DynamoDB Accelerator clusters should be encrypted in transit

How to fix it

• Replaces the resource: Encryption in transit is fixed when a cluster is created: create a new cluster with it on, shift your application's traffic to it, then delete this one.
• Can break clients: The new cluster accepts only TLS, so clients need a recent DAX client and its daxs:// endpoint URL (port 9111 by default).

In the console

DynamoDB → DAX → Clusters → Create cluster → Encryption

Turn on encryption in transit

Selected

Turn on encryption at rest

Selected as well: it is also fixed at creation, and DynamoDB.3 fails without it

With the AWS CLI

aws dax create-cluster --cluster-name <new-cluster-name> --node-type <node-type> --replication-factor 3 --iam-role-arn <dax-role-arn> --subnet-group-name <subnet-group-name> --cluster-endpoint-encryption-type TLS --sse-specification Enabled=true --region <region>

With Terraform

• Interrupts service: In Terraform cluster_endpoint_encryption_type forces a new cluster, so applying it here deletes this cluster before its replacement is up.

resource "aws_dax_cluster" "this" {
  cluster_name                     = var.cluster_name
  iam_role_arn                     = var.dax_role_arn
  node_type                        = var.node_type
  replication_factor               = 3
  cluster_endpoint_encryption_type = "TLS"

  server_side_encryption {
    enabled = true
  }
}