Back to Checks
aws

DynamoDB Accelerator (DAX) cluster has encryption in transit enabled

dynamodb_accelerator_cluster_in_transit_encryption_enabled
Service: dynamodbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

DAX clusters have endpoint encryption set to TLS, enforcing encryption in transit for client connections to the cluster

Prowler logoProwlerprowler-provider-aws

Risk

Missing TLS enables interception and manipulation of DAX traffic, impacting:

  • Confidentiality: exposure of queries, data, or credentials
  • Integrity: tampered requests/responses and cache poisoning
  • Availability: session hijacking or replay causing service disruption

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dynamodb_accelerator_cluster_in_transit_encryption_enabled

Recommendation

Enforce TLS for all DAX endpoints and clients (encryption in transit). If an existing cluster lacks it, create a new TLS-enabled cluster and migrate.

Apply defense in depth: restrict network paths, keep access private, and use least privilege IAM to reduce blast radius.

Remediation

CLI

aws dax create-cluster --cluster-name <cluster-name> --node-type <node-type> --replication-factor <replication-factor> --cluster-endpoint-encryption-type TLS

Terraform

# DAX cluster with encryption in transit enabled
resource "aws_dax_cluster" "<example_resource_name>" {
  cluster_name                      = "<example_resource_name>"
  node_type                         = "<example_node_type>"
  replication_factor                = 1
  iam_role_arn                      = "<example_resource_id>"
  cluster_endpoint_encryption_type  = "TLS"  # Critical: Enables TLS for in-transit encryption
}

NativeIaC

# CloudFormation: Create DAX cluster with TLS (encryption in transit)
Resources:
  <example_resource_name>:
    Type: AWS::DAX::Cluster
    Properties:
      ClusterName: <example_resource_name>
      IAMRoleARN: <example_resource_id>
      NodeType: <example_node_type>
      ReplicationFactor: 1
      ClusterEndpointEncryptionType: TLS  # Critical: Enables TLS for in-transit encryption

Other

1In the AWS Console, go to DynamoDB > DAX
2Click Create cluster
3Set Cluster name, Node type, Replication factor, and IAM role
4Enable Encryption in transit (TLS)
5Create the cluster and wait until ACTIVE
6Update your application to use the new DAX cluster endpoint
7Delete the old non-TLS DAX cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dynamodb.dax_client import dax_client


class dynamodb_accelerator_cluster_in_transit_encryption_enabled(Check):
    def execute(self):
        findings = []
        for cluster in dax_client.clusters:
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = f"DAX cluster {cluster.name} does not have encryption in transit enabled."
            if cluster.tls_encryption:
                report.status = "PASS"
                report.status_extended = (
                    f"DAX cluster {cluster.name} has encryption in transit enabled."
                )
            findings.append(report)
        return findings

References