> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Dax cluster encrypted remediation ### Triage and Remediation ### Remediation Below are the console steps. Because DAX **does not support turning on encryption for an existing cluster**, you must create a new encrypted cluster and then cut over your application. *** ## 1. Check current DAX cluster encryption status 1. Sign in to the **AWS Management Console**. 2. Go to **DynamoDB**. 3. In the left navigation pane, choose **DAX** (or go directly to the DAX console: `https://console.aws.amazon.com/dax/home`). 4. Select the DAX **cluster** in question. 5. On the **Details** tab, check: * **Encryption** / **Encryption at rest**: If it says **Disabled** or **Not encrypted**, you need a new encrypted cluster. *** ## 2. Prepare a KMS key (if you don’t want to use the AWS-managed key) If you’re OK with the AWS-managed key for DAX, you can skip this. 1. Go to the **AWS KMS** console. 2. Choose **Customer managed keys** → **Create key**. 3. Select **Symmetric** and **Encrypt and decrypt**. 4. Configure: * **Key administrators** (who can manage the key). * **Key users** (roles your DAX cluster and applications will use). 5. Finish key creation and note the **KMS Key ID / ARN**. *** ## 3. Create a new encrypted DAX cluster 1. Go to the **DAX** console. 2. Click **Create cluster**. 3. Configure: * **Cluster name**: New name (e.g., `my-app-dax-encrypted`). * **Node type**, **Number of nodes**, and **Replication factor** to match your existing cluster (or adjust as required). 4. Under **Security** / **Encryption**: * Turn **Encryption at rest** to **Enabled**. * For **KMS key**, choose: * **AWS owned key** or * **Customer managed key** you created (recommended if you need key control). 5. Choose the appropriate: * **VPC**, **subnet group**, **security groups**, and **IAM role** so it can reach your DynamoDB tables and your application can reach DAX. 6. Click **Create**. 7. Wait until the new cluster status is **Available**. *** ## 4. Point your application to the new encrypted DAX cluster 1. In the DAX console, open the new encrypted cluster. 2. Copy the **Cluster endpoint** (e.g., `my-app-dax-encrypted.xxxxxx.clustercfg.dax.use1.cache.amazonaws.com:8111`). 3. In your application configuration: * Update the DAX **endpoint** in your SDK/client configuration to the **new cluster endpoint**. 4. Deploy/restart your application so it connects to the new DAX cluster. 5. Monitor: * DAX metrics (hit rate, CPU, latency) for the new cluster. * Application logs for connection or timeout errors. *** ## 5. Decommission the old unencrypted cluster Once you confirm the application is functioning correctly and traffic is fully on the new cluster: 1. Go to the **DAX** console. 2. Select the **old (unencrypted) DAX cluster**. 3. Choose **Delete cluster**. 4. Confirm the deletion. *** ## 6. (Optional) Validate compliance 1. Go to **AWS Config** or your security/compliance tool. 2. Re-run the check/rule (e.g., “DAX cluster should be encrypted at rest”). 3. Confirm that the violation is cleared for the new cluster. For DynamoDB Accelerator (DAX), **encryption at rest must be enabled when you create the cluster**. It cannot be turned on for an existing cluster. Remediation via AWS CLI therefore means: 1. Create a new encrypted DAX cluster 2. Point your application to the new cluster 3. Delete the old unencrypted cluster Below are step‑by‑step CLI commands. *** ## 1. (Optional) Create or choose a KMS key If you want to use a customer-managed KMS key (recommended): ```bash theme={null} aws kms create-key --description "KMS key for DAX encryption" ``` Note the `KeyId` from the output (e.g. `arn:aws:kms:us-east-1:123456789012:key/xxxx`). Ensure the key policy allows DAX to use it (principal: `dax.amazonaws.com`) or just use the default AWS-managed key for DAX if acceptable. *** ## 2. (Optional) Create a subnet group for DAX If you don’t already have one: ```bash theme={null} aws dax create-subnet-group \ --subnet-group-name my-dax-subnet-group \ --subnet-group-description "Subnet group for DAX" \ --subnet-ids subnet-aaaaaaa subnet-bbbbbbb ``` *** ## 3. Create a new encrypted DAX cluster Use `--sse-specification Enabled=true` and (optionally) `--sse-specification KmsKeyId=...