Missing Tls in Dynamodb

Remediating missing TLS in DynamoDB requires a multi-layered approach that addresses both configuration and code-level issues. The foundation is ensuring all DynamoDB client configurations explicitly require TLS.

For AWS SDK implementations, the remediation starts with proper endpoint configuration:

// Secure configuration with TLS enforcement
const dynamodb = new AWS.DynamoDB({
  region: 'us-east-1',

This configuration ensures that any attempt to use HTTP endpoints will fail, preventing accidental exposure of credentials and data.

Lambda functions require special attention. The remediation involves adding VPC configurations and security group rules that only allow HTTPS traffic to DynamoDB endpoints:

// Secure Lambda DynamoDB access
export const handler = async (event: any) => {
  const dynamodb = new AWS.DynamoDB({
    region: process.env.AWS_REGION,

For infrastructure-as-code configurations, remediation involves updating resource definitions to enforce TLS:

# Secure DynamoDB configuration
resource "aws_dynamodb_table" "secure_table" {
  name           = "secure-example-table"
  billing_mode   = "PROVISIONED"
  read_capacity  = 20
  write_capacity = 20
  
  point_in_time_recovery {
  
  # TLS is enforced by default for AWS services
  server_side_encryption {

Application-level remediation includes implementing certificate pinning for DynamoDB connections in high-security environments:

import boto3
from botocore.client import Config

# Secure DynamoDB client with TLS verification
secure_config = Config(
    signature_version='v4',

dynamodb = boto3.resource('dynamodb',

For applications using DynamoDB streams, remediation requires implementing TLS for all stream consumers and ensuring that stream endpoints are only accessible through secure channels.

middleBrick's CLI tool can verify these remediations by scanning your deployed APIs:

# Scan DynamoDB API endpoints for TLS compliance
middlebrick scan https://dynamodb.us-east-1.amazonaws.com --category TLS

The GitHub Action integration allows automated TLS verification in CI/CD pipelines:

- name: DynamoDB TLS Security Scan
  uses: middleBrick/middlebrick@v1
  with:
    target: https://dynamodb.us-east-1.amazonaws.com
    category: TLS
    fail-on-severity: high

These remediations ensure that DynamoDB communications remain encrypted, protecting both credentials and sensitive data from network-based attacks.