Choose Delete cluster.
Confirm the deletion.

6. (Optional) Validate compliance

Go to AWS Config or your security/compliance tool.
Re-run the check/rule (e.g., “DAX cluster should be encrypted at rest”).
Confirm that the violation is cleared for the new cluster.

Using CLI

For DynamoDB Accelerator (DAX), encryption at rest must be enabled when you create the cluster. It cannot be turned on for an existing cluster. Remediation via AWS CLI therefore means:

Create a new encrypted DAX cluster
Point your application to the new cluster
Delete the old unencrypted cluster

Below are step‑by‑step CLI commands.

1. (Optional) Create or choose a KMS key

If you want to use a customer-managed KMS key (recommended):

aws kms create-key --description "KMS key for DAX encryption"

Note the KeyId from the output (e.g. arn:aws:kms:us-east-1:123456789012:key/xxxx).Ensure the key policy allows DAX to use it (principal: dax.amazonaws.com) or just use the default AWS-managed key for DAX if acceptable.

2. (Optional) Create a subnet group for DAX

If you don’t already have one:

aws dax create-subnet-group \
  --subnet-group-name my-dax-subnet-group \
  --subnet-group-description "Subnet group for DAX" \
  --subnet-ids subnet-aaaaaaa subnet-bbbbbbb

3. Create a new encrypted DAX cluster

Use --sse-specification Enabled=true and (optionally) --sse-specification KmsKeyId=...:

aws dax create-cluster \
  --cluster-name my-encrypted-dax-cluster \
  --node-type dax.r5.large \
  --replication-factor 3 \
  --iam-role-arn arn:aws:iam::123456789012:role/my-dax-iam-role \
  --subnet-group-name my-dax-subnet-group \
  --security-group-ids sg-0123456789abcdef0 \
  --sse-specification Enabled=true,KmsKeyId=arn:aws:kms:us-east-1:123456789012:key/your-key-id

If you want to use the AWS-managed key for DAX instead of a customer key, omit KmsKeyId:

--sse-specification Enabled=true

Wait until the cluster is available:

aws dax describe-clusters --cluster-names my-encrypted-dax-cluster

4. Update your application configuration

Update your app to use the new cluster endpoint:

Get the endpoint:

aws dax describe-clusters --cluster-names my-encrypted-dax-cluster \
  --query "Clusters[0].ClusterDiscoveryEndpoint.Address" \
  --output text

Replace the old DAX endpoint in your app config with this new one.
Deploy/restart your app as needed and verify it is using the new cluster successfully.

5. Delete the old unencrypted DAX cluster

After you’ve confirmed all traffic is using the new encrypted cluster:

aws dax delete-cluster --cluster-name my-old-unencrypted-dax-cluster

(Optional) If the old subnet groups or parameter groups are no longer needed, delete them as well.

Key point: There is no modify-cluster option to enable encryption on an existing DAX cluster. The only compliant remediation is to recreate the cluster with --sse-specification Enabled=true.

Using Python

For DynamoDB DAX, encryption at rest must be enabled when the cluster is created; you cannot turn it on for an existing unencrypted cluster. Remediation is therefore:

Create a new encrypted DAX cluster.
Point your app to the new cluster.
Delete the old unencrypted cluster.

Below is a minimal, step‑by‑step using Python (boto3).

1. Prerequisites

pip install boto3
aws configure  # ensure correct region/credentials

Make sure your IAM user/role has permissions for:

dax:DescribeClusters
dax:CreateCluster
dax:UpdateCluster
dax:DeleteCluster
iam:PassRole (if using a service role)

2. Check current DAX cluster encryption status

import boto3

dax = boto3.client("dax", region_name="us-east-1")  # adjust region

cluster_name = "my-dax-cluster"

resp = dax.describe_clusters(ClusterNames=[cluster_name])
cluster = resp["Clusters"][0]

# In DAX, SSE is at-cluster level; if not present or False, it's unencrypted
sse_desc = cluster.get("SSEDescription", {})
status = sse_desc.get("Status")
print(f"SSE status: {status}")   # possible: 'ENABLING', 'ENABLED', 'DISABLING', 'DISABLED', or None

If status is None or DISABLED, you need a new encrypted cluster.

3. Create a new DAX cluster with encryption enabled

Key points:

Set SSESpecification={'Enabled': True}.
Use same node type, VPC, security groups, and subnet groups as the old cluster.
Optionally specify a KMS key via KmsKeyId (otherwise AWS-managed key is used).

import time
import boto3

dax = boto3.client("dax", region_name="us-east-1")

old_cluster_name = "my-dax-cluster"
new_cluster_name = "my-dax-cluster-encrypted"

# Get settings from existing cluster to reuse
old = dax.describe_clusters(ClusterNames=[old_cluster_name])["Clusters"][0]

params = {
    "ClusterName": new_cluster_name,
    "NodeType": old["NodeType"],
    "ReplicationFactor": old["ReplicationFactor"],
    "IamRoleArn": old["IamRoleArn"],
    "SubnetGroupName": old.get("SubnetGroup"),
    "SecurityGroupIds": old.get("SecurityGroups", []),
    "Description": f"Encrypted replacement for {old_cluster_name}",
    "SSESpecification": {"Enabled": True},   # enable encryption at rest
    # Optionally:
    # "KmsKeyId": "arn:aws:kms:region:account-id:key/key-id",
    # "ParameterGroupName": old.get("ParameterGroup", {}).get("ParameterGroupName"),
}

