Skip to main content

🛡️ AWS DynamoDB Table Point In Time Recovery is not enabled🟢

Stats​

not available

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-a822159a1

Description​

Open File

Description​

This policy identifies AWS DynamoDB Tables that are not protected by Point-in-Time Recovery (PITR).

Point-in-Time Recovery is a fully managed, continuous backup feature that captures all changes to table data, enabling recovery to any second within the preceding 35-day retention window. PITR protects against accidental writes, deletions, and data corruption by allowing precise, time-based restoration.

Rationale​

Enabling PITR provides an automated and resilient data protection mechanism without requiring manual backup workflows or third-party solutions. This capability improves data durability and reduces the Recovery Time Objective (RTO) in the event of data loss, operational errors, or unintended changes.

Impact​

Enabling PITR incurs additional charges based on the total size of the DynamoDB table, including table data and any associated local secondary indexes.

Audit​

This policy flags an AWS DynamoDB Table as INCOMPLIANT if the Point-in-Time Recovery Status is set to DISABLED and no recent on-demand backup or AWS Backup recovery point exists.

... see more

Remediation​

Open File

Remediation​

Enable Point-in-Time Recovery​

From Command Line​

To enable Point-in-Time Recovery (PITR) for an existing DynamoDB table, use the following AWS CLI command:

aws dynamodb update-continuous-backups \
    --table-name {{table-name}} \
    --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true
Using AWS CloudFormation​

For CloudFormation-managed DynamoDB tables, set PointInTimeRecoverySpecification on the table resource:

Resources:
  DynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
        RecoveryPeriodInDays: 35

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DynamoDB.2] DynamoDB tables should have point-in-time recovery enabled11no data
💼 AWS Well-Architected → 💼 REL09-BP01 Identify and back up all data that needs to be backed up, or reproduce the data from sources2no data
💼 AWS Well-Architected → 💼 REL09-BP03 Perform data backup automatically3no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery26no data
💼 FedRAMP High Security Controls → 💼 CP-6(2) Recovery Time and Recovery Point Objectives (H)20no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)5416no data
💼 FedRAMP High Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)221no data
💼 FedRAMP High Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)8no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)14no data
💼 FedRAMP Low Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)21no data
💼 FedRAMP Low Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)8no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)216no data
💼 FedRAMP Moderate Security Controls → 💼 CP-10 System Recovery and Reconstitution (L)(M)(H)121no data
💼 FedRAMP Moderate Security Controls → 💼 SI-12 Information Management and Retention (L)(M)(H)8no data
💼 NIST CSF v2.0 → 💼 ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained8no data
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles28no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected248no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested18no data
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process21no data
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed21no data
💼 NIST CSF v2.0 → 💼 RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration10no data
💼 NIST CSF v2.0 → 💼 RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed21no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives20no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-9 System Backup812no data
💼 NIST SP 800-53 Revision 5 → 💼 CP-10 System Recovery and Reconstitution621no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy24no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-12 Information Management and Retention38no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-13(5) Predictable Failure Prevention _ Failover Capability20no data