Skip to main content

🛡️ AWS DynamoDB Table does not have on-demand backups in the past 90 days🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS DynamoDB Tables that are not protected by AWS Backup recovery points or on-demand backups when Point-in-Time Recovery (PITR) is not enabled.

On-demand backup coverage may be provided through one of the following mechanisms:

  1. On-Demand Backups: Backups created manually using the DynamoDB console or API.
  2. AWS Backup Recovery Points: Backups managed centrally through AWS Backup plans.

Rationale​

Although PITR is recommended for most production workloads, certain environments rely on discrete backups to support long-term data retention, archival requirements, or cost optimization strategies.

If PITR is disabled and recent backups are not available, accidental deletion, data corruption, or misconfiguration may result in permanent data loss. On-demand backups and AWS Backup recovery points provide an alternative protection mechanism, enabling snapshot retention beyond the 35-day PITR window and supporting compliance and audit requirements.

Impact​

Failure to maintain recent backups significantly increases the risk of irreversible data loss due to system failures or human error.

... see more

Remediation​

Open File

Remediation​

Configure Backup Protection for DynamoDB Tables​

When Point-in-Time Recovery (PITR) is not enabled, DynamoDB tables must be protected using either AWS Backup plans or automated on-demand backup processes to ensure recoverability and compliance with data retention requirements.

From Command Line​
Option A: Protect the Table Using an AWS Backup Plan (Sustainable and Centralized Control)​

AWS Backup provides centralized scheduling, retention management, and monitoring for DynamoDB backups. If a suitable backup plan does not already exist, create one before assigning the table.

  1. Create an AWS Backup Plan (If Not Already Present)

    Note: If an existing backup plan already meets organizational backup frequency and retention requirements, this step can be skipped.

    Define the backup plan configuration in a JSON file (for example, backup-plan.json). The following example creates a daily backup at 01:00 Pacific Time with a 365-day retention period:

    {

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 Cloudaware Framework → 💼 Data Protection and Recovery23no data
💼 FedRAMP High Security Controls → 💼 CP-6 Alternate Storage Site (M)(H)319no data
💼 FedRAMP High Security Controls → 💼 CP-6(1) Separation from Primary Site (M)(H)5no data
💼 FedRAMP High Security Controls → 💼 CP-6(2) Recovery Time and Recovery Point Objectives (H)19no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)5414no data
💼 FedRAMP High Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)220no data
💼 FedRAMP High Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)7no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)12no data
💼 FedRAMP Low Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)20no data
💼 FedRAMP Low Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)7no data
💼 FedRAMP Moderate Security Controls → 💼 CP-6 Alternate Storage Site (M)(H)25no data
💼 FedRAMP Moderate Security Controls → 💼 CP-6(1) Separation from Primary Site (M)(H)5no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)214no data
💼 FedRAMP Moderate Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)120no data
💼 FedRAMP Moderate Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)7no data
💼 NIST CSF v2.0 → 💼 ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained7no data
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles27no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected185no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected183no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested15no data
💼 NIST CSF v2.0 → 💼 PR.IR-04: Adequate resource capacity to ensure availability is maintained5no data
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process20no data
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed20no data
💼 NIST CSF v2.0 → 💼 RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration9no data
💼 NIST CSF v2.0 → 💼 RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed20no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6 Alternate Storage Site319no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(1) Alternate Storage Site _ Separation from Primary Site5no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives19no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-9 System Backup811no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-10 System Recovery and Reconstitution620no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy24no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-12 Information Management and Retention37no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-13(5) Predictable Failure Prevention _ Failover Capability19no data