Check provider logo

DynamoDB table has point-in-time recovery (PITR) enabled

dynamodb_tables_pitr_enabled

Severitymedium
Servicedynamodb
by Prowler
resilience

DynamoDB tables have Point-in-Time Recovery (PITR) enabled

Risk

Without PITR, unintended or malicious writes/deletes cannot be precisely rolled back, leading to permanent data loss and corrupted state. Failures from buggy deployments, compromised credentials, or faulty batch jobs reduce data integrity and availability, and prolong incident recovery and forensic analysis.

Run this check with Prowler CLI

prowler aws --checks dynamodb_tables_pitr_enabled

Run in Prowler Cloud

Recommendation

Enable PITR on critical tables and set a recovery window aligned to your RPO (1-35 days). Enforce least privilege on who can modify backup settings. Regularly test restores and monitor backup status. Embed PITR in IaC and change control for consistency, and apply defense in depth with on-demand backups for key milestones.

Remediation

CLI

aws dynamodb update-continuous-backups --table-name <table_name> --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

Native IaC
Terraform
Other
  1. Open the AWS Management Console and go to DynamoDB
  2. Select your table and open the Backups tab
  3. Click Edit in the Point-in-time recovery section and choose Turn on point-in-time recovery
  4. Click Save

Source Code

Resource Type

AwsDynamoDbTable

References