Back to Checks
aws

DynamoDB DAX cluster has encryption at rest enabled

dynamodb_accelerator_cluster_encryption_enabled
Service: dynamodbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

Amazon DynamoDB Accelerator (DAX) clusters are evaluated for server-side encryption at rest. The finding indicates whether the cluster's on-disk cache, configuration, and logs are encrypted using service-managed keys.

Prowler logoProwlerprowler-provider-aws

Risk

Without encryption at rest, DAX on-disk cache and logs can be extracted from underlying storage by those with low-level access, compromising confidentiality and enabling offline data mining.

Threats:

  • Compromised host or admin
  • Lost/retired media
  • Unauthorized backups or snapshots

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dynamodb_accelerator_cluster_encryption_enabled

Recommendation

Provision DAX clusters with encryption at rest enabled. Apply least privilege for DAX administration and data access, and monitor with logging.

Adopt defense in depth: enable encryption in transit, restrict network exposure, and avoid caching highly sensitive data. Re-create unencrypted clusters to enforce this setting.

Remediation

CLI

aws dax create-cluster --cluster-name <example_resource_name> --node-type <NODE_TYPE> --replication-factor 1 --iam-role-arn <example_resource_id> --sse-specification Enabled=true

Terraform

resource "aws_dax_cluster" "example" {
  cluster_name       = "<example_resource_name>"
  node_type          = "<NODE_TYPE>"
  replication_factor = 1
  iam_role_arn       = "<example_resource_id>"

  # Critical: enables encryption at rest
  server_side_encryption {
    enabled = true  # Encrypts DAX cluster data at rest
  }
}

NativeIaC

Resources:
  DaxCluster:
    Type: AWS::DAX::Cluster
    Properties:
      ClusterName: <example_resource_name>
      NodeType: <NODE_TYPE>
      ReplicationFactor: 1
      IAMRoleARN: <example_resource_id>
      SSESpecification:           # Critical: enables encryption at rest
        SSEEnabled: true          # Encrypts DAX cluster data at rest

Other

1In the AWS console, open **DynamoDB** > under **DAX**, choose **Clusters** > **Create cluster**
2Enter a name and choose a node type
3In **Encryption**, select **Enable encryption**
4Choose the IAM role and required networking, then click **Launch cluster**
5If replacing an existing unencrypted cluster: point your application to the new cluster endpoint, then delete the old cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dynamodb.dax_client import dax_client


class dynamodb_accelerator_cluster_encryption_enabled(Check):
    def execute(self):
        findings = []
        for cluster in dax_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"DAX cluster {cluster.name} does not have encryption at rest enabled."
            )
            if cluster.encryption:
                report.status = "PASS"
                report.status_extended = (
                    f"DAX cluster {cluster.name} has encryption at rest enabled."
                )
            findings.append(report)
        return findings

References