Skip to main content

Non-encrypted confidential information - DynamoDB

Description​

Some AWS DyanmoDB instances are not encrypted or use the default KMS encryption which do not use a Customer Managed Key (CMK)

Impact​

Obtain critical information from the databases in plaintext

Recommendation​

Enable the DynamoDB encryption for all their instances using a custom KMS key

Threat​

Authenticated attacker from the Internet with access to the Database

Expected Remediation Time​

⌚ 20 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: H
  • User interaction: N
  • Scope: U
  • Confidentiality: H
  • Integrity: N
  • Availability: N

Temporal​

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
  • Score:
    • Base: 4.9
    • Temporal: 4.4
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

The resource has server side encryption enabled

resource "aws_dynamodb_table" "basic-dynamodb-table" {
  server_side_encryption {
    enabled     = true
    kms_key_arn = aws_kms_key.dynamo.arn
  }
}

Non compliant code​

The resource is not using server side encryption

resource "aws_dynamodb_table" "basic-dynamodb-table" {
  server_side_encryption {
    enabled     = false
    kms_key_arn = aws_kms_key.dynamo.arn
  }
}

A Dynamodb table is unencrypted

DDBTable:
  Type: AWS::DynamoDB::Table
  Properties:
    ProvisionedThroughput:
      ReadCapacityUnits: 5
      WriteCapacityUnits: 5
    Encrypted : false
    SSESpecification:
      KMSMasterKeyId: keyid
      SSEEnabled: false
      SSEType: KMS

Using the AWS CLI, the following command checks if Amazon DynamoDB tables are using AWS-managed Customer Master Keys (CMKs)

$ aws dynamodb describe-table
    --region us-east-1
    --table-name {dynamo_table_name}
    --query 'Table.SSEDescription.SSEType'

If the command output returns AES256 instead of KMS, the selected Amazon DynamoDB table is configured to use AWS-owned Customer Master Keys instead of AWS-managed CMKs for Server-Side Encryption, which is insecure.

Details​

https://docs.bridgecrew.io/docs/ensure-that-dynamodb-tables-are-encrypted

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.