Description

Ensure that deletion protection is enabled on every Amazon DynamoDB table. When deletion protection is enabled, any request to delete the table fails until the protection is turned off.

Rationale

Without deletion protection, a table can be deleted by a single action from a user, a misconfigured script or infrastructure-as-code tool, or an attacker with delete permissions. This causes an immediate outage and, if no backup is available, permanent data loss. Deletion protection adds a deliberate extra step before deletion, and works best together with least privilege on who can change the setting, point-in-time recovery and regular backups.

Impact

  • Protects tables from accidental or unauthorized deletion

  • Reads, writes and other table updates are not affected

  • Planned table deletions, including those by automation or infrastructure-as-code tools, require turning off deletion protection first

Default Value

Deletion protection is disabled by default when a table is created.

Pre-Requisites

  • IAM permissions: dynamodb:ListTables, dynamodb:DescribeTable and dynamodb:UpdateTable

  • Confirmation that no automated process needs to delete the table without first turning off deletion protection

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Tables.

  3. Select a table and open the Additional settings tab.

  4. Check whether Deletion protection is turned on.

  5. Repeat for each table in each region in use.

  6. If deletion protection is off for any table, follow the implementation steps.

CLI:

List the tables in a region:

aws dynamodb list-tables --region <REGION> --query "TableNames"

Show the deletion protection setting of a table:

aws dynamodb describe-table --table-name <TABLE_NAME> --region <REGION> --query "Table.[TableName,DeletionProtectionEnabled]"

A table fails if DeletionProtectionEnabled is false.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Tables.

  3. Select the table and open the Additional settings tab.

  4. In the Deletion protection section, choose to turn on deletion protection and confirm.

  5. Repeat for each affected table in each region in use.

CLI:

Enable deletion protection on a table:

aws dynamodb update-table --table-name <TABLE_NAME> --region <REGION> --deletion-protection-enabled

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select the table.

  3. Open the Additional settings tab.

  4. In the Deletion protection section, choose to turn off deletion protection and confirm.

CLI:

aws dynamodb update-table --table-name <TABLE_NAME> --region <REGION> --no-deletion-protection-enabled

Note: turning off deletion protection allows the table to be deleted again.

Reference