Encryption at rest and in transit in DynamoDB - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does encryption at rest mean in DynamoDB?

Encryption at rest means that the data stored in DynamoDB tables is automatically encrypted on the disk. This protects your data from unauthorized access if someone tries to read the storage directly.

beginner

What is encryption in transit in DynamoDB?

Encryption in transit means that data moving between your application and DynamoDB is encrypted using secure protocols like TLS. This keeps your data safe from eavesdropping while it travels over the internet.

intermediate

How does DynamoDB handle encryption at rest by default?

DynamoDB automatically encrypts all data at rest using AWS owned keys unless you choose to use your own customer managed keys for more control.

beginner

Why is encryption in transit important when using DynamoDB?

Encryption in transit protects your data from being intercepted or read by attackers while it moves between your app and DynamoDB. It ensures privacy and data integrity during communication.

intermediate

Can you disable encryption at rest in DynamoDB?

No, encryption at rest is always enabled in DynamoDB to protect your data. You can choose the key type (AWS owned or customer managed), but you cannot turn off encryption at rest.

What protects DynamoDB data stored on disk from unauthorized access?

A Encryption in transit

B Backup copies

C Access keys

D Encryption at rest

Encryption at rest secures data stored on disk by encrypting it, preventing unauthorized access.

Which protocol is commonly used to encrypt data in transit between your app and DynamoDB?

A FTP

B TLS

C HTTP

D SMTP

TLS (Transport Layer Security) encrypts data in transit to keep it safe from interception.

Can you turn off encryption at rest in DynamoDB?

A No, it is always enabled

B Only for certain tables

C Only during backups

D Yes, anytime

Encryption at rest is always enabled in DynamoDB to protect your data.

What is the benefit of using customer managed keys for encryption at rest in DynamoDB?

A More control over key management

B Faster queries

C Lower cost

D No encryption needed

Customer managed keys let you control key rotation and permissions.

Encryption in transit protects data when it is:

A Stored on disk

B Being backed up

C Moving between client and DynamoDB

D Deleted permanently

Encryption in transit secures data while it travels between your app and DynamoDB.

Explain the difference between encryption at rest and encryption in transit in DynamoDB.

Think about where the data is when each encryption applies.

Describe how DynamoDB ensures your data is secure using encryption.

Consider both storage and communication security.

Practice

1. What does encryption at rest in DynamoDB primarily protect?

easy

A. Data while it is being sent over the internet

B. User passwords in the application code

C. Data stored on disk within DynamoDB tables

D. Data in the client application memory

Solution

1. Step 1: Understand encryption at rest meaning

   Encryption at rest means data is encrypted when stored on disk or persistent storage.

2. Step 2: Identify what DynamoDB encrypts at rest

   DynamoDB encrypts table data stored on disk to protect it from unauthorized access.

3. Final Answer:

   Data stored on disk within DynamoDB tables -> Option C

4. Quick Check:

   Encryption at rest = data on disk encrypted [OK]

Hint: Encryption at rest means data saved on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking encryption at rest protects data in memory
• Assuming encryption at rest protects data during transfer

2. Which of the following is the correct way to ensure encryption in transit when accessing DynamoDB?

easy

A. Use HTTPS endpoints to connect to DynamoDB

B. Disable SSL to improve performance

C. Use HTTP endpoints to connect to DynamoDB

D. Use FTP protocol for data transfer

Solution

1. Step 1: Identify encryption in transit method

   Encryption in transit protects data while it moves between client and server, typically using HTTPS.

2. Step 2: Choose correct protocol for DynamoDB access

   DynamoDB supports HTTPS endpoints to encrypt data during transfer, ensuring security.

3. Final Answer:

   Use HTTPS endpoints to connect to DynamoDB -> Option A

4. Quick Check:

   Encryption in transit = HTTPS used [OK]

Hint: Always use HTTPS for secure data transfer [OK]

Common Mistakes:

• Choosing HTTP which is not encrypted
• Disabling SSL which removes encryption
• Using unrelated protocols like FTP

3. Consider this scenario: You enable encryption at rest on a DynamoDB table. What will happen to the existing data in the table?

medium

A. Existing data will be automatically encrypted without downtime

B. Existing data will be deleted and replaced with encrypted data

C. You must manually encrypt existing data before enabling encryption

D. Encryption only applies to new data inserted after enabling

Solution

1. Step 1: Understand DynamoDB encryption at rest behavior

   When encryption at rest is enabled on an existing table, DynamoDB automatically encrypts all existing data without downtime.

2. Step 2: Confirm automatic encryption of existing data

   DynamoDB transparently encrypts existing data on disk without requiring manual intervention or data deletion.

3. Final Answer:

   Existing data will be automatically encrypted without downtime -> Option A

4. Quick Check:

   Encryption at rest on existing table = automatic encryption of all data [OK]

Hint: Encryption at rest on existing tables automatically encrypts all data [OK]

Common Mistakes:

• Thinking all existing data is unencrypted until rewritten
• Assuming data is deleted during enablement
• Believing manual pre-encryption is required before enabling

4. You wrote code to connect to DynamoDB using http://dynamodb.us-east-1.amazonaws.com. What is the main issue with this approach?

medium

A. It only works for local DynamoDB instances

B. It does not encrypt data in transit, risking data exposure

C. It encrypts data twice causing performance issues

D. It will cause a syntax error in the code

Solution

1. Step 1: Analyze the protocol used in the URL

   The URL uses HTTP, which does not encrypt data during transfer.

2. Step 2: Understand consequences of unencrypted transit

   Data sent over HTTP can be intercepted, risking sensitive information exposure.

3. Final Answer:

   It does not encrypt data in transit, risking data exposure -> Option B

4. Quick Check:

   HTTP = no encryption in transit [OK]

Hint: HTTP URLs do not encrypt data in transit [OK]

Common Mistakes:

• Confusing HTTP with HTTPS
• Expecting syntax errors from HTTP usage
• Assuming HTTP works only locally

5. You want to ensure both encryption at rest and in transit for your DynamoDB application. Which combination of settings achieves this?

hard

A. Disable encryption at rest and use HTTPS endpoints

B. Enable client-side encryption only and use HTTP endpoints

C. Use HTTP endpoints and rely on DynamoDB default encryption

D. Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls

Solution

1. Step 1: Identify how to enable encryption at rest

   DynamoDB encryption at rest is enabled via table settings to protect stored data.

2. Step 2: Identify how to enable encryption in transit

   Using HTTPS endpoints ensures data is encrypted while moving between client and DynamoDB.

3. Step 3: Combine both for full protection

   Enabling both ensures data is safe when stored and when transferred.

4. Final Answer:

   Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls -> Option D

5. Quick Check:

   Encryption at rest + HTTPS = full data protection [OK]

Hint: Combine encryption at rest with HTTPS for full security [OK]

Common Mistakes:

• Using HTTP which breaks encryption in transit
• Relying only on client-side encryption without server encryption
• Disabling encryption at rest mistakenly