Is DynamoDB encrypted?

Yes. All DynamoDB data is encrypted at rest by default, using encryption keys stored in AWS Key Management Service (KMS), and encryption cannot be turned off. You choose the key type — an AWS owned key (the default, free), an AWS managed key, or a customer managed key — and data in transit is protected with HTTPS/TLS.

What encryption at rest covers

Encryption applies to everything an encrypted table stores on durable media: the table itself including its primary key, local and global secondary indexes, streams, global tables, and backups. Note that if your table has a sort key, some of the sort keys that mark range boundaries are stored in plaintext in the table metadata.

The three key options

AWS owned key — the default. Owned and managed by DynamoDB, at no additional charge.
AWS managed key — stored in your account and managed by AWS KMS (KMS charges apply).
Customer managed key — created, owned, and rotated by you, with full control over access (KMS charges apply).

You can switch between key types at any time from the console, CLI, or API.

What "KMS charges apply" actually costs

AWS says the charge exists and leaves you to price it, so people assume a per-request fee on a database doing millions of requests. It is not one. The encryption docs are specific: "DynamoDB doesn't call AWS KMS for every DynamoDB operation. The key is refreshed once every 5 minutes per caller with active traffic."

That reduces to arithmetic you can check. One caller with continuous traffic refreshes 12 times an hour, so across a 730-hour month:

Requests: 12 × 730 = 8,760 KMS calls, at $0.03 per 10,000 = $0.026.
The key itself: $1/month for a customer managed key, prorated hourly. An AWS managed key carries no monthly key fee, only the request charge.

So a customer managed key on a busy table costs about $1.03/month, and the request half barely moves as traffic grows. Fifty application instances hitting the same table is 438,000 calls, or $1.31. Had DynamoDB called KMS per operation instead, a table serving 200 million requests a month would have added $600.

One more thing worth budgeting for before you pick a customer managed key: disabling it or scheduling it for deletion puts the table into an Inaccessible state, and if DynamoDB cannot reach the key for more than seven days the table is archived to an on-demand backup that you are then billed for.

It's transparent to your application

DynamoDB decrypts data transparently when you read it. You don't change any code to work with an encrypted table, queries work unchanged, and latency stays in the same single-digit-millisecond range. For end-to-end protection of individual attribute values before they leave your application, AWS also offers client-side encryption via the AWS Database Encryption SDK.

Go deeper

Backups are encrypted too — see how they work in the backups & PITR guide, estimate table costs (KMS is billed separately) with the pricing calculator, and download DynoTable to browse your encrypted tables — decryption is handled by AWS before the data reaches any client.

References

Last verified 2026-07-13 against the official AWS documentation linked above. The KMS refresh interval and prices used in the cost section were fetched 2026-07-28.