Secure configuration of DynamoDB service
resource "aws_dynamodb_table" "vulnerable_table" {
name = "VulnerableTable"
billing_mode = "PROVISIONED"
read_capacity = 20
write_capacity = 20
hash_key = "ID"
attribute {
name = "ID"
type = "N"
}
}
In the above Terraform script, a DynamoDB table named "VulnerableTable" is being created with a
PROVISIONED billing mode and a fixed read/write capacity of 20 units. The hash key for this table is set to "ID", and the attribute is also set to "ID" with a type of "N" (Number).
The vulnerability lies in the configuration of the read and write capacity. This table is set to a fixed read/write capacity, which can lead to throttling if the demand exceeds the provisioned capacity. Throttling can impact the performance of your application and can lead to an unsatisfactory user experience.
Moreover, the billing mode is set to
PROVISIONED, which means you pay for a set amount of read and write capacity, regardless if you use it or not. This can lead to unnecessary costs if your actual usage is much less than your provisioned capacity.
Finally, the table lacks any sort of access control or encryption at rest settings, which can be a security risk. Without proper access control, any user with access to the AWS account could potentially read, write, or delete data in the table. Without encryption at rest, the data stored in the table is vulnerable to unauthorized access.
resource "aws_dynamodb_table" "secure_table" {
name = "SecureTable"
billing_mode = "PAY_PER_REQUEST"
hash_key = "ID"
attribute {
name = "ID"
type = "N"
}
server_side_encryption {
enabled = true
}
point_in_time_recovery {
enabled = true
}
}
The above code represents a secure configuration for an AWS DynamoDB table using Terraform. Here's a breakdown of the changes made:
1. Name: The name of the DynamoDB table is set to "SecureTable". It's important to use meaningful names for your resources.
2. Billing Mode: The billing mode is set to "PAY_PER_REQUEST". This mode is recommended for applications with unpredictable workloads, as it automatically scales throughput capacity to meet workload demands, and charges for the actual reads and writes your application performs.
3. Hash Key: The hash key attribute is set to "ID" and its type is set to "N" (Number). The hash key attribute is the primary key that uniquely identifies each item in a table. It's important to ensure that the hash key attribute is appropriately defined and matches the data type used in your application.
4. Server Side Encryption: Server-side encryption is enabled for the DynamoDB table. This means that DynamoDB will encrypt your data at rest using an AWS managed key, adding an additional layer of security.
5. Point In Time Recovery: Point-in-time recovery is enabled for the DynamoDB table. This helps protect your table data from accidental write or delete operations. With point-in-time recovery, you can restore that table to any point in time during the last 35 days.
Remember, it's also important to implement fine-grained access control using AWS Identity and Access Management (IAM) roles and policies, and regularly monitor and review the DynamoDB table's configuration to ensure it remains secure and aligned with best practices.