Encryption at rest and in transit in DynamoDB - Step-by-Step Execution

Concept Flow - Encryption at rest and in transit

Data Created

↓

Encrypt Data Before Storage

→Store Encrypted Data in DynamoDB

↓

Data Stored at Rest (Encrypted)

↓

Request Data Retrieval

↓

Data Sent Over Network (Encrypted)

↓

Data Received and Decrypted by Client

Data is encrypted before saving in DynamoDB (at rest) and also encrypted when sent over the network (in transit).

Execution Sample

DynamoDB

1. PutItem with encryption enabled
2. Data stored encrypted in DynamoDB
3. GetItem request sent over TLS
4. Data received and decrypted by client

Shows how data is encrypted before storage and encrypted again during network transfer.

Execution Table

Step	Action	Data State	Encryption Type	Result
1	Create data item	Plain text	None	Data ready to store
2	Encrypt data before storing	Encrypted	Encryption at rest	Data encrypted locally
3	Store encrypted data in DynamoDB	Encrypted	Encryption at rest	Data saved securely
4	Request data retrieval	Encrypted	Encryption in transit (TLS)	Request sent securely
5	Data sent over network	Encrypted	Encryption in transit (TLS)	Data protected during transfer
6	Client receives data	Encrypted	Encryption in transit (TLS)	Data ready to decrypt
7	Client decrypts data	Plain text	Decryption	Data usable by client
8	End	Plain text	None	Process complete

💡 Process ends after client decrypts data for use

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	After Step 7
data	Plain text	Encrypted	Encrypted	Encrypted	Plain text

Key Moments - 2 Insights

Why is data encrypted twice, once at rest and once in transit?

Data is encrypted at rest to protect it when stored on disk (see Step 2 and 3). It is encrypted in transit to protect it while moving over the network (see Step 5). Both protect data in different places.

When does the data become plain text again?

Data becomes plain text only after the client decrypts it upon receiving it (see Step 7). Before that, it stays encrypted.

Visual Quiz - 3 Questions

Look at the execution table, at which step is data first encrypted?

A Step 4

B Step 1

C Step 2

D Step 6

💡 Hint

Check the 'Data State' and 'Encryption Type' columns in Step 2

At which step does the data travel securely over the network?

A Step 3

B Step 5

C Step 7

D Step 1

💡 Hint

Look for 'Encryption in transit (TLS)' in the 'Encryption Type' column

If encryption at rest was disabled, which step would change?

A Step 2 and 3 would show data as plain text

B Step 5 would show unencrypted data

C Step 7 would not decrypt data

D Step 1 would encrypt data

💡 Hint

Refer to 'Data State' in Steps 2 and 3 in the execution table

Concept Snapshot

Encryption at rest means data is encrypted when stored in DynamoDB.
Encryption in transit means data is encrypted while moving over the network.
DynamoDB uses encryption at rest automatically.
Data is sent over TLS to secure it in transit.
Clients decrypt data after receiving it.
Both protect data from unauthorized access.

Full Transcript

This visual execution shows how data is protected in DynamoDB by encrypting it at rest and in transit. First, data is created in plain text. Before storing, it is encrypted locally to protect it on disk. DynamoDB stores this encrypted data securely. When a client requests data, the request and response travel over the network encrypted using TLS. The client receives the encrypted data and decrypts it to use. This process ensures data is safe both when stored and when moving across the network.