Skip to main content

Non-encrypted confidential information - DynamoDB

Description

Some AWS DyanmoDB instances are not encrypted or use the default KMS encryption which do not use a Customer Managed Key (CMK)

Impact

Obtain critical information from the databases in plaintext

Recommendation

Enable the DynamoDB encryption for all their instances using a custom KMS key

Threat

Authenticated attacker from the Internet with access to the Database

Expected Remediation Time

⌚ 20 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: H
  • User interaction: N
  • Scope: U
  • Confidentiality: H
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
  • Score:
    • Base: 4.9
    • Temporal: 4.4
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The resource has server side encryption enabled

resource "aws_dynamodb_table" "basic-dynamodb-table" {
server_side_encryption {
enabled = true
kms_key_arn = aws_kms_key.dynamo.arn
}
}

Non compliant code

The resource is not using server side encryption

resource "aws_dynamodb_table" "basic-dynamodb-table" {
server_side_encryption {
enabled = false
kms_key_arn = aws_kms_key.dynamo.arn
}
}

A Dynamodb table is unencrypted

DDBTable:
Type: AWS::DynamoDB::Table
Properties:
ProvisionedThroughput:
ReadCapacityUnits: 5
WriteCapacityUnits: 5
Encrypted : false
SSESpecification:
KMSMasterKeyId: keyid
SSEEnabled: false
SSEType: KMS

Using the AWS CLI, the following command checks if Amazon DynamoDB tables are using AWS-managed Customer Master Keys (CMKs)

$ aws dynamodb describe-table
--region us-east-1
--table-name {dynamo_table_name}
--query 'Table.SSEDescription.SSEType'

If the command output returns AES256 instead of KMS, the selected Amazon DynamoDB table is configured to use AWS-owned Customer Master Keys instead of AWS-managed CMKs for Server-Side Encryption, which is insecure.

Details

https://docs.bridgecrew.io/docs/ensure-that-dynamodb-tables-are-encrypted

Requirements