AWS DAX cluster not configured with encryption at rest misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_47
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	2e489c95-268e-4cf1-aa98-5ba89635271a

Impact

AWS DAX encryption at rest provides an additional layer of data protection, helping secure your data from unauthorized access to underlying storage. Without encryption, anyone with access to the storage media or the network traffic between the DAX cluster and the client could potentially intercept and view the data. We recommend enabling encryption at rest.

NOTE: With encryption at rest, the data persisted by DAX on disk is encrypted using 256-bit Advanced Encryption Standard (AES-256).

How to Fix

Resource:* AWS::DAX::Cluster

• Arguments: Properties.SSESpecification.SSEEnabled - (Optional) Encrypt at rest options, enabled/disabled. [source,go]

---

Resources: daxCluster: Type: AWS::DAX::Cluster Properties: ...

• SSESpecification:
• SSEEnabled: true

---