Description

Ensure that Amazon DynamoDB tables have Point-in-Time Recovery (PITR) enabled, allowing the table to be restored to any point in time within the supported retention window (up to 35 days), protecting against accidental writes or deletes.

Rationale

Without PITR, DynamoDB does not maintain continuous backups of table data, meaning that an accidental overwrite, unintended bulk delete, or application bug that corrupts data cannot easily be undone by restoring to a specific point before the incident occurred. Enabling PITR provides continuous, automatic backups with per-second granularity restore capability, significantly improving the organization's ability to recover from accidental or malicious data modification.

Impact

  • Enables restoring the table to any specific point in time within the retention window, protecting against accidental or malicious data changes

  • Complements (but does not replace) periodic AWS Backup plan coverage for longer-term retention

  • Incurs additional cost proportional to the table's continuous backup storage

Default Value

Point-in-Time Recovery is disabled by default on newly created DynamoDB tables.

Pre-Requisites

  • IAM permissions to update table PITR settings (dynamodb:UpdateContinuousBackups)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the table to review.

  3. Open the Backups tab.

  4. Verify that Point-in-time recovery (PITR) shows as On.

  5. If PITR is Off, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the table to update.

  3. Open the Backups tab and select Edit next to Point-in-time recovery (PITR).

  4. Turn on Point-in-time recovery.

  5. Save the changes.

  6. Verify the Backups tab now shows PITR as On and note the Earliest restorable time updates over subsequent hours.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon DynamoDB > Tables and select the affected table.

  3. Open the Backups tab and select Edit next to Point-in-time recovery (PITR).

  4. Turn off Point-in-time recovery.

  5. Save the changes.

Reference