Rule: DynamoDB table should be encrypted with AWS KMS
Ensure compliance by encrypting DynamoDB table with AWS KMS.
| Rule | DynamoDB table should be encrypted with AWS KMS |
| Framework | GxP 21 CFR Part 11 |
| Severity | ✔ Medium |
Rule Description:
DynamoDB tables used for GxP (Good Practices) compliance under 21 CFR Part 11 should be encrypted using AWS Key Management Service (KMS). This rule ensures that sensitive data stored in DynamoDB tables is protected and meets regulatory requirements.
Troubleshooting Steps:
- 1.
Verify DynamoDB Table Encryption: Confirm if the DynamoDB table is already encrypted with AWS KMS.
- 2.
Check KMS Key Policy: Ensure that the KMS key policy allows DynamoDB service to access and use the key for encryption.
- 3.
Verify IAM Permissions: Validate that the IAM role or user associated with the DynamoDB table has appropriate permissions to encrypt and decrypt data using the KMS key.
- 4.
Check AWS Region Compatibility: Ensure that the DynamoDB table and the KMS key are in the same AWS region. DynamoDB and KMS must be in the same region for encryption to work.
- 5.
Review Error Messages: If encryption is not working, examine error messages for further troubleshooting.
Necessary Code:
No necessary code is required for this rule. The encryption of DynamoDB tables using AWS KMS is managed through AWS console or CLI commands.
Step-by-Step Remediation Guide:
- 1.
Sign in to the AWS Management Console.
- 2.
Open the Amazon DynamoDB console.
- 3.
Select the desired DynamoDB table that needs to be encrypted.
- 4.
Click on the "Encryption" tab in the table details.
- 5.
Check if "Encryption at rest" is already enabled. If not, proceed to the next step.
- 6.
Click on "Modify" beside "Encryption at rest".
- 7.
Choose "Enable encryption" option.
- 8.
Select the appropriate AWS KMS key from the dropdown menu under "AWS Key Management Service" section. If the desired KMS key is not available, create a new one using the KMS service.
- 9.
Click on "Save" to enable encryption using the selected KMS key.
- 10.
Wait for the encryption process to complete. This may take some time depending on the size of the DynamoDB table.
- 11.
Verify encryption status by checking if "Encryption at rest" for the DynamoDB table shows as enabled.
- 12.
Validate GxP compliance requirements with your organization's internal procedures or relevant regulatory guidelines.
Note: Please ensure that you have the necessary permissions to modify AWS resources and access AWS KMS keys.
By following these steps, you can encrypt your DynamoDB table using AWS KMS to meet GxP compliance requirements under 21 CFR Part 11.