---
title: DynamoDB tables should use KMS encryption
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > DynamoDB tables should use KMS
  encryption
---

# DynamoDB tables should use KMS encryption
 
## Description{% #description %}

DynamoDB tables should have encryption at rest enabled. All DynamoDB tables are encrypted by default using an AWS owned key. AWS managed KMS keys and customer managed KMS keys are also supported. This rule verifies that encryption at rest is not explicitly disabled.

## Remediation{% #remediation %}

Ensure encryption at rest is enabled on the table. AWS owned keys (the default), AWS managed KMS keys, and customer managed KMS keys are all acceptable. For guidance, see [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html).