# Ensure DynamoDB table is protected by a backup plan - Source: https://support.icompaas.com/support/solutions/articles/a_179329223818835-ensure-dynamodb-table-is-protected-by-a-backup-plan - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon DynamoDB table is included in an AWS Backup plan. A table is counted as protected when a resource assignment of a backup plan explicitly lists the table's ARN, the wildcard arn:aws:dynamodb:\*:\*:table/\* (all DynamoDB tables) or \* (all resources) in its resource list; tables that are covered only through tag-based selections are reported as unprotected. The backup plan then takes scheduled backups of the table and keeps them for the defined retention period. **Rationale** Without a backup plan, a table has no centrally managed, scheduled backups. Accidental deletes, corrupted writes or malicious changes can then become unrecoverable, and recovery takes longer. AWS Backup plans also allow cross-region and cross-account copies and backup vault locks, which protect backups against regional failures and deletion. Including all critical tables in a backup plan, and regularly testing restores, keeps recovery predictable. **Impact** - Provides scheduled, centrally managed backups of the table - Allows recovery from data loss, corruption or deletion within the retention period - Backup storage and restore operations are charged, so retention periods should be chosen with cost in mind **Default Value** DynamoDB tables are not included in any AWS Backup plan by default. **Pre-Requisites** - IAM permissions: dynamodb:ListTables, backup:ListBackupPlans, backup:ListBackupSelections, backup:GetBackupSelection, backup:CreateBackupPlan, backup:CreateBackupSelection and iam:PassRole - An IAM role that AWS Backup can use to back up the tables (for example, the default role that the console can create) - Agreement on the backup frequency and retention period for the tables **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans** in the left menu. 3. Open each backup plan and review its **Resource assignments**. 4. Check whether the table is selected by its ARN, or whether an assignment includes all DynamoDB tables or all resources. 5. Repeat for each region in use. 6. If a table is not included in any backup plan, follow the implementation steps. **CLI:** List the backup plans in a region: aws backup list-backup-plans --region --query "BackupPlansList\[\].\[BackupPlanName,BackupPlanId\]" --output table List the resource assignments of a backup plan: aws backup list-backup-selections --backup-plan-id --region --query "BackupSelectionsList\[\].\[SelectionName,SelectionId\]" --output table Show the resources selected by an assignment: aws backup get-backup-selection --backup-plan-id --selection-id --region --query "BackupSelection.Resources" A table fails if no resource assignment lists its ARN, arn:aws:dynamodb:\*:\*:table/\* (all DynamoDB tables) or \* (all resources). Tables selected only through tags or conditions are not counted as protected. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console, select **Settings**, choose **Configure resources** and make sure **DynamoDB** is turned on. 3. If no suitable backup plan exists, select **Backup plans**, choose **Create backup plan**, select **Build a new plan**, enter a plan name and a backup rule (vault, frequency and retention), and choose **Create plan**. 4. On the plan page, choose **Assign resources**. 5. Enter a **Resource assignment name** and select the IAM role (for example **Default role**). 6. Choose to include specific resource types, select **DynamoDB**, and select either all tables or the specific tables. 7. Choose **Assign resources**. 8. Repeat for each region in use. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Backup console and select **Backup plans**. 3. Open the backup plan and select the resource assignment that was added. 4. Choose **Delete** and confirm. 5. If a backup plan was created only for this purpose, delete the plan as well. Note: removing the assignment stops new scheduled backups of the table. Existing recovery points stay in the backup vault until they are deleted or reach the end of their retention period. **Reference** - [https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html](https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html) - [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/CreateBackupAWS.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/CreateBackupAWS.html) - [https://aws.amazon.com/blogs/database/set-up-scheduled-backups-for-amazon-dynamodb-using-aws-backup/](https://aws.amazon.com/blogs/database/set-up-scheduled-backups-for-amazon-dynamodb-using-aws-backup/) - [https://docs.aws.amazon.com/cli/latest/reference/backup/get-backup-selection.html](https://docs.aws.amazon.com/cli/latest/reference/backup/get-backup-selection.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.