Project: KICS (Provisioning / Security & Compliance)
File: c8dee387-a2e6-4a73-a942-183c975549ac.md

title: DynamoDB With Aws Owned CMK hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c8dee387-a2e6-4a73-a942-183c975549ac Query name: DynamoDB With Aws Owned CMK Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: AWS DynamoDb should be encrypted using AWS Managed CMK, instead of AWS-owned CMK. To verify this, SSEEnabled must be verified if false for AWS-owned CMK or true for AWS-Managed CMK. Default value is false.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="4" AWSTemplateFormatVersion: "2010-09-09" Description: Sample CloudFormation template for DynamoDB with AWS-Owned CMK Resources: DynamoDBOnDemandTable2: Type: "AWS::DynamoDB::Table" Properties: TableName: "dynamodb-kms-0" AttributeDefinitions: AttributeName: pk AttributeType: S KeySchema: AttributeName: pk KeyType: HASH BillingMode: PAYPERREQUEST SSESpecification: SSEEnabled: false SSEType: "KMS" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="4" AWSTemplateFormatVersion: "2010-09-11" Description: Sample CloudFormation template for DynamoDB with AWS-Owned CMK Resources: DynamoDBOnDemandTable4: Type: "AWS::DynamoDB::Table" Properties: TableName: "dynamodb-kms-2" AttributeDefinitions: AttributeName: pk AttributeType: S KeySchema: AttributeName: pk KeyType: HASH BillingMode: PAYPERREQUEST SSESpecification: SSEType: "KMS" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="4" AWSTemplateFormatVersion: "2010-09-10" Description: Sample CloudFormation template for DynamoDB with AWS-Owned CMK Resources: DynamoDBOnDemandTable5: Type: "AWS::DynamoDB::Table" Properties: TableName: "dynamodb-kms-3" AttributeDefinitions: AttributeName: pk AttributeType: S KeySchema: AttributeName: pk KeyType: HASH BillingMode: PAYPERREQUEST ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="5" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Sample CloudFormation template for DynamoDB with AWS-Owned CMK", "Resources": { "DynamoDBOnDemandTable2": { "Type": "AWS::DynamoDB::Table", "Properties": { "TableName": "dynamodb-kms-0", "AttributeDefinitions": [ { "AttributeName": "pk", "AttributeType": "S" } ], "KeySchema": [ { "AttributeName": "pk", "KeyType": "HASH" } ], "BillingMode": "PAYPERREQUEST", "SSESpecification": { "SSEEnabled": false, "SSEType": "KMS" } } } } } ``` </details> <details><summary>Positive test

5 - json file</summary> ```json hl_lines="4" { "Description": "Sample CloudFormation template for DynamoDB with AWS-Owned CMK", "Resources": { "DynamoDBOnDemandTable4": { "Type": "AWS::DynamoDB::Table", "Properties": { "SSESpecification": { "SSEType": "KMS" }, "TableName": "dynamodb-kms-2", "AttributeDefinitions": [ { "AttributeName": "pk", "AttributeType": "S" } ], "KeySchema": [ { "AttributeName": "pk", "KeyType": "HASH" } ], "BillingMode": "PAYPERREQUEST" } } }, "AWSTemplateFormatVersion": "2010-09-11" } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="5" { "AWSTemplateFormatVersion": "2010-09-10", "Description": "Sample CloudFormation template for DynamoDB with AWS-Owned CMK", "Resources": { "DynamoDBOnDemandTable5": { "Type": "AWS::DynamoDB::Table", "Properties": { "TableName": "dynamodb-kms-3", "AttributeDefinitions": [ { "AttributeName": "pk", "AttributeType": "S" } ], "KeySchema": [ { "AttributeName": "pk", "KeyType": "HASH" } ], "BillingMode": "PAYPERREQUEST" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: Sample CloudFormation template for DynamoDB with customer managed CMK Resources: dynamodbKMSKey: Type: AWS::KMS::Key Properties: Description: "An example CMK" KeyPolicy: Version: "2012-10-17" Id: "key-default-1" Statement: Sid: "Allow administration of the key" Effect: "Allow" Principal: AWS: "arn:aws:iam::123456789012:user/ana" Action: "kms:Create*" "kms:Describe*" "kms:Enable*" "kms:List*" "kms:Put*" "kms:Update*" "kms:Revoke*" "kms:Disable*" "kms:Get*" "kms:Delete*" "kms:ScheduleKeyDeletion" "kms:CancelKeyDeletion" Resource: "*" Sid: "Allow use of the key" Effect: "Allow" Principal: AWS: "arn:aws:iam::123456789012:user/ana" Action: "kms:DescribeKey" "kms:Encrypt" "kms:Decrypt" "kms:ReEncrypt*" "kms:GenerateDataKey" "kms:GenerateDataKeyWithoutPlaintext" Resource: "*" DynamoDBOnDemandTable1: Type: "AWS::DynamoDB::Table" Properties: TableName: "dynamodb-kms" AttributeDefinitions: AttributeName: pk AttributeType: S KeySchema: AttributeName: pk KeyType: HASH BillingMode: PAYPERREQUEST SSESpecification: KMSMasterKeyId: !Ref dynamodbKMSKey SSEEnabled: true SSEType: "KMS" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "dynamodbKMSKey": { "Type": "AWS::KMS::Key", "Properties": { "Description": "An example CMK", "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Allow administration of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/ana" }, "Action": [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ], "Resource": "*" }, { "Sid": "Allow use of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/ana" }, "Action": [ "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*" } ] } } }, "DynamoDBOnDemandTable1": { "Type": "AWS::DynamoDB::Table", "Properties": { "BillingMode": "PAYPERREQUEST", "SSESpecification": { "KMSMasterKeyId": "dynamodbKMSKey", "SSEEnabled": true, "SSEType": "KMS" }, "TableName": "dynamodb-kms", "AttributeDefinitions": [ { "AttributeName": "pk", "AttributeType": "S" } ], "KeySchema": [ { "AttributeName": "pk", "KeyType": "HASH" } ] } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Sample CloudFormation template for DynamoDB with customer managed CMK" } ```