Description

Ensure that point-in-time recovery (PITR) is enabled on every Amazon DynamoDB table. With PITR, DynamoDB keeps continuous backups of the table and allows it to be restored to any second within the recovery period, which can be up to 35 days.

Rationale

Without PITR, unintended or malicious writes and deletes cannot be precisely rolled back. Faulty deployments, compromised credentials or broken batch jobs can then cause permanent data loss or corrupted data, and recovery depends on the last on-demand backup, if any. Enabling PITR with a recovery period that matches your recovery point objective, and testing restores regularly, protects the integrity and availability of table data.

Impact

  • Allows the table to be restored to any second within the recovery period

  • Protects against accidental writes and deletes, and against data corruption by applications

  • PITR is charged based on the size of the table and its indexes

  • A restore always creates a new table; the existing table is not overwritten

Default Value

Point-in-time recovery is disabled by default when a table is created.

Pre-Requisites

  • IAM permissions: dynamodb:ListTables, dynamodb:DescribeContinuousBackups and dynamodb:UpdateContinuousBackups

  • Agreement on the recovery period needed for each table

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Tables.

  3. Select a table and open the Backups tab.

  4. Check the status in the Point-in-time recovery (PITR) section.

  5. Repeat for each table in each region in use.

  6. If PITR is off for any table, follow the implementation steps.

CLI:

List the tables in a region:

aws dynamodb list-tables --region <REGION> --query "TableNames"

Show the PITR status of a table:

aws dynamodb describe-continuous-backups --table-name <TABLE_NAME> --region <REGION> --query "ContinuousBackupsDescription.PointInTimeRecoveryDescription.PointInTimeRecoveryStatus"

A table fails if PointInTimeRecoveryStatus is not ENABLED.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select Tables.

  3. Select the table and open the Backups tab.

  4. In the Point-in-time recovery (PITR) section, choose Edit.

  5. Turn on point-in-time recovery and, if offered, set the recovery period.

  6. Choose Save changes.

  7. Repeat for each affected table in each region in use.

CLI:

Enable PITR on a table:

aws dynamodb update-continuous-backups --table-name <TABLE_NAME> --region <REGION> --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon DynamoDB console and select the table.

  3. Open the Backups tab and, in the Point-in-time recovery (PITR) section, choose Edit.

  4. Turn off point-in-time recovery and choose Save changes.

CLI:

aws dynamodb update-continuous-backups --table-name <TABLE_NAME> --region <REGION> --point-in-time-recovery-specification PointInTimeRecoveryEnabled=false

Note: turning off PITR deletes the continuous backup history, so the table can no longer be restored to an earlier point in time.

Reference