DynamoDB table does not have CMK (customer-managed KMS) encryption enabled

Severity: Low
Service: DynamoDB
Check ID: DYNAMODB_NOT_ENCRYPTED

What this check finds

DynamoDB tables are encrypted by default with an AWS-owned key. This finding flags tables that have not opted in to customer-managed KMS encryption, which provides audit logs, key rotation control, and the ability to revoke access.

Passing looks like: DynamoDB tables encrypted with CMK.

How to fix it

Update the table to use a customer-managed KMS key.

AWS CLI

aws dynamodb update-table --table-name TABLE_NAME --sse-specification Enabled=true,SSEType=KMS,KMSMasterKeyId=KEY_ID

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

DynamoDB → Tables → select table → Additional settings → Encryption → Manage encryption → Customer managed key.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to DynamoDB table does not have CMK (customer-managed KMS) encryption enabled
Framework	Controls
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-13 Cryptographic Protection SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More DynamoDB checks

All DynamoDB checks