Back to Checks
aws

DynamoDB table has deletion protection enabled

dynamodb_table_deletion_protection_enabled
Service: dynamodbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsDynamoDbTable

DynamoDB tables have deletion protection enabled via the deletion protection setting, meaning delete operations require this setting to be disabled first

Prowler logoProwlerprowler-provider-aws

Risk

Without deletion protection, tables can be removed by authorized actions or misconfigured automation, causing irrecoverable data loss and service outage. This impacts integrity and availability, and increases the blast radius of compromised credentials or mistaken runbooks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dynamodb_table_deletion_protection_enabled

Recommendation

Enable deletion protection on critical tables.

  • Enforce least privilege to restrict who can modify this setting
  • Require change control to disable it before planned deletes
  • Combine with PITR and backups for defense in depth
  • Use automation to make this the default for new tables

Remediation

CLI

aws dynamodb update-table --table-name <TABLE_NAME> --deletion-protection-enabled

Terraform

resource "aws_dynamodb_table" "<example_resource_name>" {
  name     = "<example_resource_name>"
  hash_key = "id"

  attribute {
    name = "id"
    type = "S"
  }

  deletion_protection_enabled = true  # CRITICAL: Prevents accidental table deletion
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::DynamoDB::Table
    Properties:
      DeletionProtectionEnabled: true  # CRITICAL: Enables deletion protection to prevent table deletion

Other

1Open the AWS Management Console and go to DynamoDB
2Select the table
3Choose Additional settings
4Enable Deletion protection
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dynamodb.dynamodb_client import dynamodb_client


class dynamodb_table_deletion_protection_enabled(Check):
    def execute(self):
        findings = []
        for table in dynamodb_client.tables.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=table)
            report.status = "FAIL"
            report.status_extended = f"DynamoDB table {table.name} does not have deletion protection enabled."

            if table.deletion_protection:
                report.status = "PASS"
                report.status_extended = (
                    f"DynamoDB table {table.name} has deletion protection enabled."
                )

            findings.append(report)

        return findings

References