Enable At Rest Encryption | Vulnerability Database

DAX Cluster should always encrypt data at rest

Data can be freely read if compromised. Amazon DynamoDB Accelerator (DAX) encryption at rest provides an additional layer of data protection by helping secure your data from unauthorized access to the underlying storage.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Enable encryption at rest for DAX Cluster

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


Resources:
  GoodExample:
    Type: AWS::DAX::Cluster
    Properties:
      ClusterName: MyDAXCluster
      Description: DAX cluster with encryption at rest
      IAMRoleARN: arn:aws:iam::111122223333:role/DaxAccess
      NodeType: dax.r3.large
      ReplicationFactor: 1
      SSESpecification:
        SSEEnabled: true

Enable encryption at rest for DAX Cluster

1
2
3
4
5
6
7


resource "aws_dax_cluster" "good_example" {
  // other DAX config

  server_side_encryption {
    enabled = true // enabled server side encryption
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dax_cluster#server_side_encryption