DynamoDB Accelerator (DAX) clusters should be encrypted at rest

How to fix it

• Replaces the resource: Encryption at rest is fixed when a cluster is created: create a new encrypted cluster, repoint clients to its endpoint, then delete this one; its cache starts empty.
• Can break clients: A cluster with encryption in transit accepts only TLS, so clients need a recent DAX client and the new daxs:// endpoint URL.

In the console

DynamoDB → DAX → Clusters → Create cluster → Encryption

Turn on encryption at rest

Selected; DAX uses an AWS managed key, as customer managed keys are not supported

Turn on encryption in transit

Selected as well: it is also fixed at creation, and DynamoDB.7 fails without it

Node types

Any type except dax.r3.*, which does not support encryption at rest

With the AWS CLI

aws dax create-cluster --cluster-name <new-cluster-name> --node-type <node-type> --replication-factor 3 --iam-role-arn <dax-role-arn> --subnet-group-name <subnet-group-name> --sse-specification Enabled=true --cluster-endpoint-encryption-type TLS --region <region>

With Terraform

• Interrupts service: In Terraform server_side_encryption forces a new cluster, so applying it here deletes this cluster before its replacement is up.

resource "aws_dax_cluster" "this" {
  cluster_name                     = var.cluster_name
  iam_role_arn                     = var.dax_role_arn
  node_type                        = var.node_type
  replication_factor               = 3
  cluster_endpoint_encryption_type = "TLS"

  server_side_encryption {
    enabled = true
  }
}