DynamoDB Accelerator (DAX) cluster should have encryption at rest enabled

What it checks

DAX cluster: encryption at rest is not enabled.

Where it applies

Terraform: aws_dax_cluster

CloudFormation: AWS::DAX::Cluster, AWS::DAX::Cluster

How to fix it

1. Set server_side_encryption { enabled = true }. DAX encryption at rest can only be set at cluster creation, so an existing unencrypted cluster must be recreated.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules