DynamoDB DAX cluster has encryption at rest enabled

Check ID: dynamodb_accelerator_cluster_encryption_enabled
Provider: AWS
Service: dynamodb
Severity: MEDIUM
Categories: encryption
Resource type: Other

What this check verifies

Amazon DynamoDB Accelerator (DAX) clusters are evaluated for server-side encryption at rest. The finding indicates whether the cluster’s on-disk cache, configuration, and logs are encrypted using service-managed keys.

Risk

Without encryption at rest, DAX on-disk cache and logs can be extracted from underlying storage by those with low-level access, compromising confidentiality and enabling offline data mining. Threats:

Compromised host or admin
Lost/retired media
Unauthorized backups or snapshots

Recommendation

Provision DAX clusters with encryption at rest enabled. Apply least privilege for DAX administration and data access, and monitor with logging. Adopt defense in depth: enable encryption in transit, restrict network exposure, and avoid caching highly sensitive data. Re-create unencrypted clusters to enforce this setting.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dax create-cluster --cluster-name <example_resource_name> --node-type <NODE_TYPE> --replication-factor 1 --iam-role-arn <example_resource_id> --sse-specification Enabled=true

resource "aws_dax_cluster" "example" {
  cluster_name       = "<example_resource_name>"
  node_type          = "<NODE_TYPE>"
  replication_factor = 1
  iam_role_arn       = "<example_resource_id>"

  # Critical: enables encryption at rest
  server_side_encryption {
    enabled = true  # Encrypts DAX cluster data at rest
  }
}

Resources:
  DaxCluster:
    Type: AWS::DAX::Cluster
    Properties:
      ClusterName: <example_resource_name>
      NodeType: <NODE_TYPE>
      ReplicationFactor: 1
      IAMRoleARN: <example_resource_id>
      SSESpecification:           # Critical: enables encryption at rest
        SSEEnabled: true          # Encrypts DAX cluster data at rest

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dynamodb_accelerator_cluster_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Elastic Disaster Recovery is enabled with a recovery job DynamoDB Accelerator (DAX) encrypts data in transit

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires