# Ensure DynamoDB table has deletion protection enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292237862814-ensure-dynamodb-table-has-deletion-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that deletion protection is enabled on every Amazon DynamoDB table. When deletion protection is enabled, any request to delete the table fails until the protection is turned off.

**Rationale**

Without deletion protection, a table can be deleted by a single action from a user, a misconfigured script or infrastructure-as-code tool, or an attacker with delete permissions. This causes an immediate outage and, if no backup is available, permanent data loss. Deletion protection adds a deliberate extra step before deletion, and works best together with least privilege on who can change the setting, point-in-time recovery and regular backups.

**Impact**

-   Protects tables from accidental or unauthorized deletion
    
-   Reads, writes and other table updates are not affected
    
-   Planned table deletions, including those by automation or infrastructure-as-code tools, require turning off deletion protection first
    

**Default Value**

Deletion protection is disabled by default when a table is created.

**Pre-Requisites**

-   IAM permissions: dynamodb:ListTables, dynamodb:DescribeTable and dynamodb:UpdateTable
    
-   Confirmation that no automated process needs to delete the table without first turning off deletion protection
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select **Tables**.
    
3.  Select a table and open the **Additional settings** tab.
    
4.  Check whether **Deletion protection** is turned on.
    
5.  Repeat for each table in each region in use.
    
6.  If deletion protection is off for any table, follow the implementation steps.
    

**CLI:**

List the tables in a region:

aws dynamodb list-tables --region <REGION> --query "TableNames"

Show the deletion protection setting of a table:

aws dynamodb describe-table --table-name <TABLE\_NAME> --region <REGION> --query "Table.\[TableName,DeletionProtectionEnabled\]"

A table fails if DeletionProtectionEnabled is false.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select **Tables**.
    
3.  Select the table and open the **Additional settings** tab.
    
4.  In the **Deletion protection** section, choose to turn on deletion protection and confirm.
    
5.  Repeat for each affected table in each region in use.
    

**CLI:**

Enable deletion protection on a table:

aws dynamodb update-table --table-name <TABLE\_NAME> --region <REGION> --deletion-protection-enabled

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select the table.
    
3.  Open the **Additional settings** tab.
    
4.  In the **Deletion protection** section, choose to turn off deletion protection and confirm.
    

**CLI:**

aws dynamodb update-table --table-name <TABLE\_NAME> --region <REGION> --no-deletion-protection-enabled

Note: turning off deletion protection allows the table to be deleted again.

**Reference**

-   [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.Basics.html)
    
-   [https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html](https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-table.html](https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-table.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.