Description

Ensure that Amazon DynamoDB tables have the Deletion protection setting enabled, so that the table cannot be accidentally deleted via the DeleteTable API or console action without first explicitly disabling this protection.

Rationale

Deleting a DynamoDB table immediately and irreversibly removes all of its data, and without deletion protection, a single console misclick, scripting error, or compromised credential with sufficient permissions can trigger this action. Enabling deletion protection requires an explicit, deliberate additional step before the table can be deleted, protecting against this class of accidental data loss for critical tables.

Impact

  • Prevents accidental or unauthorized deletion of critical DynamoDB tables and their data

  • Requires an explicit, deliberate action to disable protection before legitimate table deletion

  • Adds an extra step to legitimate table decommissioning workflows

Default Value

Deletion protection is disabled by default on newly created DynamoDB tables.

Pre-Requisites

  • IAM permissions to update table settings (dynamodb:UpdateTable)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the table to review.

  3. Open the Overview tab.

  4. Verify that Deletion protection shows as Enabled.

  5. If Deletion protection is disabled for a production table, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the table to update.

  3. Open the Overview tab and select Edit next to Deletion protection (or under Table details).

  4. Enable Deletion protection.

  5. Save the changes.

  6. Verify the Overview tab now shows Deletion protection as Enabled.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the affected table.

  3. Open the Overview tab and select Edit next to Deletion protection.

  4. Disable Deletion protection.

  5. Save the changes.

Reference