How do I enable Encryption at Rest on DynamoDB with CloudFormation

5
votes

I'm trying to figure out if it's possible to create a DynamoDB table using CloudFormation but with Encryption at Rest.

I've managed to find the following develop guide but it just tells you how to create the table using the Console and the AWS CLI: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.tutorial.html

From looking at the SDKs seems that you need to set a property on SSEEnabled on SSESpecification to true but can this go in the cloudformation template? and if so where?

AWS::DynamoDB::Table

1
amazon-dynamodbamazon-cloudformation

1 Answers

6
votes

You should be able to add it in when creating the table in the template: 

{
    "Type" : "AWS::DynamoDB::Table",
    "Properties" : {
      "AttributeDefinitions" : [ AttributeDefinition, ... ],
      "GlobalSecondaryIndexes" : [ GlobalSecondaryIndexes, ... ],
      "KeySchema" : [ KeySchema, ... ],
      "LocalSecondaryIndexes" : [ LocalSecondaryIndexes, ... ],
      "ProvisionedThroughput" : ProvisionedThroughput,
      "SSESpecification" : {
          "SSEEnabled": true
        },
      "StreamSpecification" : StreamSpecification,
      "TableName" : String,
      "Tags" : [ Resource Tag, ... ],
      "TimeToLiveSpecification" : TimeToLiveSpecification
    }
  }
}

Here's link from the docs: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-dynamodb-table.html

Could it be an IntelliSense issue?