Skip to content

AWS AppSync API caches should be encrypted at rest

Identifier

appsync-enable-at-rest-encryption

Category

Protect > Data Protection > Encryption of data-at-rest

Description

This control checks whether AWS AppSync API caches are configured to use encryption at rest. Enabling encryption at rest for AppSync API caching ensures that cached data is protected from unauthorized access while stored in memory.

AppSync API caching is backed by AWS ElastiCache for Redis. When enabled, encryption at rest can be enforced by setting the at_rest_encryption_enabled flag to true in the Terraform aws_appsync_api_cache resource.

Non Compliant Example

Terraform
1
2
3
4
5
6
resource "aws_appsync_api_cache" "foo" {
  api_id                        = aws_appsync_graphql_api.foo.id
  api_caching_behavior       = "FULL_REQUEST_CACHING"
  type                       = "LARGE"
  ttl                        = 500
}

Remediation

To ensure cache encryption at rest, set at_rest_encryption_enabled = true:

Terraform
1
2
3
4
5
6
7
resource "aws_appsync_api_cache" "foo" {
  api_id                        = aws_appsync_graphql_api.foo.id
  api_caching_behavior       = "FULL_REQUEST_CACHING"
  type                       = "LARGE"
  ttl                        = 500
  at_rest_encryption_enabled = true
}

Extra Resources