Encryption at rest and in transit in DynamoDB - Step-by-Step Execution

Concept Flow - Encryption at rest and in transit

Data Created

↓

Encrypt Data Before Storage

→Store Encrypted Data in DynamoDB

↓

Data Stored at Rest (Encrypted)

↓

Request Data Retrieval

↓

Data Sent Over Network (Encrypted)

↓

Data Received and Decrypted by Client

Data is encrypted before saving in DynamoDB (at rest) and also encrypted when sent over the network (in transit).

Execution Sample

DynamoDB

1. PutItem with encryption enabled
2. Data stored encrypted in DynamoDB
3. GetItem request sent over TLS
4. Data received and decrypted by client

Shows how data is encrypted before storage and encrypted again during network transfer.

Execution Table

Step	Action	Data State	Encryption Type	Result
1	Create data item	Plain text	None	Data ready to store
2	Encrypt data before storing	Encrypted	Encryption at rest	Data encrypted locally
3	Store encrypted data in DynamoDB	Encrypted	Encryption at rest	Data saved securely
4	Request data retrieval	Encrypted	Encryption in transit (TLS)	Request sent securely
5	Data sent over network	Encrypted	Encryption in transit (TLS)	Data protected during transfer
6	Client receives data	Encrypted	Encryption in transit (TLS)	Data ready to decrypt
7	Client decrypts data	Plain text	Decryption	Data usable by client
8	End	Plain text	None	Process complete

💡 Process ends after client decrypts data for use

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	After Step 7
data	Plain text	Encrypted	Encrypted	Encrypted	Plain text

Key Moments - 2 Insights

Why is data encrypted twice, once at rest and once in transit?

Data is encrypted at rest to protect it when stored on disk (see Step 2 and 3). It is encrypted in transit to protect it while moving over the network (see Step 5). Both protect data in different places.

When does the data become plain text again?

Data becomes plain text only after the client decrypts it upon receiving it (see Step 7). Before that, it stays encrypted.

Visual Quiz - 3 Questions

Look at the execution table, at which step is data first encrypted?

A Step 4

B Step 1

C Step 2

D Step 6

💡 Hint

Check the 'Data State' and 'Encryption Type' columns in Step 2

At which step does the data travel securely over the network?

A Step 3

B Step 5

C Step 7

D Step 1

💡 Hint

Look for 'Encryption in transit (TLS)' in the 'Encryption Type' column

If encryption at rest was disabled, which step would change?

A Step 2 and 3 would show data as plain text

B Step 5 would show unencrypted data

C Step 7 would not decrypt data

D Step 1 would encrypt data

💡 Hint

Refer to 'Data State' in Steps 2 and 3 in the execution table

Concept Snapshot

Encryption at rest means data is encrypted when stored in DynamoDB.
Encryption in transit means data is encrypted while moving over the network.
DynamoDB uses encryption at rest automatically.
Data is sent over TLS to secure it in transit.
Clients decrypt data after receiving it.
Both protect data from unauthorized access.

Full Transcript

This visual execution shows how data is protected in DynamoDB by encrypting it at rest and in transit. First, data is created in plain text. Before storing, it is encrypted locally to protect it on disk. DynamoDB stores this encrypted data securely. When a client requests data, the request and response travel over the network encrypted using TLS. The client receives the encrypted data and decrypts it to use. This process ensures data is safe both when stored and when moving across the network.

Practice

1. What does encryption at rest in DynamoDB primarily protect?

easy

A. Data while it is being sent over the internet

B. User passwords in the application code

C. Data stored on disk within DynamoDB tables

D. Data in the client application memory

Solution

1. Step 1: Understand encryption at rest meaning

   Encryption at rest means data is encrypted when stored on disk or persistent storage.

2. Step 2: Identify what DynamoDB encrypts at rest

   DynamoDB encrypts table data stored on disk to protect it from unauthorized access.

3. Final Answer:

   Data stored on disk within DynamoDB tables -> Option C

4. Quick Check:

   Encryption at rest = data on disk encrypted [OK]

Hint: Encryption at rest means data saved on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking encryption at rest protects data in memory
• Assuming encryption at rest protects data during transfer

2. Which of the following is the correct way to ensure encryption in transit when accessing DynamoDB?

easy

A. Use HTTPS endpoints to connect to DynamoDB

B. Disable SSL to improve performance

C. Use HTTP endpoints to connect to DynamoDB

D. Use FTP protocol for data transfer

Solution

1. Step 1: Identify encryption in transit method

   Encryption in transit protects data while it moves between client and server, typically using HTTPS.

2. Step 2: Choose correct protocol for DynamoDB access

   DynamoDB supports HTTPS endpoints to encrypt data during transfer, ensuring security.

3. Final Answer:

   Use HTTPS endpoints to connect to DynamoDB -> Option A

4. Quick Check:

   Encryption in transit = HTTPS used [OK]

Hint: Always use HTTPS for secure data transfer [OK]

Common Mistakes:

• Choosing HTTP which is not encrypted
• Disabling SSL which removes encryption
• Using unrelated protocols like FTP

3. Consider this scenario: You enable encryption at rest on a DynamoDB table. What will happen to the existing data in the table?

medium

A. Existing data will be automatically encrypted without downtime

B. Existing data will be deleted and replaced with encrypted data

C. You must manually encrypt existing data before enabling encryption

D. Encryption only applies to new data inserted after enabling

Solution

1. Step 1: Understand DynamoDB encryption at rest behavior

   When encryption at rest is enabled on an existing table, DynamoDB automatically encrypts all existing data without downtime.

2. Step 2: Confirm automatic encryption of existing data

   DynamoDB transparently encrypts existing data on disk without requiring manual intervention or data deletion.

3. Final Answer:

   Existing data will be automatically encrypted without downtime -> Option A

4. Quick Check:

   Encryption at rest on existing table = automatic encryption of all data [OK]

Hint: Encryption at rest on existing tables automatically encrypts all data [OK]

Common Mistakes:

• Thinking all existing data is unencrypted until rewritten
• Assuming data is deleted during enablement
• Believing manual pre-encryption is required before enabling

4. You wrote code to connect to DynamoDB using http://dynamodb.us-east-1.amazonaws.com. What is the main issue with this approach?

medium

A. It only works for local DynamoDB instances

B. It does not encrypt data in transit, risking data exposure

C. It encrypts data twice causing performance issues

D. It will cause a syntax error in the code

Solution

1. Step 1: Analyze the protocol used in the URL

   The URL uses HTTP, which does not encrypt data during transfer.

2. Step 2: Understand consequences of unencrypted transit

   Data sent over HTTP can be intercepted, risking sensitive information exposure.

3. Final Answer:

   It does not encrypt data in transit, risking data exposure -> Option B

4. Quick Check:

   HTTP = no encryption in transit [OK]

Hint: HTTP URLs do not encrypt data in transit [OK]

Common Mistakes:

• Confusing HTTP with HTTPS
• Expecting syntax errors from HTTP usage
• Assuming HTTP works only locally

5. You want to ensure both encryption at rest and in transit for your DynamoDB application. Which combination of settings achieves this?

hard

A. Disable encryption at rest and use HTTPS endpoints

B. Enable client-side encryption only and use HTTP endpoints

C. Use HTTP endpoints and rely on DynamoDB default encryption

D. Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls

Solution

1. Step 1: Identify how to enable encryption at rest

   DynamoDB encryption at rest is enabled via table settings to protect stored data.

2. Step 2: Identify how to enable encryption in transit

   Using HTTPS endpoints ensures data is encrypted while moving between client and DynamoDB.

3. Step 3: Combine both for full protection

   Enabling both ensures data is safe when stored and when transferred.

4. Final Answer:

   Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls -> Option D

5. Quick Check:

   Encryption at rest + HTTPS = full data protection [OK]

Hint: Combine encryption at rest with HTTPS for full security [OK]

Common Mistakes:

• Using HTTP which breaks encryption in transit
• Relying only on client-side encryption without server encryption
• Disabling encryption at rest mistakenly