DynamoDB table is encrypted at rest with AWS KMS
dynamodb_tables_kms_cmk_encryption_enabled
DynamoDB tables use AWS KMS keys (KMS) for encryption at rest instead of the default service-owned key
Risk
Relying on the default service-owned key reduces control over confidentiality: no custom key policies, limited auditability, and no independent rotation or disablement. This weakens least-privilege enforcement and incident response, and can impede meeting mandates that require customer-controlled keys.
prowler aws --checks dynamodb_tables_kms_cmk_encryption_enabled
Recommendation
Encrypt tables with KMS keys in your account-prefer customer-managed keys for sensitive data.
- Enforce least-privilege key policies and scope grants
- Enable rotation and monitor key usage
- Separate duties for key admins vs data users
- Restrict which principals can use the key for DynamoDB
Remediation
aws dynamodb update-table --table-name <example_resource_name> --sse-specification Enabled=true,SSEType=KMS
- Open the AWS Management Console and go to DynamoDB
- Select your table
- In Table details, find Encryption at rest and click Edit
- Select AWS KMS: choose AWS managed key (alias/aws/dynamodb) or a customer managed key
- Click Save
Source Code
Resource Type
AwsDynamoDbTable