Skip to main content

🛡️ AWS DynamoDB Table Point In Time Recovery is not enabled🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-a822159a1

Description​

Open File

Description​

Ensure that Point-in-Time Recovery (PITR) is enabled for all Amazon DynamoDB tables. PITR is a fully managed, continuous backup feature that automatically records all changes to table data, allowing recovery to any second within the preceding 35-day retention window. It protects against accidental writes, deletes, and corruption by enabling precise, time-based data restoration.

Rationale​

Enabling PITR provides an automated and resilient data protection mechanism without requiring manual backup workflows or third-party solutions.This enhances data durability and minimizes the Recovery Time Objective (RTO) in the event of data loss or operational errors.

Impact​

Enabling PITR incurs additional charges based on the total size of the DynamoDB table, including table data and any associated local secondary indexes.

Audit​

This policy marks an AWS DynamoDB Table as INCOMPLIANT if Point In Time Recovery Status is set to DISABLED.

If the DynamoDB Table is not ACTIVE, it is marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

From Command Line​

To enable Point-in-Time Recovery (PITR) for an existing DynamoDB table, use the following AWS CLI command:

aws dynamodb update-continuous-backups \
    --table-name {{table-name}} \
    --point-in-time-recovery-specification PointInTimeRecoveryEnabled=True

Using AWS CloudFormation​

  • CloudFormation template (YAML):
AWSTemplateFormatVersion: '2010-09-09'
Description: Enable Point-in-Time Recovery for an existing DynamoDB table

Parameters:
  TableName:
    Type: String
    Description: Name of the existing DynamoDB table

Resources:
  PointInTimeRecovery:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref TableName
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
        RecoveryPeriodInDays: 35

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DynamoDB.2] DynamoDB tables should have point-in-time recovery enabled11no data
💼 AWS Well-Architected → 💼 REL09-BP01 Identify and back up all data that needs to be backed up, or reproduce the data from sources2no data
💼 AWS Well-Architected → 💼 REL09-BP03 Perform data backup automatically3no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery18no data
💼 FedRAMP High Security Controls → 💼 CP-6(2) Recovery Time and Recovery Point Objectives (H)12no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)5410no data
💼 FedRAMP High Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)212no data
💼 FedRAMP High Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)5no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)9no data
💼 FedRAMP Low Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)12no data
💼 FedRAMP Low Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)5no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)210no data
💼 FedRAMP Moderate Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)112no data
💼 FedRAMP Moderate Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)5no data
💼 NIST CSF v2.0 → 💼 ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained5no data
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles25no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected164no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected156no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested12no data
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process12no data
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed12no data
💼 NIST CSF v2.0 → 💼 RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration6no data
💼 NIST CSF v2.0 → 💼 RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed12no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives12no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-9 System Backup87no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-10 System Recovery and Reconstitution612no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy11no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-12 Information Management and Retention35no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-13(5) Predictable Failure Prevention _ Failover Capability11no data