Description

Ensure that every Amazon DynamoDB table is included in an AWS Backup plan. A table is counted as protected when a resource assignment of a backup plan explicitly lists the table's ARN, the wildcard arn:aws:dynamodb:*:*:table/* (all DynamoDB tables) or * (all resources) in its resource list; tables that are covered only through tag-based selections are reported as unprotected. The backup plan then takes scheduled backups of the table and keeps them for the defined retention period.

Rationale

Without a backup plan, a table has no centrally managed, scheduled backups. Accidental deletes, corrupted writes or malicious changes can then become unrecoverable, and recovery takes longer. AWS Backup plans also allow cross-region and cross-account copies and backup vault locks, which protect backups against regional failures and deletion. Including all critical tables in a backup plan, and regularly testing restores, keeps recovery predictable.

Impact

  • Provides scheduled, centrally managed backups of the table

  • Allows recovery from data loss, corruption or deletion within the retention period

  • Backup storage and restore operations are charged, so retention periods should be chosen with cost in mind

Default Value

DynamoDB tables are not included in any AWS Backup plan by default.

Pre-Requisites

  • IAM permissions: dynamodb:ListTables, backup:ListBackupPlans, backup:ListBackupSelections, backup:GetBackupSelection, backup:CreateBackupPlan, backup:CreateBackupSelection and iam:PassRole

  • An IAM role that AWS Backup can use to back up the tables (for example, the default role that the console can create)

  • Agreement on the backup frequency and retention period for the tables

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans in the left menu.

  3. Open each backup plan and review its Resource assignments.

  4. Check whether the table is selected by its ARN, or whether an assignment includes all DynamoDB tables or all resources.

  5. Repeat for each region in use.

  6. If a table is not included in any backup plan, follow the implementation steps.

CLI:

List the backup plans in a region:

aws backup list-backup-plans --region <REGION> --query "BackupPlansList[].[BackupPlanName,BackupPlanId]" --output table

List the resource assignments of a backup plan:

aws backup list-backup-selections --backup-plan-id <BACKUP_PLAN_ID> --region <REGION> --query "BackupSelectionsList[].[SelectionName,SelectionId]" --output table

Show the resources selected by an assignment:

aws backup get-backup-selection --backup-plan-id <BACKUP_PLAN_ID> --selection-id <SELECTION_ID> --region <REGION> --query "BackupSelection.Resources"

A table fails if no resource assignment lists its ARN, arn:aws:dynamodb:*:*:table/* (all DynamoDB tables) or * (all resources). Tables selected only through tags or conditions are not counted as protected.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console, select Settings, choose Configure resources and make sure DynamoDB is turned on.

  3. If no suitable backup plan exists, select Backup plans, choose Create backup plan, select Build a new plan, enter a plan name and a backup rule (vault, frequency and retention), and choose Create plan.

  4. On the plan page, choose Assign resources.

  5. Enter a Resource assignment name and select the IAM role (for example Default role).

  6. Choose to include specific resource types, select DynamoDB, and select either all tables or the specific tables.

  7. Choose Assign resources.

  8. Repeat for each region in use.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Backup console and select Backup plans.

  3. Open the backup plan and select the resource assignment that was added.

  4. Choose Delete and confirm.

  5. If a backup plan was created only for this purpose, delete the plan as well.

Note: removing the assignment stops new scheduled backups of the table. Existing recovery points stay in the backup vault until they are deleted or reach the end of their retention period.

Reference