DynamoDB table is encrypted at rest with AWS KMS

Check ID: dynamodb_tables_kms_cmk_encryption_enabled
Provider: AWS
Service: dynamodb
Severity: MEDIUM
Categories: encryption
Resource type: AwsDynamoDbTable

What this check verifies

DynamoDB tables use AWS KMS keys (KMS) for encryption at rest instead of the default service-owned key

Risk

Relying on the default service-owned key reduces control over confidentiality: no custom key policies, limited auditability, and no independent rotation or disablement. This weakens least-privilege enforcement and incident response, and can impede meeting mandates that require customer-controlled keys.

Recommendation

Encrypt tables with KMS keys in your account-prefer customer-managed keys for sensitive data.

Enforce least-privilege key policies and scope grants
Enable rotation and monitor key usage
Separate duties for key admins vs data users
Restrict which principals can use the key for DynamoDB

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dynamodb update-table --table-name <example_resource_name> --sse-specification Enabled=true,SSEType=KMS

resource "aws_dynamodb_table" "<example_resource_name>" {
  name         = "<example_resource_name>"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "id"

  attribute {
    name = "id"
    type = "S"
  }

  server_side_encryption {
    enabled = true  # Critical: enables AWS KMS encryption (uses AWS managed key if no key ARN provided)
  }
}

# CloudFormation: Enable KMS encryption on a DynamoDB table
Resources:
  <example_resource_name>:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST
      SSESpecification:
        SSEEnabled: true  # Critical: enables KMS-based encryption
        SSEType: KMS      # Critical: switches from DEFAULT to AWS KMS

References

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dynamodb_tables_kms_cmk_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DynamoDB table is protected by a backup plan DynamoDB table has point-in-time recovery (PITR) enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires