Encryption at rest and in transit in DynamoDB

Introduction

Encryption keeps your data safe by turning it into secret code. Encryption at rest protects stored data, and encryption in transit protects data moving between places.

When you want to protect sensitive customer information stored in your database.

When your application sends data over the internet and you want to keep it private.

When you need to follow security rules or laws that require data protection.

When you want to prevent unauthorized people from reading your data if they get access.

When you want to build trust with users by keeping their data secure.

Syntax

DynamoDB

Encryption at rest: Enabled by default in DynamoDB using AWS owned keys or customer managed keys.
Encryption in transit: Use HTTPS (TLS) endpoints to connect to DynamoDB.

Example: 
- Enable encryption at rest with AWS KMS key when creating a table.
- Use HTTPS endpoint to access DynamoDB API.

DynamoDB automatically encrypts data at rest by default.

To encrypt data in transit, always use HTTPS endpoints when connecting to DynamoDB.

Examples

This command creates a DynamoDB table with encryption at rest enabled using a customer managed AWS KMS key.

DynamoDB

aws dynamodb create-table \
  --table-name MyTable \
  --attribute-definitions AttributeName=Id,AttributeType=S \
  --key-schema AttributeName=Id,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST \
  --sse-specification Enabled=true,KMSMasterKeyId=alias/myKey

Always connect to DynamoDB using HTTPS to ensure encryption in transit.

DynamoDB

Use HTTPS endpoint:
https://dynamodb.us-west-2.amazonaws.com

Sample Program

This command creates a DynamoDB table named SecureTable with encryption at rest enabled using the default AWS managed key.

DynamoDB

aws dynamodb create-table \
  --table-name SecureTable \
  --attribute-definitions AttributeName=UserId,AttributeType=S \
  --key-schema AttributeName=UserId,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST \
  --sse-specification Enabled=true,KMSMasterKeyId=alias/aws/dynamodb

Important Notes

Encryption at rest protects data stored on disk inside DynamoDB.

Encryption in transit protects data as it moves between your app and DynamoDB.

Using customer managed keys gives you more control over encryption keys.

Summary

Encryption at rest secures stored data automatically in DynamoDB.

Encryption in transit requires using HTTPS endpoints to keep data safe while moving.

Enabling encryption helps protect sensitive data and meet security requirements.

Practice

1. What does encryption at rest in DynamoDB primarily protect?

easy

A. Data while it is being sent over the internet

B. User passwords in the application code

C. Data stored on disk within DynamoDB tables

D. Data in the client application memory

Solution

1. Step 1: Understand encryption at rest meaning

   Encryption at rest means data is encrypted when stored on disk or persistent storage.

2. Step 2: Identify what DynamoDB encrypts at rest

   DynamoDB encrypts table data stored on disk to protect it from unauthorized access.

3. Final Answer:

   Data stored on disk within DynamoDB tables -> Option C

4. Quick Check:

   Encryption at rest = data on disk encrypted [OK]

Hint: Encryption at rest means data saved on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking encryption at rest protects data in memory
• Assuming encryption at rest protects data during transfer

2. Which of the following is the correct way to ensure encryption in transit when accessing DynamoDB?

easy

A. Use HTTPS endpoints to connect to DynamoDB

B. Disable SSL to improve performance

C. Use HTTP endpoints to connect to DynamoDB

D. Use FTP protocol for data transfer

Solution

1. Step 1: Identify encryption in transit method

   Encryption in transit protects data while it moves between client and server, typically using HTTPS.

2. Step 2: Choose correct protocol for DynamoDB access

   DynamoDB supports HTTPS endpoints to encrypt data during transfer, ensuring security.

3. Final Answer:

   Use HTTPS endpoints to connect to DynamoDB -> Option A

4. Quick Check:

   Encryption in transit = HTTPS used [OK]

Hint: Always use HTTPS for secure data transfer [OK]

Common Mistakes:

• Choosing HTTP which is not encrypted
• Disabling SSL which removes encryption
• Using unrelated protocols like FTP

3. Consider this scenario: You enable encryption at rest on a DynamoDB table. What will happen to the existing data in the table?

medium

A. Existing data will be automatically encrypted without downtime

B. Existing data will be deleted and replaced with encrypted data

C. You must manually encrypt existing data before enabling encryption

D. Encryption only applies to new data inserted after enabling

Solution

1. Step 1: Understand DynamoDB encryption at rest behavior

   When encryption at rest is enabled on an existing table, DynamoDB automatically encrypts all existing data without downtime.

2. Step 2: Confirm automatic encryption of existing data

   DynamoDB transparently encrypts existing data on disk without requiring manual intervention or data deletion.

3. Final Answer:

   Existing data will be automatically encrypted without downtime -> Option A

4. Quick Check:

   Encryption at rest on existing table = automatic encryption of all data [OK]

Hint: Encryption at rest on existing tables automatically encrypts all data [OK]

Common Mistakes:

• Thinking all existing data is unencrypted until rewritten
• Assuming data is deleted during enablement
• Believing manual pre-encryption is required before enabling

4. You wrote code to connect to DynamoDB using http://dynamodb.us-east-1.amazonaws.com. What is the main issue with this approach?

medium

A. It only works for local DynamoDB instances

B. It does not encrypt data in transit, risking data exposure

C. It encrypts data twice causing performance issues

D. It will cause a syntax error in the code

Solution

1. Step 1: Analyze the protocol used in the URL

   The URL uses HTTP, which does not encrypt data during transfer.

2. Step 2: Understand consequences of unencrypted transit

   Data sent over HTTP can be intercepted, risking sensitive information exposure.

3. Final Answer:

   It does not encrypt data in transit, risking data exposure -> Option B

4. Quick Check:

   HTTP = no encryption in transit [OK]

Hint: HTTP URLs do not encrypt data in transit [OK]

Common Mistakes:

• Confusing HTTP with HTTPS
• Expecting syntax errors from HTTP usage
• Assuming HTTP works only locally

5. You want to ensure both encryption at rest and in transit for your DynamoDB application. Which combination of settings achieves this?

hard

A. Disable encryption at rest and use HTTPS endpoints

B. Enable client-side encryption only and use HTTP endpoints

C. Use HTTP endpoints and rely on DynamoDB default encryption

D. Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls

Solution

1. Step 1: Identify how to enable encryption at rest

   DynamoDB encryption at rest is enabled via table settings to protect stored data.

2. Step 2: Identify how to enable encryption in transit

   Using HTTPS endpoints ensures data is encrypted while moving between client and DynamoDB.

3. Step 3: Combine both for full protection

   Enabling both ensures data is safe when stored and when transferred.

4. Final Answer:

   Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls -> Option D

5. Quick Check:

   Encryption at rest + HTTPS = full data protection [OK]

Hint: Combine encryption at rest with HTTPS for full security [OK]

Common Mistakes:

• Using HTTP which breaks encryption in transit
• Relying only on client-side encryption without server encryption
• Disabling encryption at rest mistakenly