Encryption at rest and in transit in DynamoDB - Mini Project: Build & Apply

Encryption at rest and in transit with DynamoDB

📖 Scenario: You are building a secure application that stores user data in AWS DynamoDB. To protect sensitive information, you need to ensure that data is encrypted both when stored (at rest) and when sent over the network (in transit).

🎯 Goal: Create a DynamoDB table with encryption at rest enabled and configure the AWS SDK client to use HTTPS for encryption in transit.

📋 What You'll Learn

Create a DynamoDB table named UserData with server-side encryption enabled using the AWS managed key.

Configure the AWS SDK DynamoDB client to use HTTPS endpoint to ensure encryption in transit.

Use exact names: table name UserData, encryption type AWS_MANAGED, and HTTPS endpoint https://dynamodb.us-west-2.amazonaws.com.

💡 Why This Matters

🌍 Real World

Many applications store sensitive user data in DynamoDB and must protect it from unauthorized access by encrypting data at rest and in transit.

💼 Career

Understanding how to enable encryption in DynamoDB and configure secure clients is essential for cloud developers and security engineers working with AWS.

1

Create DynamoDB table with encryption at rest

Write the AWS CLI command to create a DynamoDB table named UserData with a primary key called UserId of type string. Enable server-side encryption using the AWS managed key by including --sse-specification Enabled=true,SSEType=KMS.

DynamoDB

# Your AWS CLI command here

Hint

Use aws dynamodb create-table with --sse-specification Enabled=true,SSEType=KMS to enable encryption at rest.

2

Configure AWS SDK DynamoDB client endpoint

In your AWS SDK configuration code, create a DynamoDB client object that connects to the HTTPS endpoint https://dynamodb.us-west-2.amazonaws.com to ensure encryption in transit. Assign this client to a variable named dynamodb_client.

DynamoDB

aws dynamodb create-table \
    --table-name UserData \
    --attribute-definitions AttributeName=UserId,AttributeType=S \
    --key-schema AttributeName=UserId,KeyType=HASH \
    --billing-mode PAY_PER_REQUEST \
    --sse-specification Enabled=true,SSEType=KMS

# Create DynamoDB client with HTTPS endpoint
# Your code here

Hint

Use boto3.client('dynamodb', endpoint_url='https://dynamodb.us-west-2.amazonaws.com') to create the client.

3

Put an item securely into the DynamoDB table

Use the dynamodb_client to put an item into the UserData table. The item should have UserId set to "user123" and Email set to "[e-mail]". Use the put_item method with the correct parameters.

DynamoDB

aws dynamodb create-table \
    --table-name UserData \
    --attribute-definitions AttributeName=UserId,AttributeType=S \
    --key-schema AttributeName=UserId,KeyType=HASH \
    --billing-mode PAY_PER_REQUEST \
    --sse-specification Enabled=true,SSEType=KMS

import boto3

dynamodb_client = boto3.client('dynamodb', endpoint_url='https://dynamodb.us-west-2.amazonaws.com')

# Put an item into UserData table
# Your code here

Hint

Use dynamodb_client.put_item with TableName and Item parameters.

4

Enable HTTPS enforcement in client configuration

Add a configuration to the dynamodb_client to explicitly enforce HTTPS by setting the use_ssl parameter to True when creating the client.

DynamoDB

aws dynamodb create-table \
    --table-name UserData \
    --attribute-definitions AttributeName=UserId,AttributeType=S \
    --key-schema AttributeName=UserId,KeyType=HASH \
    --billing-mode PAY_PER_REQUEST \
    --sse-specification Enabled=true,SSEType=KMS

import boto3

# Create DynamoDB client with HTTPS enforced
# Your code here

dynamodb_client.put_item(
    TableName='UserData',
    Item={
        'UserId': {'S': 'user123'},
        'Email': {'S': '[e-mail]'}
    }
)

Hint

Add use_ssl=True when creating the client to enforce HTTPS.

Practice

1. What does encryption at rest in DynamoDB primarily protect?

easy

A. Data while it is being sent over the internet

B. User passwords in the application code

C. Data stored on disk within DynamoDB tables

D. Data in the client application memory

Solution

1. Step 1: Understand encryption at rest meaning

   Encryption at rest means data is encrypted when stored on disk or persistent storage.