`: ```bash theme={null} aws dax create-cluster \ --cluster-name my-encrypted-dax-cluster \ --node-type dax.r5.large \ --replication-factor 3 \ --iam-role-arn arn:aws:iam::123456789012:role/my-dax-iam-role \ --subnet-group-name my-dax-subnet-group \ --security-group-ids sg-0123456789abcdef0 \ --sse-specification Enabled=true,KmsKeyId=arn:aws:kms:us-east-1:123456789012:key/your-key-id ``` If you want to use the AWS-managed key for DAX instead of a customer key, omit `KmsKeyId`: ```bash theme={null} --sse-specification Enabled=true ``` Wait until the cluster is `available`: ```bash theme={null} aws dax describe-clusters --cluster-names my-encrypted-dax-cluster ``` *** ## 4. Update your application configuration Update your app to use the new cluster endpoint: 1. Get the endpoint: ```bash theme={null} aws dax describe-clusters --cluster-names my-encrypted-dax-cluster \ --query "Clusters[0].ClusterDiscoveryEndpoint.Address" \ --output text ``` 2. Replace the old DAX endpoint in your app config with this new one. 3. Deploy/restart your app as needed and verify it is using the new cluster successfully. *** ## 5. Delete the old unencrypted DAX cluster After you’ve confirmed all traffic is using the new encrypted cluster: ```bash theme={null} aws dax delete-cluster --cluster-name my-old-unencrypted-dax-cluster ``` (Optional) If the old subnet groups or parameter groups are no longer needed, delete them as well. *** **Key point:** There is no `modify-cluster` option to enable encryption on an existing DAX cluster. The only compliant remediation is to recreate the cluster with `--sse-specification Enabled=true`. For DynamoDB DAX, encryption at rest must be enabled **when the cluster is created**; you cannot turn it on for an existing unencrypted cluster. Remediation is therefore: 1. Create a new encrypted DAX cluster. 2. Point your app to the new cluster. 3. Delete the old unencrypted cluster. Below is a minimal, step‑by‑step using Python (boto3). *** ### 1. Prerequisites ```bash theme={null} pip install boto3 aws configure # ensure correct region/credentials ``` Make sure your IAM user/role has permissions for: * `dax:DescribeClusters` * `dax:CreateCluster` * `dax:UpdateCluster` * `dax:DeleteCluster` * `iam:PassRole` (if using a service role) *** ### 2. Check current DAX cluster encryption status ```python theme={null} import boto3 dax = boto3.client("dax", region_name="us-east-1") # adjust region cluster_name = "my-dax-cluster" resp = dax.describe_clusters(ClusterNames=[cluster_name]) cluster = resp["Clusters"][0] # In DAX, SSE is at-cluster level; if not present or False, it's unencrypted sse_desc = cluster.get("SSEDescription", {}) status = sse_desc.get("Status") print(f"SSE status: {status}") # possible: 'ENABLING', 'ENABLED', 'DISABLING', 'DISABLED', or None ``` If `status` is `None` or `DISABLED`, you need a new encrypted cluster. *** ### 3. Create a new DAX cluster with encryption enabled Key points: * Set `SSESpecification={'Enabled': True}`. * Use same node type, VPC, security groups, and subnet groups as the old cluster. * Optionally specify a KMS key via `KmsKeyId` (otherwise AWS-managed key is used). ```python theme={null} import time import boto3 dax = boto3.client("dax", region_name="us-east-1") old_cluster_name = "my-dax-cluster" new_cluster_name = "my-dax-cluster-encrypted" # Get settings from existing cluster to reuse old = dax.describe_clusters(ClusterNames=[old_cluster_name])["Clusters"][0] params = { "ClusterName": new_cluster_name, "NodeType": old["NodeType"], "ReplicationFactor": old["ReplicationFactor"], "IamRoleArn": old["IamRoleArn"], "SubnetGroupName": old.get("SubnetGroup"), "SecurityGroupIds": old.get("SecurityGroups", []), "Description": f"Encrypted replacement for {old_cluster_name}", "SSESpecification": {"Enabled": True}, # enable encryption at rest # Optionally: # "KmsKeyId": "arn:aws:kms:region:account-id:key/key-id", # "ParameterGroupName": old.get("ParameterGroup", {}).get("ParameterGroupName"), } # Create encrypted cluster create_resp = dax.create_cluster(**params) print("Creating encrypted DAX cluster...") # Wait until cluster is available waiter_status = None while waiter_status != "available": time.sleep(30) c = dax.describe_clusters(ClusterNames=[new_cluster_name])["Clusters"][0] waiter_status = c["Status"] print(f"Status: {waiter_status}") ``` *** ### 4. Update your application to use the new cluster * Get the new cluster’s endpoint: ```python theme={null} c = dax.describe_clusters(ClusterNames=[new_cluster_name])["Clusters"][0] new_endpoint = c["ClusterDiscoveryEndpoint"]["Address"] new_port = c["ClusterDiscoveryEndpoint"]["Port"] print(f"New DAX endpoint: {new_endpoint}:{new_port}") ``` * Update your app config / environment variables / secrets to use `new_endpoint` instead of the old one. * Redeploy / restart your application so it connects to the new encrypted DAX cluster. DAX is a cache for DynamoDB, so there is no data migration; you only need to switch clients to the new cluster. *** ### 5. Delete the old unencrypted cluster Once you’ve confirmed the app uses the new encrypted cluster and it’s stable: ```python theme={null} response = dax.delete_cluster(ClusterName=old_cluster_name) print("Deleting old unencrypted DAX cluster...") ``` You can also wait for deletion: ```python theme={null} while True: try: dax.describe_clusters(ClusterNames=[old_cluster_name]) print("Still deleting...") time.sleep(30) except dax.exceptions.ClusterNotFoundFault: print("Old cluster deleted.") break ``` *** ### 6. (Optional) Wrap into a remediation script You can encapsulate this logic (detect unencrypted → create encrypted → output new endpoint) into a script and run it for each non‑compliant cluster. ```hcl theme={null} resource "aws_dax_cluster" "DAX_CLUSTER" { # Replace DAX_CLUSTER with your cluster name in Terraform cluster_name = "DAX_CLUSTER_NAME" # set to the desired (new) cluster name, e.g. "-encrypted" node_type = "DAX_NODE_TYPE" # e.g. "dax.r5.large" replication_factor = 3 # replace with your desired node count iam_role_arn = "DAX_IAM_ROLE_ARN" # from the existing cluster subnet_group_name = "DAX_SUBNET_GROUP_NAME" # from the existing cluster security_group_ids = [ "SG_ID_1", "SG_ID_2", ] # This enables server-side encryption at rest, matching `--sse-specification Enabled=true` server_side_encryption { enabled = true } # Optionally match other configuration from the existing cluster: # parameter_group_name = "DAX_PARAMETER_GROUP_NAME" # maintenance_window = "dax:MON:01:00-MON:02:00" # notification_topic_arn = "SNS_TOPIC_ARN" # availability_zones = ["AZ_1", "AZ_2", "AZ_3"] } ``` Enabling `server_side_encryption` on an existing unencrypted DAX cluster forces replacement of the cluster; AWS does not support in‑place encryption, so Terraform will destroy the old cluster and create a new encrypted one (plan will show the `aws_dax_cluster` resource being replaced, with `server_side_encryption.enabled` changing from `false` (or null) to `true`).