AWS DynamoDB Tables Should Use KMS CMKs for Encryption

Using Console

To remediate the misconfiguration of AWS DynamoDB tables not using KMS CMKs for encryption, you can follow these steps using the AWS Management Console:

Sign in to the AWS Management Console: Go to the AWS Management Console and sign in to your account.
Navigate to DynamoDB: From the services menu, select DynamoDB to access the DynamoDB dashboard.
Select the DynamoDB Table: Locate the DynamoDB table that you want to remediate and click on its name to open the table details.
Configure Encryption: In the table details, click on the “Manage” tab and then select the “Encryption” option.
Enable Server-Side Encryption: In the Encryption settings, select the option to enable server-side encryption.
Choose KMS CMK: Choose the option to use a KMS key to encrypt the DynamoDB table. You can either select an existing KMS CMK or create a new one.
Save Changes: Once you have selected the appropriate KMS CMK, save the changes to apply the encryption settings to the DynamoDB table.
Verify Encryption: After saving the changes, verify that the encryption settings have been successfully applied to the DynamoDB table.

By following these steps, you can remediate the misconfiguration of AWS DynamoDB tables not using KMS CMKs for encryption and ensure that the data in the table is encrypted using a KMS key for improved security.

Using CLI

To remediate the misconfiguration of AWS DynamoDB tables not using KMS CMKs for encryption, you can follow these steps using AWS CLI:

List DynamoDB tables without KMS encryption: Run the following command to list all DynamoDB tables that do not use KMS encryption:
aws dynamodb list-tables
Enable encryption with KMS CMK for DynamoDB table: For each DynamoDB table that does not use KMS encryption, you can enable encryption with a KMS CMK by following these steps:
- Identify the KMS Key ID that you want to use for encryption. You can list the available KMS keys using:
  aws kms list-keys
- Update the DynamoDB table to enable encryption with the chosen KMS key. Replace TABLE_NAME and KMS_KEY_ID with your actual values:
  aws dynamodb update-table --table-name TABLE_NAME --sse-specification Enabled=true,KMSMasterKeyId=KMS_KEY_ID
Verify encryption status: You can verify that encryption with KMS CMK has been enabled for the DynamoDB table by describing the table:
aws dynamodb describe-table --table-name TABLE_NAME
Repeat for other DynamoDB tables: Repeat steps 2 and 3 for each DynamoDB table that does not use KMS encryption.

By following these steps, you can remediate the misconfiguration of AWS DynamoDB tables not using KMS CMKs for encryption.

Using Python

To remediate the misconfiguration of AWS DynamoDB tables not using KMS CMKs for encryption, you can follow these steps using Python and the AWS SDK (boto3):

Install the AWS SDK for Python (boto3) if you haven’t already:

pip install boto3

Use the following Python script to update the encryption settings for your DynamoDB tables to use a KMS Customer Master Key (CMK) for encryption:

import boto3

# Initialize the DynamoDB client
dynamodb = boto3.client('dynamodb')

# Get a list of all DynamoDB tables in your account
response = dynamodb.list_tables()
tables = response['TableNames']

# Iterate through each table and update the encryption settings
for table_name in tables:
    try:
        # Update the table to use a KMS CMK for encryption
        response = dynamodb.update_table(
            TableName=table_name,
            SSESpecification={
                'Enabled': True,
                'SSEType': 'KMS',
                'KMSMasterKeyId': 'YOUR_KMS_CMK_ARN'
            }
        )
        print(f"Updated encryption settings for table {table_name}")
    except Exception as e:
        print(f"Error updating encryption settings for table {table_name}: {e}")

Replace 'YOUR_KMS_CMK_ARN' with the ARN of the KMS CMK that you want to use for encryption.
Run the Python script to update the encryption settings for all DynamoDB tables in your AWS account to use the specified KMS CMK for encryption.

By following these steps, you can remediate the misconfiguration of AWS DynamoDB tables not using KMS CMKs for encryption.

Using Terraform

resource "aws_dynamodb_table" "this" {
  name         = "TABLE_NAME"            # replace with your DynamoDB table name
  billing_mode = "PAY_PER_REQUEST"

  hash_key = "PARTITION_KEY_NAME"        # replace with your key schema
  attribute {
    name = "PARTITION_KEY_NAME"
    type = "S"
  }

  # Ensure the table uses a customer-managed KMS key for SSE
  server_side_encryption {
    enabled     = true
    sse_type    = "KMS"
    kms_key_arn = aws_kms_key.dynamodb_sse.arn
  }
}

resource "aws_kms_key" "dynamodb_sse" {
  description         = "CMK for DynamoDB table TABLE_NAME encryption at rest"
  enable_key_rotation = true

  # Ensure the key policy allows the DynamoDB service principal to use this key:
  # - kms:Encrypt
  # - kms:Decrypt
  # - kms:ReEncrypt*
  # - kms:GenerateDataKey*
  # - kms:DescribeKey
  # Example (replace ACCOUNT_ID and adjust principals as needed):
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAccountAdmins",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::ACCOUNT_ID:root" },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowDynamoDBUseOfTheKey",
      "Effect": "Allow",
      "Principal": { "Service": "dynamodb.amazonaws.com" },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

This change updates the table’s server-side encryption from the AWS-owned CMK to the specified customer-managed KMS key without replacing the table; AWS performs the re-encryption in the background while the table remains available.Verification: terraform plan should show an in-place update of aws_dynamodb_table.this.server_side_encryption with enabled = true, sse_type = "KMS", and kms_key_arn changing from the previous value (or null/AWS-owned key) to the ARN of aws_kms_key.dynamodb_sse.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

AWS DynamoDB Tables Should Use KMS CMKs for Encryption

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: