Back to Checks
aws

DynamoDB table has point-in-time recovery (PITR) enabled

dynamodb_tables_pitr_enabled
Service: dynamodbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsDynamoDbTable

DynamoDB tables have Point-in-Time Recovery (PITR) enabled

Prowler logoProwlerprowler-provider-aws

Risk

Without PITR, unintended or malicious writes/deletes cannot be precisely rolled back, leading to permanent data loss and corrupted state. Failures from buggy deployments, compromised credentials, or faulty batch jobs reduce data integrity and availability, and prolong incident recovery and forensic analysis.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks dynamodb_tables_pitr_enabled

Recommendation

Enable PITR on critical tables and set a recovery window aligned to your RPO (1-35 days). Enforce least privilege on who can modify backup settings. Regularly test restores and monitor backup status. Embed PITR in IaC and change control for consistency, and apply defense in depth with on-demand backups for key milestones.

Remediation

CLI

aws dynamodb update-continuous-backups --table-name <table_name> --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

Terraform

# Enable PITR on a DynamoDB table
resource "aws_dynamodb_table" "<example_resource_name>" {
  name         = "<example_resource_name>"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "id"

  attribute {
    name = "id"
    type = "S"
  }

  point_in_time_recovery {
    enabled = true  # Critical: enables PITR
  }
}

NativeIaC

# CloudFormation: enable PITR on a DynamoDB table
Resources:
  <example_resource_name>:
    Type: AWS::DynamoDB::Table
    Properties:
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true  # Critical: enables Point-in-Time Recovery (PITR)

Other

1Open the AWS Management Console and go to DynamoDB
2Select your table and open the Backups tab
3Click Edit in the Point-in-time recovery section and choose Turn on point-in-time recovery
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.dynamodb.dynamodb_client import dynamodb_client


class dynamodb_tables_pitr_enabled(Check):
    def execute(self):
        findings = []
        for table in dynamodb_client.tables.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=table)
            report.status = "FAIL"
            report.status_extended = f"DynamoDB table {table.name} does not have point-in-time recovery enabled."
            if table.pitr:
                report.status = "PASS"
                report.status_extended = (
                    f"DynamoDB table {table.name} has point-in-time recovery enabled."
                )
            findings.append(report)
        return findings

References