Skip to content

Amazon DynamoDB Accelerator (DAX) clusters should be encrypted at rest

Identifier

dynamodb-dax-enable-at-rest-encryption

Category

Protect > Data protection > Encryption of data at rest

Description

This control checks whether an Amazon DynamoDB Accelerator (DAX) cluster is encrypted at rest, by verifying that the server_side_encryption.enabled is set to true in the Terraform configuration.

Non Compliant Example

Terraform
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
resource "aws_dax_cluster" "foo" {
  cluster_name       = "cluster-example-1"
  iam_role_arn       = data.aws_iam_role.example.arn
  node_type          = "dax.r4.large"
  replication_factor = 1
}

resource "aws_dax_cluster" "bar" {
  cluster_name       = "cluster-example-2"
  iam_role_arn       = data.aws_iam_role.example.arn
  node_type          = "dax.r4.large"
  replication_factor = 1
  server_side_encryption {
    enabled = false
  }
}

Remediation

To fix this violation, set the encryption type explicitly in your Terraform configuration:

Terraform
1
2
3
4
5
6
7
8
9
resource "aws_dax_cluster" "foo" {
  cluster_name       = "cluster-compliant"
  iam_role_arn       = data.aws_iam_role.example.arn
  node_type          = "dax.r4.large"
  replication_factor = 1
  server_side_encryption {
    enabled = true
  }
}

Extra Resources