DynamoDB table should use a customer-managed KMS key for encryption

What it checks

DynamoDB table should use a customer-managed KMS key for encryption

Where it applies

Terraform: aws_dynamodb_table

CloudFormation: AWS::DynamoDB::Table

How to fix it

1. Create a CMK and set server_side_encryption { kms_key_arn = <arn> }. Changing the key type requires a table modification (no data loss).

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules