Status: IN
DAX uses the KMS encryption key only at cluster launch, not per-operation; revoking KMS access does not immediately cut off data access until the cluster is shut down.
Source: entries/2026/03/11/amazondynamodb-latest-developerguide-DAXEncryptionAtResthtml.md