# Ensure DynamoDB Table Has Deletion Protection Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890029845495-ensure-dynamodb-table-has-deletion-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon DynamoDB tables have the Deletion protection setting enabled, so that the table cannot be accidentally deleted via the DeleteTable API or console action without first explicitly disabling this protection.

**Rationale**

Deleting a DynamoDB table immediately and irreversibly removes all of its data, and without deletion protection, a single console misclick, scripting error, or compromised credential with sufficient permissions can trigger this action. Enabling deletion protection requires an explicit, deliberate additional step before the table can be deleted, protecting against this class of accidental data loss for critical tables.

**Impact**

-   Prevents accidental or unauthorized deletion of critical DynamoDB tables and their data
    
-   Requires an explicit, deliberate action to disable protection before legitimate table deletion
    
-   Adds an extra step to legitimate table decommissioning workflows
    

**Default Value**

Deletion protection is disabled by default on newly created DynamoDB tables.

**Pre-Requisites**

-   IAM permissions to update table settings (dynamodb:UpdateTable)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon DynamoDB > Tables and select the table to review.
    
3.  Open the Overview tab.
    
4.  Verify that Deletion protection shows as Enabled.
    
5.  If Deletion protection is disabled for a production table, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon DynamoDB > Tables and select the table to update.
    
3.  Open the Overview tab and select Edit next to Deletion protection (or under Table details).
    
4.  Enable Deletion protection.
    
5.  Save the changes.
    
6.  Verify the Overview tab now shows Deletion protection as Enabled.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon DynamoDB > Tables and select the affected table.
    
3.  Open the Overview tab and select Edit next to Deletion protection.
    
4.  Disable Deletion protection.
    
5.  Save the changes.
    

**Reference**

-   [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.