Description

Ensure that Amazon DynamoDB tables containing important data are protected by an AWS Backup plan (or, at minimum, have on-demand backups or point-in-time recovery configured), so that table data can be restored following accidental deletion, corruption, or malicious action.

Rationale

DynamoDB does not automatically create ongoing backups beyond what is explicitly configured, and relying solely on point-in-time recovery (which has a limited retention window) may not satisfy longer-term retention or centralized backup governance requirements. Including a table in an AWS Backup plan ensures it is covered by centrally managed, scheduled backups with a defined retention lifecycle, in addition to any point-in-time recovery configuration.

Impact

  • Ensures table data can be restored according to a defined, centrally managed retention schedule

  • Provides centralized visibility and auditability of backup coverage across DynamoDB tables

  • Increases storage cost for backup retention, which should be sized to an appropriate policy

Default Value

DynamoDB tables are not automatically included in any AWS Backup plan by default; this must be explicitly configured via resource assignment.

Pre-Requisites

  • An existing AWS Backup plan with an appropriate schedule and retention lifecycle

  • IAM permissions to update backup resource assignments (backup:UpdateBackupSelection or backup:CreateBackupSelection)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the table to review.

  3. Open the Backups tab and review any AWS Backup plan coverage indicated for the table (or check AWS Backup > Backup plans > Resource assignments directly).

  4. Verify that the table is included in the resource assignment of at least one backup plan.

  5. If the table is not covered by a backup plan, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup plans and select the appropriate plan (or create one if none exists that fits the table's requirements).

  3. Open Resource assignments and select Assign resources.

  4. Add the DynamoDB table by specific resource ARN, or ensure the table carries a tag that matches the plan's tag-based assignment rule.

  5. Save the resource assignment.

  6. Verify the first scheduled backup job for the table completes successfully under AWS Backup > Jobs.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Backup > Backup plans, open the relevant plan's Resource assignments, and remove the DynamoDB table from the assignment.

Reference