Rule: DynamoDB Table Encryption Enabled

Rule Description

Troubleshooting Steps

2. 1.

   Verify Encryption Status: First, confirm whether encryption is already enabled for the DynamoDB table. You can check this by examining the table's settings or by using the AWS Management Console, AWS CLI, or SDKs.

4. 2.

   Update Table Encryption: If encryption is not enabled, you will need to update the table settings to enable encryption. This can be done through AWS Management Console, AWS CLI, or SDKs, depending on your preferred method.

6. 3.

   Verify Encryption Type: Check the encryption type used for the DynamoDB table. HIPAA compliance requires that the table uses AWS managed keys (SSE-AES256) or customer-managed keys (SSE-C). Ensure that the appropriate encryption type is used.

8. 4.

   Monitor and Verify Compliance: After enabling encryption, periodically monitor the DynamoDB table to ensure it remains compliant with HIPAA requirements. Regularly reviewing the table's encryption status and logs can help identify any potential issues or changes that need attention.

Necessary Code

AWS CLI Example:

aws dynamodb update-table --table-name <table-name> --sse-specification Enabled=true, SSEType=<encryption-type>

<table-name>

<encryption-type>

AWS SDK Example (Python):

import boto3

dynamodb = boto3.client('dynamodb')

response = dynamodb.update_table(
    TableName='<table-name>',
    SSESpecification={
        'Enabled': True,
        'SSEType': '<encryption-type>'
    }
)

<table-name>

<encryption-type>

Step-by-Step Guide for Remediation

2. 1.

   Identify the DynamoDB table: Determine the specific DynamoDB table that needs encryption enabled. Note down its name for reference.

4. 2.

   Choose an encryption type: Decide whether you want to use AWS managed keys (SSE-AES256) or customer-managed keys (SSE-C) for encryption. Refer to the HIPAA compliance guidelines for the suitable encryption type.

6. 3.

   Enable encryption using AWS Management Console:

   • Open the AWS Management Console and navigate to the DynamoDB service.
   • Select the target region from the console's top-right corner if it is not already selected.
   • Click on the name of the target DynamoDB table.
   • Under the "Encryption" tab or section, click on the "Edit" or "Update" button.
   • Choose the desired encryption option (AWS managed keys or customer-managed keys).
   • Save the changes to enable encryption for the DynamoDB table.
8. 4.

   Enable encryption using AWS CLI:

   • Open your preferred terminal or command prompt.
   • Execute the AWS CLI command provided above, replacing

     <table-name>

     and

     <encryption-type>

     with the appropriate values.
   • Verify the command's output for any errors or exceptions.
   • The DynamoDB table should now be encrypted according to the specified encryption type.
10. 5.

    Enable encryption using AWS SDK:

    • Utilize the provided AWS SDK code example for your preferred programming language (e.g., Python) and replace the placeholders with the correct values.
    • Execute the code snippet and check for any errors or exceptions.
    • Confirm that the DynamoDB table has been successfully encrypted as per the chosen encryption type.
12. 6.

    Periodically monitor and verify compliance:

    • Regularly review the DynamoDB table's encryption status to ensure it remains enabled.
    • Monitor the AWS CloudTrail logs or relevant logs to detect any potential issues related to encryption.
    • Establish a monitoring and alerting system to promptly address any compliance breaches related to encryption.