Back to Checks
aws

DynamoDB table is encrypted at rest with AWS KMS

dynamodb_tables_kms_cmk_encryption_enabled
Service: dynamodbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsDynamoDbTable

DynamoDB tables use AWS KMS keys (KMS) for encryption at rest instead of the default service-owned key

Prowler logoProwlerprowler-provider-aws

Risk

Relying on the default service-owned key reduces control over confidentiality: no custom key policies, limited auditability, and no independent rotation or disablement. This weakens least-privilege enforcement and incident response, and can impede meeting mandates that require customer-controlled keys.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dynamodb_tables_kms_cmk_encryption_enabled

Recommendation

Encrypt tables with KMS keys in your account-prefer customer-managed keys for sensitive data.

  • Enforce least-privilege key policies and scope grants
  • Enable rotation and monitor key usage
  • Separate duties for key admins vs data users
  • Restrict which principals can use the key for DynamoDB

Remediation

CLI

aws dynamodb update-table --table-name <example_resource_name> --sse-specification Enabled=true,SSEType=KMS

Terraform

resource "aws_dynamodb_table" "<example_resource_name>" {
  name         = "<example_resource_name>"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "id"

  attribute {
    name = "id"
    type = "S"
  }

  server_side_encryption {
    enabled = true  # Critical: enables AWS KMS encryption (uses AWS managed key if no key ARN provided)
  }
}

NativeIaC

# CloudFormation: Enable KMS encryption on a DynamoDB table
Resources:
  <example_resource_name>:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST
      SSESpecification:
        SSEEnabled: true  # Critical: enables KMS-based encryption
        SSEType: KMS      # Critical: switches from DEFAULT to AWS KMS

Other

1Open the AWS Management Console and go to DynamoDB
2Select your table
3In Table details, find Encryption at rest and click Edit
4Select AWS KMS: choose AWS managed key (alias/aws/dynamodb) or a customer managed key
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dynamodb.dynamodb_client import dynamodb_client


class dynamodb_tables_kms_cmk_encryption_enabled(Check):
    def execute(self):
        findings = []
        for table in dynamodb_client.tables.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=table)
            report.status = "FAIL"
            report.status_extended = (
                f"DynamoDB table {table.name} is using DEFAULT encryption."
            )
            if table.encryption_type == "KMS":
                report.status = "PASS"
                report.status_extended = f"DynamoDB table {table.name} has KMS encryption enabled with key {table.kms_arn.split('/')[1]}."
            findings.append(report)
        return findings

References