DynamoDB Tables Should Have Autoscaling Enabled

Using Console

To remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using the AWS Management Console, follow these steps:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your AWS account.
Navigate to DynamoDB Service: Click on the “Services” at the top left corner of the console, then select “DynamoDB” under the Database category.
Select the Table: From the list of DynamoDB tables, select the table for which you want to enable autoscaling.
Modify Table: In the table details page, click on the “Capacity” tab.
Enable Autoscaling: Under the “Table settings” section, find the “Auto Scaling” option and click on the “Modify” button.
Configure Autoscaling: In the “Auto Scaling” section, you can configure the read and write capacity settings for autoscaling. You can choose to enable autoscaling for read capacity, write capacity, or both.
Set Capacity Limits: Set the minimum and maximum capacity units for the read and write capacity. You can also set the target utilization percentage for autoscaling.
Save Changes: Once you have configured the autoscaling settings, click on the “Save” button to apply the changes.
Verify Autoscaling: After saving the changes, DynamoDB will start autoscaling the read and write capacity based on the configured settings.

By following these steps, you can remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using AWS CLI, follow these steps:

List all the DynamoDB tables in your AWS account to identify which tables do not have autoscaling enabled:

aws dynamodb list-tables

For each table that does not have autoscaling enabled, update the table to enable autoscaling using the following command:

aws dynamodb update-table \
    --table-name YOUR_TABLE_NAME \
    --billing-mode PAY_PER_REQUEST \
    --provisioned-throughput ReadCapacityAutoScalingSettings={MinimumCapacity=1,MaximumCapacity=100,AutoScalingDisabled=false,TargetTrackingScalingPolicy={TargetValue=70.0,PredefinedMetricSpecification={PredefinedMetricType=DynamoDBReadCapacityUtilization}}},WriteCapacityAutoScalingSettings={MinimumCapacity=1,MaximumCapacity=100,AutoScalingDisabled=false,TargetTrackingScalingPolicy={TargetValue=70.0,PredefinedMetricSpecification={PredefinedMetricType=DynamoDBWriteCapacityUtilization}}}

Replace YOUR_TABLE_NAME with the name of the DynamoDB table that you want to enable autoscaling for.

Verify that autoscaling is enabled for the DynamoDB table by describing the table and checking the BillingMode and ProvisionedThroughput settings:

aws dynamodb describe-table --table-name YOUR_TABLE_NAME

By following these steps, you can remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using Python, follow these steps:

Import the necessary libraries:

import boto3

Initialize the DynamoDB client:

dynamodb = boto3.client('dynamodb')

List all the DynamoDB tables:

response = dynamodb.list_tables()
tables = response['TableNames']

Enable autoscaling for each table:

for table_name in tables:
    response = dynamodb.update_table(
        TableName=table_name,
        ProvisionedThroughput={
            'ReadCapacityUnits': 5,  # Set your desired read capacity units
            'WriteCapacityUnits': 5  # Set your desired write capacity units
        },
        BillingMode='PROVISIONED',  # Set the billing mode to PROVISIONED
        GlobalSecondaryIndexUpdates=[
            {
                'Update': {
                    'IndexName': 'string',
                    'ProvisionedThroughput': {
                        'ReadCapacityUnits': 5,  # Set your desired read capacity units
                        'WriteCapacityUnits': 5  # Set your desired write capacity units
                    }
                }
            },
        ],
        StreamSpecification={
            'StreamEnabled': False
        },
        SSESpecification={
            'Enabled': False
        },
        TimeToLiveSpecification={
            'Enabled': False
        },
        BillingMode='PAY_PER_REQUEST'  # Set the billing mode to PAY_PER_REQUEST for autoscaling
    )

Replace the placeholder values like 'ReadCapacityUnits': 5 and 'WriteCapacityUnits': 5 with your desired values for read and write capacity units.
Run the Python script to enable autoscaling for all DynamoDB tables.

By following these steps and running the Python script, you can remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS.

Using Terraform

resource "aws_dynamodb_table" "this" {
  name         = "TABLE_NAME" # replace with your table name
  hash_key     = "HASH_KEY_NAME"
  billing_mode = "PROVISIONED"

  read_capacity  = 5
  write_capacity = 5

  attribute {
    name = "HASH_KEY_NAME" # replace with your hash key attribute name
    type = "S"
  }
}

# Read capacity autoscaling target
resource "aws_appautoscaling_target" "dynamodb_read_capacity" {
  max_capacity       = 100
  min_capacity       = 5
  resource_id        = "table/${aws_dynamodb_table.this.name}"
  scalable_dimension = "dynamodb:table:ReadCapacityUnits"
  service_namespace  = "dynamodb"
}

# Read capacity autoscaling policy
resource "aws_appautoscaling_policy" "dynamodb_read_capacity" {
  name               = "DynamoDBReadCapacityUtilization:table/${aws_dynamodb_table.this.name}"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.dynamodb_read_capacity.resource_id
  scalable_dimension = aws_appautoscaling_target.dynamodb_read_capacity.scalable_dimension
  service_namespace  = aws_appautoscaling_target.dynamodb_read_capacity.service_namespace

  target_tracking_scaling_policy_configuration {
    target_value = 70.0

    predefined_metric_specification {
      predefined_metric_type = "DynamoDBReadCapacityUtilization"
    }

    scale_in_cooldown  = 60
    scale_out_cooldown = 60
  }
}

# Write capacity autoscaling target
resource "aws_appautoscaling_target" "dynamodb_write_capacity" {
  max_capacity       = 100
  min_capacity       = 5
  resource_id        = "table/${aws_dynamodb_table.this.name}"
  scalable_dimension = "dynamodb:table:WriteCapacityUnits"
  service_namespace  = "dynamodb"
}

# Write capacity autoscaling policy
resource "aws_appautoscaling_policy" "dynamodb_write_capacity" {
  name               = "DynamoDBWriteCapacityUtilization:table/${aws_dynamodb_table.this.name}"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.dynamodb_write_capacity.resource_id
  scalable_dimension = aws_appautoscaling_target.dynamodb_write_capacity.scalable_dimension
  service_namespace  = aws_appautoscaling_target.dynamodb_write_capacity.service_namespace

  target_tracking_scaling_policy_configuration {
    target_value = 70.0

    predefined_metric_specification {
      predefined_metric_type = "DynamoDBWriteCapacityUtilization"
    }

    scale_in_cooldown  = 60
    scale_out_cooldown = 60
  }
}

This change does not force replacement of the existing table as long as billing_mode = "PROVISIONED" is already set; changing the billing mode from PAY_PER_REQUEST to PROVISIONED would force replacement and a potential outage.Verification: terraform plan should show the DynamoDB table unchanged (if already provisioned) and four new resources to be added: two aws_appautoscaling_target and two aws_appautoscaling_policy with the capacities, target value, and cooldowns above.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

DynamoDB Tables Should Have Autoscaling Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: