Why Encryption at rest and in transit in DynamoDB? - Purpose & Use Cases

The Big Idea

What if your secret data could stay locked tight no matter where it goes?

The Scenario

Imagine you have a treasure chest full of important letters and you carry it around everywhere. You want to keep those letters safe from thieves and spies, but you only lock the chest sometimes and never protect the letters inside when you send them to friends.

The Problem

Without proper protection, anyone who finds the chest or intercepts the letters can read or steal your secrets. Manually trying to protect data by hiding it yourself is slow, easy to mess up, and risky because you might forget to lock the chest or cover the letters during travel.

The Solution

Encryption at rest and in transit automatically locks your data both when it is stored and when it moves between places. This means your data stays safe inside the database and while traveling across the network, without you having to do extra work or worry about mistakes.

Before vs After

✗ Before

Store data in plain text
Send data over network without protection

✓ After

Enable encryption at rest in DynamoDB
Use TLS to encrypt data in transit automatically

What It Enables

It enables secure storage and communication of sensitive data, giving you peace of mind that your information is protected everywhere.

Real Life Example

A healthcare app stores patient records in DynamoDB. Encryption at rest keeps the records safe on the server, and encryption in transit protects them when doctors access the data from their devices.

Key Takeaways

Manual data protection is slow and risky.

Encryption at rest and in transit secures data automatically.

This keeps sensitive information safe both stored and moving.

Practice

1. What does encryption at rest in DynamoDB primarily protect?

easy

A. Data while it is being sent over the internet

B. User passwords in the application code

C. Data stored on disk within DynamoDB tables

D. Data in the client application memory

Solution

1. Step 1: Understand encryption at rest meaning

   Encryption at rest means data is encrypted when stored on disk or persistent storage.

2. Step 2: Identify what DynamoDB encrypts at rest

   DynamoDB encrypts table data stored on disk to protect it from unauthorized access.

3. Final Answer:

   Data stored on disk within DynamoDB tables -> Option C

4. Quick Check:

   Encryption at rest = data on disk encrypted [OK]

Hint: Encryption at rest means data saved on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking encryption at rest protects data in memory
• Assuming encryption at rest protects data during transfer

2. Which of the following is the correct way to ensure encryption in transit when accessing DynamoDB?

easy

A. Use HTTPS endpoints to connect to DynamoDB

B. Disable SSL to improve performance

C. Use HTTP endpoints to connect to DynamoDB

D. Use FTP protocol for data transfer

Solution

1. Step 1: Identify encryption in transit method

   Encryption in transit protects data while it moves between client and server, typically using HTTPS.

2. Step 2: Choose correct protocol for DynamoDB access

   DynamoDB supports HTTPS endpoints to encrypt data during transfer, ensuring security.

3. Final Answer:

   Use HTTPS endpoints to connect to DynamoDB -> Option A

4. Quick Check:

   Encryption in transit = HTTPS used [OK]

Hint: Always use HTTPS for secure data transfer [OK]

Common Mistakes:

• Choosing HTTP which is not encrypted
• Disabling SSL which removes encryption
• Using unrelated protocols like FTP

3. Consider this scenario: You enable encryption at rest on a DynamoDB table. What will happen to the existing data in the table?

medium

A. Existing data will be automatically encrypted without downtime

B. Existing data will be deleted and replaced with encrypted data

C. You must manually encrypt existing data before enabling encryption

D. Encryption only applies to new data inserted after enabling

Solution

1. Step 1: Understand DynamoDB encryption at rest behavior

   When encryption at rest is enabled on an existing table, DynamoDB automatically encrypts all existing data without downtime.

2. Step 2: Confirm automatic encryption of existing data

   DynamoDB transparently encrypts existing data on disk without requiring manual intervention or data deletion.

3. Final Answer:

   Existing data will be automatically encrypted without downtime -> Option A

4. Quick Check:

   Encryption at rest on existing table = automatic encryption of all data [OK]

Hint: Encryption at rest on existing tables automatically encrypts all data [OK]

Common Mistakes:

• Thinking all existing data is unencrypted until rewritten
• Assuming data is deleted during enablement
• Believing manual pre-encryption is required before enabling

4. You wrote code to connect to DynamoDB using http://dynamodb.us-east-1.amazonaws.com. What is the main issue with this approach?

medium

A. It only works for local DynamoDB instances

B. It does not encrypt data in transit, risking data exposure

C. It encrypts data twice causing performance issues

D. It will cause a syntax error in the code

Solution

1. Step 1: Analyze the protocol used in the URL

   The URL uses HTTP, which does not encrypt data during transfer.

2. Step 2: Understand consequences of unencrypted transit

   Data sent over HTTP can be intercepted, risking sensitive information exposure.

3. Final Answer:

   It does not encrypt data in transit, risking data exposure -> Option B

4. Quick Check:

   HTTP = no encryption in transit [OK]

Hint: HTTP URLs do not encrypt data in transit [OK]

Common Mistakes:

• Confusing HTTP with HTTPS
• Expecting syntax errors from HTTP usage
• Assuming HTTP works only locally

5. You want to ensure both encryption at rest and in transit for your DynamoDB application. Which combination of settings achieves this?

hard

A. Disable encryption at rest and use HTTPS endpoints

B. Enable client-side encryption only and use HTTP endpoints

C. Use HTTP endpoints and rely on DynamoDB default encryption

D. Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls

Solution

1. Step 1: Identify how to enable encryption at rest

   DynamoDB encryption at rest is enabled via table settings to protect stored data.

2. Step 2: Identify how to enable encryption in transit

   Using HTTPS endpoints ensures data is encrypted while moving between client and DynamoDB.

3. Step 3: Combine both for full protection

   Enabling both ensures data is safe when stored and when transferred.

4. Final Answer:

   Enable DynamoDB encryption at rest and use HTTPS endpoints for API calls -> Option D

5. Quick Check:

   Encryption at rest + HTTPS = full data protection [OK]

Hint: Combine encryption at rest with HTTPS for full security [OK]

Common Mistakes:

• Using HTTP which breaks encryption in transit
• Relying only on client-side encryption without server encryption
• Disabling encryption at rest mistakenly