2. Step 2: Identify what DynamoDB encrypts at rest

   DynamoDB encrypts table data stored on disk to protect it from unauthorized access.

3. Final Answer:

   Data stored on disk within DynamoDB tables -> Option C

4. Quick Check:

   Encryption at rest = data on disk encrypted [OK]

Hint: Encryption at rest means data saved on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking encryption at rest protects data in memory
• Assuming encryption at rest protects data during transfer

2. Which of the following is the correct way to ensure encryption in transit when accessing DynamoDB?

easy

A. Use HTTPS endpoints to connect to DynamoDB

B. Disable SSL to improve performance

C. Use HTTP endpoints to connect to DynamoDB

D. Use FTP protocol for data transfer

Solution

1. Step 1: Identify encryption in transit method

   Encryption in transit protects data while it moves between client and server, typically using HTTPS.

2. Step 2: Choose correct protocol for DynamoDB access

   DynamoDB supports HTTPS endpoints to encrypt data during transfer, ensuring security.

3. Final Answer:

   Use HTTPS endpoints to connect to DynamoDB -> Option A

4. Quick Check:

   Encryption in transit = HTTPS used [OK]

Hint: Always use HTTPS for secure data transfer [OK]

Common Mistakes:

• Choosing HTTP which is not encrypted
• Disabling SSL which removes encryption
• Using unrelated protocols like FTP

3. Consider this scenario: You enable encryption at rest on a DynamoDB table. What will happen to the existing data in the table?

medium

A. Existing data will be automatically encrypted without downtime

B. Existing data will be deleted and replaced with encrypted data

C. You must manually encrypt existing data before enabling encryption

D. Encryption only applies to new data inserted after enabling

Solution

1. Step 1: Understand DynamoDB encryption at rest behavior

   When encryption at rest is enabled on an existing table, DynamoDB automatically encrypts all existing data without downtime.

2. Step 2: Confirm automatic encryption of existing data

   DynamoDB transparently encrypts existing data on disk without requiring manual intervention or data deletion.

3. Final Answer:

   Existing data will be automatically encrypted without downtime -> Option A

4. Quick Check:

   Encryption at rest on existing table = automatic encryption of all data [OK]

Hint: Encryption at rest on existing tables automatically encrypts all data [OK]

Common Mistakes:

• Thinking all existing data is unencrypted until rewritten
• Assuming data is deleted during enablement
• Believing manual pre-encryption is required before enabling

4. You wrote code to connect to DynamoDB using http://dynamodb.us-east-1.amazonaws.com. What is the main issue with this approach?

medium

A. It only works for local DynamoDB instances

B. It does not encrypt data in transit, risking data exposure

C. It encrypts data twice causing performance issues

D. It will cause a syntax error in the code

Solution

1. Step 1: Analyze the protocol used in the URL

   The URL uses HTTP, which does not encrypt data during transfer.

2. Step 2: Understand consequences of unencrypted transit

   Data sent over HTTP can be intercepted, risking sensitive information exposure.

3. Final Answer:

   It does not encrypt data in transit, risking data exposure -> Option B

4. Quick Check:

   HTTP = no encryption in transit [OK]

Hint: HTTP URLs do not encrypt data in transit [OK]

Common Mistakes:

• Confusing HTTP with HTTPS
• Expecting syntax errors from HTTP usage
• Assuming HTTP works only locally

5. You want to ensure both encryption at rest and in transit for your DynamoDB application. Which combination of settings achieves this?

hard

A. Disable encryption at rest and use HTTPS endpoints

B. Enable client-side encryption only and use HTTP endpoints

C. Use HTTP endpoints and rely on DynamoDB default encryption

D. Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls

Solution

1. Step 1: Identify how to enable encryption at rest

   DynamoDB encryption at rest is enabled via table settings to protect stored data.

2. Step 2: Identify how to enable encryption in transit

   Using HTTPS endpoints ensures data is encrypted while moving between client and DynamoDB.

3. Step 3: Combine both for full protection

   Enabling both ensures data is safe when stored and when transferred.

4. Final Answer:

   Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls -> Option D

5. Quick Check:

   Encryption at rest + HTTPS = full data protection [OK]

Hint: Combine encryption at rest with HTTPS for full security [OK]

Common Mistakes:

• Using HTTP which breaks encryption in transit
• Relying only on client-side encryption without server encryption
• Disabling encryption at rest mistakenly