DynamoDB Accelerator (DAX) encrypts data in transit

Check ID: dynamodb_accelerator_cluster_in_transit_encryption_enabled
Provider: AWS
Service: dynamodb
Severity: MEDIUM
Categories: encryption
Resource type: Other

What this check verifies

DAX clusters have endpoint encryption set to TLS, enforcing encryption in transit for client connections to the cluster

Risk

Missing TLS enables interception and manipulation of DAX traffic, impacting:

Confidentiality: exposure of queries, data, or credentials
Integrity: tampered requests/responses and cache poisoning
Availability: session hijacking or replay causing service disruption

Recommendation

Enforce TLS for all DAX endpoints and clients (encryption in transit). If an existing cluster lacks it, create a new TLS-enabled cluster and migrate. Apply defense in depth: restrict network paths, keep access private, and use least privilege IAM to reduce blast radius.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dax create-cluster —cluster-name <cluster-name> —node-type <node-type> —replication-factor <replication-factor> —cluster-endpoint-encryption-type TLS

# DAX cluster with encryption in transit enabled
resource "aws_dax_cluster" "<example_resource_name>" {
  cluster_name                      = "<example_resource_name>"
  node_type                         = "<example_node_type>"
  replication_factor                = 1
  iam_role_arn                      = "<example_resource_id>"
  cluster_endpoint_encryption_type  = "TLS"  # Critical: Enables TLS for in-transit encryption
}

# CloudFormation: Create DAX cluster with TLS (encryption in transit)
Resources:
  <example_resource_name>:
    Type: AWS::DAX::Cluster
    Properties:
      ClusterName: <example_resource_name>
      IAMRoleARN: <example_resource_id>
      NodeType: <example_node_type>
      ReplicationFactor: 1
      ClusterEndpointEncryptionType: TLS  # Critical: Enables TLS for in-transit encryption

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dynamodb_accelerator_cluster_in_transit_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DynamoDB DAX cluster has encryption at rest enabled DynamoDB Accelerator (DAX) cluster has nodes in multiple AZs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires