Securing Data at Rest: The Importance of Encryption and How to Implement It
Tags: security, serverless, data, dynamodb
Published: 2024-07-14 17:30:56

## Introduction
Keeping your data safe is essential for any organization to prevent unauthorized access and breaches. In AWS's shared security responsibility model, customers are responsible for anything they put in the cloud or connect to the cloud, while AWS is responsible for the security of the cloud. For more details, you can [_read more information about AWS shared responsibility model._](https://aws.amazon.com/compliance/shared-responsibility-model/)

Data at rest refers to data stored in AWS data stores, such as Amazon S3 buckets and DynamoDB. In this article, I will highlight the importance of encrypting data at rest and provide a guide on how to encrypt an [_Amazon DynamoDB_](https://aws.amazon.com/dynamodb/) table using a Customer Managed key (CMK).

## Why do we need to encrypt data at rest?

AWS data stores offer encryption at rest using configurable options that we control. These encryption options leverage the AWS Key Management Service (AWS KMS) and keys that either we or AWS manage. By default, data on Amazon DynamoDB tables is fully encrypted. AWS offers several encryption tools, including [_AWS Cryptographic Services and Tools_](https://docs.aws.amazon.com/crypto/latest/userguide/awscryp-service-toplevel.html), and [AWS KMS](https://aws.amazon.com/kms/). In this article, we will focus on adding encryption to DynamoDB using a [AWS KMS CMK](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt).

The importance of encrypting data at rest includes:
- Ensuring sensitive data stored on disks is not readable by any user or application without a valid key.
- Maintaining the confidentiality and protection of sensitive information from unauthorized access.
- Enhancing customer trust by demonstrating a commitment to data security and privacy.
- Minimizing the impact of data breaches on business operations and reputation.



## How to Encrypt a DynamoDB Table Using AWS KMS CMK

The steps below guides on how to encrypt a DynamoDB table using AWS KMS CMK from AWS Management Console:

### Step 1: Create an AWS KMS Customer Managed Key
1. Log in to your **AWS Management Console**.
2. **Navigate to AWS Key Management Service (KMS)** and click on **Create key**.

    ![Create key image on management console](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eu5ix93fzf3ndnw5wqfq.png)

3. **Configure Key**.

    ![Configure key image on management console](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ewe13a98nrgihb4w3zts.png)

4. **Configure Add Labels**: Name the key "mykey".

    ![Configure Add Labels](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/skozjw97ltzogv74ye1s.png)

5. **Define Key Administrative Permissions and Usage Permissions**. [_Read more_](https://repost.aws/questions/QU4A3jhSKwRy-3vUUrS2Fqzw/assign-role-for-administrative-and-usage-permission-kms) about assigning roles for administrative and usage permissions.
6. **Review your configurations** and click **Finish**.

### Step 2: Encrypt DynamoDB Table Data Using the Key
1. **Go to the DynamoDB console** and select **Tables**.
2. Click on **Create table**.

    ![Click on Create table](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8oa6ouvwz5sv7tjicugx.png)

3. On the next page, name your table "`myTable`" and add a partition key.
4. In **Table Settings**, click on **Customize settings**.

    ![Customize settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s2qmm602dw5zojg4iutz.png)

5. Scroll down to **Encryption at rest** and add your custom key.

    ![Add our own custom key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z2dhq180kvd37k0k1zuc.png)
    
    Choose the key you created named "mykey".

6. Click **Create table**.

![Create table](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jfoukzvclyptnqjbcc15.png)
Your table will now be encrypted using the selected CMK.


## Conclusion
Encrypting data at rest in AWS is a critical step in ensuring the security and integrity of your organization's sensitive information. By leveraging AWS KMS Customer Managed Keys (CMK), you can maintain control over your encryption keys and meet compliance requirements. This guide has walked you through the process of creating a custom key and using it to encrypt a DynamoDB table. Implementing these encryption practices not only protects your data from unauthorized access but also enhances customer trust and minimizes the impact of potential data breaches. Prioritizing data security is essential for safeguarding your business operations and reputation.

Follow my social handles for more on AWS Serverless services:
Click to follow on
- [_LinkedIn_](https://www.linkedin.com/in/sherifawofiranye)
- [_Twitter_](https://www.x.com/awofiranyesher2)
- [_Dev_](https://dev.to/iamsherif)
- [_Medium_](https://medium.com/@awofiranyesherif4)