Notebook Data Should Be Encrypted

Using Console

For DynamoDB, “notebook data” translates to DynamoDB table data needing encryption at rest.DynamoDB already encrypts all table data at rest by default with an AWS-owned KMS key. If your requirement is stricter (e.g., must use a customer-managed KMS key), follow these steps in the AWS Console:

1. Confirm Encryption Status of the Table

Sign in to the AWS Management Console.
Go to DynamoDB.
In the left menu, click Tables.
Click the specific table.
Choose the Additional settings or Overview tab (depending on UI version).
Look for Encryption at rest:
- It should show something like:
  - Encryption type: AWS owned key
    or
  - KMS key: alias/aws/dynamodb
    or
  - KMS key: alias/your-cmk-alias

If encryption is already enabled (it always is), you only need remediation if your policy requires a customer-managed KMS key (CMK).

2. (If Required) Create a Customer-Managed KMS Key

In the console, open Key Management Service (KMS).
Click Customer managed keys → Create key.
Key type: Symmetric.
Key usage: Encrypt and decrypt.
Set Alias (e.g., alias/dynamodb-notebook-data).
Configure Key administrators and Key users:
- Ensure the IAM roles/services that use DynamoDB have permission to use this key.
Finish key creation.

3. Update DynamoDB Table to Use the Customer-Managed KMS Key

Note: DynamoDB encryption with AWS-owned/AWS-managed key is default; using a customer-managed key is an optional enhancement. UI labels may differ slightly between regions/UI versions but the flow is similar.

Go back to DynamoDB → Tables.
Select the table.
Go to Additional settings or Table details.
Find the Encryption at rest section.
Click Edit (or Manage encryption).
Change encryption from AWS owned key or default key to Customer managed key.
From the dropdown, choose your new KMS key alias (e.g., alias/dynamodb-notebook-data).
Save/Apply the change.

DynamoDB will handle re-encryption transparently; no application changes are needed.

4. Validate Compliance

Re-open the table Details/Additional settings.
Confirm:
- Encryption at rest is Enabled.
- KMS key now references your customer-managed CMK alias.
Optionally, in KMS → Customer managed keys, open the key and check Key usage / CloudTrail to see DynamoDB using the key.

If your policy only says “must be encrypted,” DynamoDB’s default (AWS-owned key) already satisfies that; the remediation is primarily confirming and documenting that encryption at rest is enabled and enforced for all DynamoDB tables storing notebook data.

Using CLI

Below are the minimal, step‑by‑step AWS CLI steps to ensure DynamoDB “Notebook Data” is encrypted at rest.

1. Identify the DynamoDB table(s)

If you already know the table name, skip to step 2.

aws dynamodb list-tables

Assume your table is called notebook-data-table (replace with your actual name).

2. Check current encryption status

aws dynamodb describe-table \
  --table-name notebook-data-table \
  --query "Table.SSEDescription"

Look at:

Status (ENABLED, ENABLING, DISABLED)
SSEType (KMS)
KMSMasterKeyArn (if using a CMK)

If Status is DISABLED or not present, encryption is not enabled.

3. (Optional) Choose or create a KMS key

If you want to use an AWS-managed key for DynamoDB (simplest), skip to step 4.To create a customer-managed KMS key:

aws kms create-key \
  --description "CMK for DynamoDB Notebook Data Encryption" \
  --query "KeyMetadata.KeyId" \
  --output text

Note the returned KeyId or ARN.
Ensure the key policy allows DynamoDB and relevant IAM principals to use it.

4. Enable encryption on the table

Option A – Use AWS-owned key (default encryption)

aws dynamodb update-table \
  --table-name notebook-data-table \
  --sse-specification Enabled=true

Option B – Use AWS-managed KMS key for DynamoDB

aws dynamodb update-table \
  --table-name notebook-data-table \
  --sse-specification Enabled=true,SSEType=KMS

Option C – Use your own customer-managed KMS key

Replace <kms-key-arn-or-id> with your key:

aws dynamodb update-table \
  --table-name notebook-data-table \
  --sse-specification Enabled=true,SSEType=KMS,KMSMasterKeyId=<kms-key-arn-or-id>

5. Confirm encryption is enabled

Run again:

aws dynamodb describe-table \
  --table-name notebook-data-table \
  --query "Table.SSEDescription"

You should see:

Status: ENABLED
SSEType: KMS
KMSMasterKeyArn: set (if using KMS)

Once done, the DynamoDB table storing notebook data is encrypted at rest.

Using Python

To encrypt DynamoDB “notebook data” at rest, you need to ensure the DynamoDB table has Server-Side Encryption (SSE) enabled, preferably with a customer-managed KMS key. Below are step-by-step instructions using Python (boto3).

1. Prerequisites

boto3 installed:
pip install boto3
AWS credentials configured (via aws configure, environment variables, or an IAM role).
IAM permissions for:
- dynamodb:DescribeTable
- dynamodb:UpdateTable
- kms:CreateKey (if you’ll create a new CMK)
- kms:DescribeKey
- kms:EnableKeyRotation
- kms:PutKeyPolicy (as needed)

2. (Optional) Create a customer-managed KMS key for DynamoDB

If you want to use your own CMK instead of the AWS-owned key:

import boto3

kms = boto3.client('kms', region_name='us-east-1')  # choose your region

response = kms.create_key(
    Description='CMK for encrypting DynamoDB notebook data',
    KeyUsage='ENCRYPT_DECRYPT',
    Origin='AWS_KMS'
)

cmk_arn = response['KeyMetadata']['Arn']
print("Created KMS CMK:", cmk_arn)

# (Optional but recommended) enable key rotation
kms.enable_key_rotation(KeyId=cmk_arn)

Keep cmk_arn – you’ll use it in the DynamoDB SSE config.

