Metadata

Id: cloudformation-aws-dynamodb-table-point-in-time-recovery-disabled

Provider: AWS

Platform: CloudFormation

Severity: Medium

Category: Best Practices

Learn More

• Provider Reference

Description

DynamoDB tables must have point-in-time recovery (PITR) enabled to allow restoration to a prior consistent state after accidental deletes, overwrites, or data corruption. Without PITR, you cannot restore to recent points in time, increasing the risk of permanent data loss and extended recovery time. Check AWS::DynamoDB::Table resources and ensure the Properties.PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled property is defined and set to true. Resources missing PointInTimeRecoverySpecification, missing the PointInTimeRecoveryEnabled field, or with PointInTimeRecoveryEnabled set to false will be flagged.

Secure configuration example:

MyDynamoTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: MyTable
    AttributeDefinitions:
      - AttributeName: id
        AttributeType: S
    KeySchema:
      - AttributeName: id
        KeyType: HASH
    BillingMode: PAY_PER_REQUEST
    PointInTimeRecoverySpecification:
      PointInTimeRecoveryEnabled: true

Compliant Code Examples

Resources:
  MyDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification: 
        PointInTimeRecoveryEnabled: true

Non-Compliant Code Examples

Resources:
  MyDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification: 
        PointInTimeRecoveryEnabled: false

Resources:
  MyDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: my-table

Resources:
  MyDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification: {}