More Info:
Amazon DynamoDB tables should be using AWS-managed Customer Master Keys (CMKs) instead of AWS-owned CMKs for Server-Side Encryption (SSE), in order to meet strict encryption compliance and regulatory requirements. DynamoDB supports to switch from AWS-owned CMKs to customer-managed CMKs managed using Amazon Key Management Service (KMS), without any code to encrypt the data.Risk Level
HighAddress
SecurityCompliance Standards
SOC2, GDPR, HIPAA, NIST, ISO27001Remediation
How to reconfigure existing DynamoDB tables to use AWS-managed CMKs for Server-Side Encryption?Using AWS Console
- Open the AWS Management Console and navigate to the DynamoDB service.
- Select the desired DynamoDB table that you want to reconfigure. (In the Cloudanix Console, navigate to “Misconfig” page and look for Affected Assets for “AWS DynamoDB Tables Should Use KMS CMKs for Encryption” Policy.)
- Click on the “Manage DynamoDB” button or access the table configuration settings.
- In the table configuration settings, locate the “Encryption” section.
- Check if the table is already encrypted. If it is not, proceed to the next step.
- Click on the “Edit” button or the appropriate option to modify the encryption settings.
- In the encryption settings, choose the option to enable encryption and select “AWS managed key” as the encryption type.
- From the drop-down menu, select the AWS-managed CMK that you want to use for server-side encryption.
- Review any additional encryption-related settings, such as the type of encryption algorithm.
- Save the changes to apply the new encryption configuration to the DynamoDB table.