3. Check current encryption status of the DynamoDB table

import boto3

dynamodb = boto3.client('dynamodb', region_name='us-east-1')  # choose your region
table_name = 'your-notebook-data-table'

desc = dynamodb.describe_table(TableName=table_name)
print(desc['Table'].get('SSEDescription', 'No SSEDescription found'))

Look at:

SSEDescription['Status'] (e.g., ENABLED, ENABLING, DISABLED)
SSEDescription['SSEType'] (e.g., KMS)
SSEDescription['KMSMasterKeyArn'] (if using CMK)

4. Enable or update server-side encryption on the table

Option A – Use AWS owned key (simpler)

dynamodb.update_table(
    TableName=table_name,
    SSESpecification={
        'Enabled': True,
        'SSEType': 'KMS'  # with no KMSMasterKeyId, DynamoDB uses the AWS owned key
    }
)

Option B – Use customer-managed CMK (more control)

Use the cmk_arn from step 2:

cmk_arn = 'arn:aws:kms:us-east-1:123456789012:key/your-key-id-or-arn'

dynamodb.update_table(
    TableName=table_name,
    SSESpecification={
        'Enabled': True,
        'SSEType': 'KMS',
        'KMSMasterKeyId': cmk_arn
    }
)

5. Wait for encryption to finish and verify

import time

while True:
    desc = dynamodb.describe_table(TableName=table_name)
    sse = desc['Table'].get('SSEDescription', {})
    status = sse.get('Status')
    print("SSE Status:", status)

    if status in ['ENABLED', 'UPDATING']:
        break
    time.sleep(5)

print("Final SSEDescription:", sse)

Ensure:

Status is ENABLED
SSEType is KMS
KMSMasterKeyArn is set (if using CMK)

6. Enforce encryption via IaC / policy (optional but recommended)

To prevent future unencrypted tables:

Use IaC (CloudFormation/Terraform) with SSESpecification always set.
Add AWS Config rule dynamodb-table-encryption-enabled and remediate non-compliant tables with an automation script similar to the above.

This ensures that all “notebook data” stored in DynamoDB is encrypted at rest.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Notebook Data Should Be Encrypted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Confirm Encryption Status of the Table

2. (If Required) Create a Customer-Managed KMS Key

3. Update DynamoDB Table to Use the Customer-Managed KMS Key

4. Validate Compliance

1. Identify the DynamoDB table(s)

2. Check current encryption status

3. (Optional) Choose or create a KMS key

4. Enable encryption on the table

Option A – Use AWS-owned key (default encryption)

Option B – Use AWS-managed KMS key for DynamoDB

Option C – Use your own customer-managed KMS key

5. Confirm encryption is enabled

1. Prerequisites

2. (Optional) Create a customer-managed KMS key for DynamoDB

3. Check current encryption status of the DynamoDB table

4. Enable or update server-side encryption on the table

Option A – Use AWS owned key (simpler)

Option B – Use customer-managed CMK (more control)

5. Wait for encryption to finish and verify

6. Enforce encryption via IaC / policy (optional but recommended)

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Confirm Encryption Status of the Table

​2. (If Required) Create a Customer-Managed KMS Key

​3. Update DynamoDB Table to Use the Customer-Managed KMS Key

​4. Validate Compliance

​1. Identify the DynamoDB table(s)

​2. Check current encryption status

​3. (Optional) Choose or create a KMS key

​4. Enable encryption on the table

​Option A – Use AWS-owned key (default encryption)

​Option B – Use AWS-managed KMS key for DynamoDB

​Option C – Use your own customer-managed KMS key

​5. Confirm encryption is enabled

​1. Prerequisites

​2. (Optional) Create a customer-managed KMS key for DynamoDB

​3. Check current encryption status of the DynamoDB table

​4. Enable or update server-side encryption on the table

​Option A – Use AWS owned key (simpler)

​Option B – Use customer-managed CMK (more control)

​5. Wait for encryption to finish and verify

​6. Enforce encryption via IaC / policy (optional but recommended)

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Confirm Encryption Status of the Table

2. (If Required) Create a Customer-Managed KMS Key

3. Update DynamoDB Table to Use the Customer-Managed KMS Key

4. Validate Compliance

1. Identify the DynamoDB table(s)

2. Check current encryption status

3. (Optional) Choose or create a KMS key

4. Enable encryption on the table

Option A – Use AWS-owned key (default encryption)

Option B – Use AWS-managed KMS key for DynamoDB

Option C – Use your own customer-managed KMS key

5. Confirm encryption is enabled

1. Prerequisites

2. (Optional) Create a customer-managed KMS key for DynamoDB

3. Check current encryption status of the DynamoDB table

4. Enable or update server-side encryption on the table

Option A – Use AWS owned key (simpler)

Option B – Use customer-managed CMK (more control)

5. Wait for encryption to finish and verify

6. Enforce encryption via IaC / policy (optional but recommended)

Additional Reading: