Rule: DynamoDB Table Encrypted with AWS KMS

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify KMS Key: Check if the appropriate AWS KMS key exists for encryption. Ensure that the key has appropriate permissions.

4. 2.

   Enable Encryption: If encryption is not enabled for the DynamoDB table, enable it by specifying the KMS key during table creation or modification.

6. 3.

   Check Table Encryption Status: Verify the encryption status of the DynamoDB table. If it is not encrypted, proceed to enable encryption.

8. 4.

   Permissions Setup: Ensure that the IAM roles and policies associated with the table have the necessary permissions to access the KMS key and enable encryption.

Necessary Codes:

Remediation Steps:

2. 1.

   Identify the KMS Key ARN: Determine the Amazon Resource Name (ARN) of the KMS key that you want to use for encryption.

4. 2.

   Apply Encryption Using AWS CLI:

   $ aws dynamodb update-table \
     --table-name <table-name> \
     --sse-specification Enabled=true,KMSMasterKeyId=<kms-key-arn>
   

   Replace

   <table-name>

   with the actual name of the DynamoDB table you want to encrypt. Replace

   <kms-key-arn>

   with the ARN of the desired KMS key.

6. 3.

   Apply Encryption Using AWS SDKs: Utilize the appropriate AWS SDK for your preferred programming language to update the table with encryption enabled. Here's an example using Python and Boto3 SDK:

   import boto3
    
   dynamodb_client = boto3.client('dynamodb')
   response = dynamodb_client.update_table(
       TableName='<table-name>',
       SSESpecification={
           'Enabled': True,
           'KMSMasterKeyId': '<kms-key-arn>'
       }
   )
   

   Replace

   <table-name>

   with the actual name of the DynamoDB table, and

   <kms-key-arn>

   with the ARN of the desired KMS key.

8. 4.

   Verify Encryption: After applying encryption, verify the encryption status of the DynamoDB table to ensure it is encrypted using AWS KMS.

Conclusion: