DynamoDB Security
Storage & DatabaseDynamoDB Security covers protecting your NoSQL data in AWS's fully managed key-value and document database.
Encryption
- Encryption at Rest: always enabled (since 2018); choose AWS owned key (free), AWS managed key, or customer managed KMS key
- In Transit: all DynamoDB endpoints use HTTPS (TLS); no unencrypted option
Access Control
- IAM Policies: control who can access tables, indexes, and streams
- Fine-grained Access Control: use IAM condition keys (
dynamodb:LeadingKeys) to restrict access to specific items based on partition key - VPC Endpoints: gateway endpoint keeps DynamoDB traffic on the AWS network (no internet traversal)
Data Protection
- Point-in-Time Recovery (PITR): continuous backups with 35-day recovery window
- On-Demand Backups: manual snapshots for long-term retention
- Deletion Protection: prevents accidental table deletion
Related Content
Related Terms
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
A private connection between your VPC and an AWS service that keeps traffic within the AWS network, eliminating the need for internet access.
A JSON document that defines permissions - which actions are allowed or denied on which AWS resources, and under what conditions.
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.