AWS DynamoDB Table Autoscaling

Description

DynamoDB Auto Scaling can dynamically adjust provisioned throughput capacity in response to traffic patterns. This enables a table to increase its provisioned read and write capacity to handle sudden increases in traffic

Query · python

from panther_base_helpers import deep_get

# If you do not wish to enforce application auto-scaling on your dynamo tables Global
# Secondary Indices, set this variable to False
CHECK_GSI = True


def policy(resource):
    # Check if this table has never had auto scaling configured
    if resource["BillingModeSummary"] is None and resource["AutoScalingDescriptions"] is None:
        return False

    # Check if this table is not on provisioned billing (and therefore auto scaling does not apply)
    if deep_get(resource, "BillingModeSummary", "BillingMode") != "PROVISIONED":
        return True

    # Check if application auto scaling is configured
    if resource["AutoScalingDescriptions"] is None:
        return False

    # Build a list of all the resources (the table and optionally the GSI's) to be checked
    table_id = "table/" + resource["Name"]
    resource_auto_scaling = {table_id: False}
    if CHECK_GSI:
        # We cannot use resource.get('GSI', []) here as the value is present, it is just a NoneType
        for gsi in resource["GlobalSecondaryIndexes"] or []:
            resource_auto_scaling[table_id + "/index/" + gsi["IndexName"]] = False

    # Check that each resource that requires application autoscaling has it enabled
    for auto_scale_target in resource["AutoScalingDescriptions"]:
        resource_auto_scaling[auto_scale_target["ResourceId"]] = True

    # Return True if all resources have autoscaling enabled
    return all(resource_auto_scaling.values())

Analyst notes

https://docs.runpanther.io/alert-runbooks/built-in-policies/aws-dynamodb-table-has-autoscaling-enabled

Detection tier

Not a detection

This rule makes no claim about adversary activity — it asserts configuration, suppresses an alert, or records a policy violation — so it sits at no rung of the pyramid.

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Low
Status: Stable
Query type: python
Created: —
Modified: 2024-04-02
Authored by: panther-labs
Source ID: —
Upstream: policies/aws_dynamodb_policies/aws_dynamodb_autoscaling.yml
Type: policy
Version: 1
References: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.html