AWS DynamoDB Database Encryption In Transit | A Quick Guide

Introduction

Amazon DynamoDB is a storage service from AWS that is perfect for mission-critical and main data storage because
it is very reliable. It stores data in more than one place on various devices in more than one place within an
Amazon DynamoDB Region.

AWS DynamoDB Encryption in Transit

AWS DynamoDB protects data both when it is at rest and when it is moving. Encryption in transit is a way to keep
private information safe while it is being sent to and from DynamoDB. This encryption makes sure that no third
party, including AWS, can get to the raw data. To do this, AWS offers the DynamoDB encryption client, which is a
software library that protects the data as it moves from one place to another. Under the Apache 2.0 licence, the
encryption app is free for anyone to use.

When a user adds things to a DynamoDB table, they can encrypt and sign those items using the DynamoDB encryption
client. It also lets the data be checked and decrypted once it has been returned. This method, which is called
“client-side encryption,” works with most of Amazon DynamoDB’s features, such as global tables. For older versions
of global tables to work with the encryption client, you may need to change how they are set up.

The DynamoDB encryption client makes it easy to make safe implementations by encrypting the attribute values of
each item in a table with a unique encryption key. Signing the things also helps protect them from changes made by
people who shouldn’t be able to, like removing or adding attributes or swapping encrypted values.

When using the DynamoDB Client, encryption keys can come from a number of places, such as custom cryptography
services like AWS CloudHSM or AWS Key Management Service (AWS KMS).

At the moment, you can get the DynamoDB encryption client tools in Java and Python. These tools can work with each
other, so the Java client can encrypt data and the Python client can decrypt it.

It’s important to know that the AWS Encryption SDK and the Amazon S3 Encryption Client are not compatible with the
DynamoDB Encryption Client. So, you can’t use one client-side library to decode something that was encrypted with
another.

Encryption in DynamoDB

By default, DynamoDB encrypts all tables when they are not being used. This means that the information kept in
those tables is safe. But sometimes, when you run searches, you might find DynamoDB tables that look like they are
not encrypted.

You can use the ‘describe-table’ tool to see if encryption is turned on for a certain table. Here’s an example of
how the program can be run:

aws dynamodb describe-table --table-name YOUR_TABLE_NAME --profile YOUR_AWS_PROFILE

When you run the ‘describe-table’ command, the answer will tell you about the table, including whether or not it
is encrypted. If the response has a ‘SSEDescription’ part and the status says “ENABLED,” the table is encrypted
with AWS Key Management Service (KMS). Here’s an example of the answer for a table that has been encrypted:

{
  "Table": {
    ...
    "SSEDescription": {
      "Status": "ENABLED",
      "SSEType": "KMS",
      "KMSMasterKeyArn": "arn:aws:kms:eu-west-2:YOUR_ACCOUNT_ID:key/YOUR_KMS_KEY_ID"
    }
  }
}

If the ‘SSEDescription’ section is missing from the response, on the other hand, it means that the table is
encrypted with the default choice. In this case, DynamoDB uses the CMK (Customer Master Key) that it already has.

When using the default encryption choice, it’s important to remember that the ‘SSEDescription’ field may not be in
the response that is longer than 1500 characters.

Conclusion

Codeyo Genie is here to help, so don’t forget that. If you need more help or would rather have an expert show you the way. Contact us today to improve how your website works and make sure your users can always get to it.