Skip to main content

DynamoDB Tables Should Have Autoscaling Enabled

More Info:​

Amazon DynamoDB Auto Scaling feature should be enabled to dynamically adjust provisioned throughput (read and write) capacity for your tables and global secondary indexes. This can make it easier to administer your DynamoDB data, help you maximize your application availability and reduce your DynamoDB costs.

Risk Level​

Low

Address​

Cost Optimization, Operational Maturity, Performance, Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using the AWS Management Console, follow these steps:

  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your AWS account.

  2. Navigate to DynamoDB Service: Click on the "Services" at the top left corner of the console, then select "DynamoDB" under the Database category.

  3. Select the Table: From the list of DynamoDB tables, select the table for which you want to enable autoscaling.

  4. Modify Table: In the table details page, click on the "Capacity" tab.

  5. Enable Autoscaling: Under the "Table settings" section, find the "Auto Scaling" option and click on the "Modify" button.

  6. Configure Autoscaling: In the "Auto Scaling" section, you can configure the read and write capacity settings for autoscaling. You can choose to enable autoscaling for read capacity, write capacity, or both.

  7. Set Capacity Limits: Set the minimum and maximum capacity units for the read and write capacity. You can also set the target utilization percentage for autoscaling.

  8. Save Changes: Once you have configured the autoscaling settings, click on the "Save" button to apply the changes.

  9. Verify Autoscaling: After saving the changes, DynamoDB will start autoscaling the read and write capacity based on the configured settings.

By following these steps, you can remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using AWS CLI, follow these steps:

  1. List all the DynamoDB tables in your AWS account to identify which tables do not have autoscaling enabled:
aws dynamodb list-tables
  1. For each table that does not have autoscaling enabled, update the table to enable autoscaling using the following command:
aws dynamodb update-table \
    --table-name YOUR_TABLE_NAME \
    --billing-mode PAY_PER_REQUEST \
    --provisioned-throughput ReadCapacityAutoScalingSettings={MinimumCapacity=1,MaximumCapacity=100,AutoScalingDisabled=false,TargetTrackingScalingPolicy={TargetValue=70.0,PredefinedMetricSpecification={PredefinedMetricType=DynamoDBReadCapacityUtilization}}},WriteCapacityAutoScalingSettings={MinimumCapacity=1,MaximumCapacity=100,AutoScalingDisabled=false,TargetTrackingScalingPolicy={TargetValue=70.0,PredefinedMetricSpecification={PredefinedMetricType=DynamoDBWriteCapacityUtilization}}}

Replace YOUR_TABLE_NAME with the name of the DynamoDB table that you want to enable autoscaling for.

  1. Verify that autoscaling is enabled for the DynamoDB table by describing the table and checking the BillingMode and ProvisionedThroughput settings:
aws dynamodb describe-table --table-name YOUR_TABLE_NAME

By following these steps, you can remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS using Python, follow these steps:

  1. Import the necessary libraries:
import boto3
  1. Initialize the DynamoDB client:
dynamodb = boto3.client('dynamodb')
  1. List all the DynamoDB tables:
response = dynamodb.list_tables()
tables = response['TableNames']
  1. Enable autoscaling for each table:
for table_name in tables:
    response = dynamodb.update_table(
        TableName=table_name,
        ProvisionedThroughput={
            'ReadCapacityUnits': 5,  # Set your desired read capacity units
            'WriteCapacityUnits': 5  # Set your desired write capacity units
        },
        BillingMode='PROVISIONED',  # Set the billing mode to PROVISIONED
        GlobalSecondaryIndexUpdates=[
            {
                'Update': {
                    'IndexName': 'string',
                    'ProvisionedThroughput': {
                        'ReadCapacityUnits': 5,  # Set your desired read capacity units
                        'WriteCapacityUnits': 5  # Set your desired write capacity units
                    }
                }
            },
        ],
        StreamSpecification={
            'StreamEnabled': False
        },
        SSESpecification={
            'Enabled': False
        },
        TimeToLiveSpecification={
            'Enabled': False
        },
        BillingMode='PAY_PER_REQUEST'  # Set the billing mode to PAY_PER_REQUEST for autoscaling
    )

  1. Replace the placeholder values like 'ReadCapacityUnits': 5 and 'WriteCapacityUnits': 5 with your desired values for read and write capacity units.

  2. Run the Python script to enable autoscaling for all DynamoDB tables.

By following these steps and running the Python script, you can remediate the misconfiguration of DynamoDB tables not having autoscaling enabled in AWS.

Using Terraform
resource "aws_dynamodb_table" "this" {
  name         = "TABLE_NAME" # replace with your table name
  hash_key     = "HASH_KEY_NAME"
  billing_mode = "PROVISIONED"

  read_capacity  = 5
  write_capacity = 5

  attribute {
    name = "HASH_KEY_NAME" # replace with your hash key attribute name
    type = "S"
  }
}

# Read capacity autoscaling target
resource "aws_appautoscaling_target" "dynamodb_read_capacity" {
  max_capacity       = 100
  min_capacity       = 5
  resource_id        = "table/${aws_dynamodb_table.this.name}"
  scalable_dimension = "dynamodb:table:ReadCapacityUnits"
  service_namespace  = "dynamodb"
}

# Read capacity autoscaling policy
resource "aws_appautoscaling_policy" "dynamodb_read_capacity" {
  name               = "DynamoDBReadCapacityUtilization:table/${aws_dynamodb_table.this.name}"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.dynamodb_read_capacity.resource_id
  scalable_dimension = aws_appautoscaling_target.dynamodb_read_capacity.scalable_dimension
  service_namespace  = aws_appautoscaling_target.dynamodb_read_capacity.service_namespace

  target_tracking_scaling_policy_configuration {
    target_value = 70.0

    predefined_metric_specification {
      predefined_metric_type = "DynamoDBReadCapacityUtilization"
    }

    scale_in_cooldown  = 60
    scale_out_cooldown = 60
  }
}

# Write capacity autoscaling target
resource "aws_appautoscaling_target" "dynamodb_write_capacity" {
  max_capacity       = 100
  min_capacity       = 5
  resource_id        = "table/${aws_dynamodb_table.this.name}"
  scalable_dimension = "dynamodb:table:WriteCapacityUnits"
  service_namespace  = "dynamodb"
}

# Write capacity autoscaling policy
resource "aws_appautoscaling_policy" "dynamodb_write_capacity" {
  name               = "DynamoDBWriteCapacityUtilization:table/${aws_dynamodb_table.this.name}"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.dynamodb_write_capacity.resource_id
  scalable_dimension = aws_appautoscaling_target.dynamodb_write_capacity.scalable_dimension
  service_namespace  = aws_appautoscaling_target.dynamodb_write_capacity.service_namespace

  target_tracking_scaling_policy_configuration {
    target_value = 70.0

    predefined_metric_specification {
      predefined_metric_type = "DynamoDBWriteCapacityUtilization"
    }

    scale_in_cooldown  = 60
    scale_out_cooldown = 60
  }
}

This change does not force replacement of the existing table as long as billing_mode = "PROVISIONED" is already set; changing the billing mode from PAY_PER_REQUEST to PROVISIONED would force replacement and a potential outage.

Verification: terraform plan should show the DynamoDB table unchanged (if already provisioned) and four new resources to be added: two aws_appautoscaling_target and two aws_appautoscaling_policy with the capacities, target value, and cooldowns above.

Additional Reading:​