DynamoDB.7: DAX clusters should be encrypted in transit

Written and reviewed by Emnode · Last reviewed 27 May 2026

What does AWS Security Hub DynamoDB.7 check?

DynamoDB.7 checks the endpoint encryption type of a DAX cluster. It reports FAILED when the cluster's endpoint encryption type is not TLS, meaning client traffic to the cache travels unencrypted.

Why does DynamoDB.7 matter?

DAX caches table data, so traffic between the application and the cluster carries the same sensitive records. Without TLS on the endpoint, that traffic can be intercepted on the network in transit: the in-transit counterpart to DynamoDB.3's at-rest concern.

How do I fix DynamoDB.7?

Find clusters whose endpoint encryption type is not TLS with describe-clusters.
Because the setting is immutable, create a replacement cluster with --cluster-endpoint-encryption-type TLS.
Cut the application's DAX client over to the new endpoint with minimal disruption.
Delete the old non-TLS cluster.

Remediation script · bash

# Find the highest-impact plaintext-permitting stores across engines.
aws rds describe-db-instances \
  --query 'DBInstances[].DBInstanceIdentifier' --output text
aws elasticache describe-replication-groups \
  --query 'ReplicationGroups[?TransitEncryptionEnabled==`false`].ReplicationGroupId' \
  --output text

# RDS for PostgreSQL: require TLS via rds.force_ssl (static -> needs a reboot).
PG=$(aws rds describe-db-instances --db-instance-identifier prod-orders-pg \
  --query 'DBInstances[].DBParameterGroups[].DBParameterGroupName' --output text)
aws rds modify-db-parameter-group --db-parameter-group-name "$PG" \
  --parameters 'ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=pending-reboot'
aws rds reboot-db-instance --db-instance-identifier prod-orders-pg

# Redshift: require_ssl on a custom cluster parameter group, then reboot.
aws redshift modify-cluster-parameter-group --parameter-group-name analytics-tls \
  --parameters ParameterName=require_ssl,ParameterValue=true
aws redshift reboot-cluster --cluster-identifier analytics-prod

Full walkthrough (console steps, edge cases and verification) in the lesson Enforce TLS on database and cache connections.

Is DynamoDB.7 a false positive?

Endpoint encryption type is fixed at creation: remediation means rebuilding the cluster with TLS, not toggling a setting. It is also separate from DynamoDB.3 (at rest).

Full lesson Enforce TLS on database and cache connections Step-by-step remediation with CLI, code and persona-specific context.

AWS documentation for DynamoDB controls ↗ Check your own account for DynamoDB.7 →

Part of the learning path Encrypt everything

DynamoDB.1 DynamoDB tables should auto-scale capacity
DynamoDB.2 DynamoDB tables should have PITR
DynamoDB.3 DAX clusters should be encrypted at rest
DynamoDB.4 DynamoDB tables should be in a backup plan
DynamoDB.6 DynamoDB tables should have deletion protection