# Create encrypted cluster
create_resp = dax.create_cluster(**params)
print("Creating encrypted DAX cluster...")

# Wait until cluster is available
waiter_status = None
while waiter_status != "available":
    time.sleep(30)
    c = dax.describe_clusters(ClusterNames=[new_cluster_name])["Clusters"][0]
    waiter_status = c["Status"]
    print(f"Status: {waiter_status}")

4. Update your application to use the new cluster

Get the new cluster’s endpoint:

c = dax.describe_clusters(ClusterNames=[new_cluster_name])["Clusters"][0]
new_endpoint = c["ClusterDiscoveryEndpoint"]["Address"]
new_port = c["ClusterDiscoveryEndpoint"]["Port"]

print(f"New DAX endpoint: {new_endpoint}:{new_port}")

Update your app config / environment variables / secrets to use new_endpoint instead of the old one.
Redeploy / restart your application so it connects to the new encrypted DAX cluster.

DAX is a cache for DynamoDB, so there is no data migration; you only need to switch clients to the new cluster.

5. Delete the old unencrypted cluster

Once you’ve confirmed the app uses the new encrypted cluster and it’s stable:

response = dax.delete_cluster(ClusterName=old_cluster_name)
print("Deleting old unencrypted DAX cluster...")

You can also wait for deletion:

while True:
    try:
        dax.describe_clusters(ClusterNames=[old_cluster_name])
        print("Still deleting...")
        time.sleep(30)
    except dax.exceptions.ClusterNotFoundFault:
        print("Old cluster deleted.")
        break

6. (Optional) Wrap into a remediation script

You can encapsulate this logic (detect unencrypted → create encrypted → output new endpoint) into a script and run it for each non‑compliant cluster.

Using Terraform

resource "aws_dax_cluster" "DAX_CLUSTER" {
  # Replace DAX_CLUSTER with your cluster name in Terraform
  cluster_name       = "DAX_CLUSTER_NAME"     # set to the desired (new) cluster name, e.g. "<old>-encrypted"
  node_type          = "DAX_NODE_TYPE"        # e.g. "dax.r5.large"
  replication_factor = 3                      # replace with your desired node count

  iam_role_arn      = "DAX_IAM_ROLE_ARN"      # from the existing cluster
  subnet_group_name = "DAX_SUBNET_GROUP_NAME" # from the existing cluster
  security_group_ids = [
    "SG_ID_1",
    "SG_ID_2",
  ]

  # This enables server-side encryption at rest, matching `--sse-specification Enabled=true`
  server_side_encryption {
    enabled = true
  }

  # Optionally match other configuration from the existing cluster:
  # parameter_group_name = "DAX_PARAMETER_GROUP_NAME"
  # maintenance_window   = "dax:MON:01:00-MON:02:00"
  # notification_topic_arn = "SNS_TOPIC_ARN"
  # availability_zones     = ["AZ_1", "AZ_2", "AZ_3"]
}

Enabling server_side_encryption on an existing unencrypted DAX cluster forces replacement of the cluster; AWS does not support in‑place encryption, so Terraform will destroy the old cluster and create a new encrypted one (plan will show the aws_dax_cluster resource being replaced, with server_side_encryption.enabled changing from false (or null) to true).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

DynamoDB Accelerator (DAX) Cluster Should Be Encrypted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Check current DAX cluster encryption status

2. Prepare a KMS key (if you don’t want to use the AWS-managed key)

3. Create a new encrypted DAX cluster

4. Point your application to the new encrypted DAX cluster

5. Decommission the old unencrypted cluster

6. (Optional) Validate compliance

1. (Optional) Create or choose a KMS key

2. (Optional) Create a subnet group for DAX

3. Create a new encrypted DAX cluster

4. Update your application configuration

5. Delete the old unencrypted DAX cluster

1. Prerequisites

2. Check current DAX cluster encryption status

3. Create a new DAX cluster with encryption enabled

4. Update your application to use the new cluster

5. Delete the old unencrypted cluster

6. (Optional) Wrap into a remediation script

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Check current DAX cluster encryption status

​2. Prepare a KMS key (if you don’t want to use the AWS-managed key)

​3. Create a new encrypted DAX cluster

​4. Point your application to the new encrypted DAX cluster

​5. Decommission the old unencrypted cluster

​6. (Optional) Validate compliance

​1. (Optional) Create or choose a KMS key

​2. (Optional) Create a subnet group for DAX

​3. Create a new encrypted DAX cluster

​4. Update your application configuration

​5. Delete the old unencrypted DAX cluster

​1. Prerequisites

​2. Check current DAX cluster encryption status

​3. Create a new DAX cluster with encryption enabled

​4. Update your application to use the new cluster

​5. Delete the old unencrypted cluster

​6. (Optional) Wrap into a remediation script

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Check current DAX cluster encryption status

2. Prepare a KMS key (if you don’t want to use the AWS-managed key)

3. Create a new encrypted DAX cluster

4. Point your application to the new encrypted DAX cluster

5. Decommission the old unencrypted cluster

6. (Optional) Validate compliance

1. (Optional) Create or choose a KMS key

2. (Optional) Create a subnet group for DAX

3. Create a new encrypted DAX cluster

4. Update your application configuration

5. Delete the old unencrypted DAX cluster

1. Prerequisites

2. Check current DAX cluster encryption status

3. Create a new DAX cluster with encryption enabled

4. Update your application to use the new cluster

5. Delete the old unencrypted cluster

6. (Optional) Wrap into a remediation script

Additional Reading: