# Ensure DynamoDB table has point-in-time recovery (PITR) enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292238816134-ensure-dynamodb-table-has-point-in-time-recovery-pitr-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that point-in-time recovery (PITR) is enabled on every Amazon DynamoDB table. With PITR, DynamoDB keeps continuous backups of the table and allows it to be restored to any second within the recovery period, which can be up to 35 days.

**Rationale**

Without PITR, unintended or malicious writes and deletes cannot be precisely rolled back. Faulty deployments, compromised credentials or broken batch jobs can then cause permanent data loss or corrupted data, and recovery depends on the last on-demand backup, if any. Enabling PITR with a recovery period that matches your recovery point objective, and testing restores regularly, protects the integrity and availability of table data.

**Impact**

-   Allows the table to be restored to any second within the recovery period
    
-   Protects against accidental writes and deletes, and against data corruption by applications
    
-   PITR is charged based on the size of the table and its indexes
    
-   A restore always creates a new table; the existing table is not overwritten
    

**Default Value**

Point-in-time recovery is disabled by default when a table is created.

**Pre-Requisites**

-   IAM permissions: dynamodb:ListTables, dynamodb:DescribeContinuousBackups and dynamodb:UpdateContinuousBackups
    
-   Agreement on the recovery period needed for each table
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select **Tables**.
    
3.  Select a table and open the **Backups** tab.
    
4.  Check the status in the **Point-in-time recovery (PITR)** section.
    
5.  Repeat for each table in each region in use.
    
6.  If PITR is off for any table, follow the implementation steps.
    

**CLI:**

List the tables in a region:

aws dynamodb list-tables --region <REGION> --query "TableNames"

Show the PITR status of a table:

aws dynamodb describe-continuous-backups --table-name <TABLE\_NAME> --region <REGION> --query "ContinuousBackupsDescription.PointInTimeRecoveryDescription.PointInTimeRecoveryStatus"

A table fails if PointInTimeRecoveryStatus is not ENABLED.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select **Tables**.
    
3.  Select the table and open the **Backups** tab.
    
4.  In the **Point-in-time recovery (PITR)** section, choose **Edit**.
    
5.  Turn on point-in-time recovery and, if offered, set the recovery period.
    
6.  Choose **Save changes**.
    
7.  Repeat for each affected table in each region in use.
    

**CLI:**

Enable PITR on a table:

aws dynamodb update-continuous-backups --table-name <TABLE\_NAME> --region <REGION> --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon DynamoDB console and select the table.
    
3.  Open the **Backups** tab and, in the **Point-in-time recovery (PITR)** section, choose **Edit**.
    
4.  Turn off point-in-time recovery and choose **Save changes**.
    

**CLI:**

aws dynamodb update-continuous-backups --table-name <TABLE\_NAME> --region <REGION> --point-in-time-recovery-specification PointInTimeRecoveryEnabled=false

Note: turning off PITR deletes the continuous backup history, so the table can no longer be restored to an earlier point in time.

**Reference**

-   [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery\_Howitworks.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html)
    
-   [https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery.Tutorial.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery.Tutorial.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-continuous-backups.html](https://docs.aws.amazon.com/cli/latest/reference/dynamodb/update-continuous-backups.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.