Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
dynamodb_table_autoscaling_enabledProvider: AWS
Service:
dynamodbSeverity: MEDIUM
Categories:
resilienceResource type:
AwsDynamoDbTableWhat this check verifies
DynamoDB tables use automatic capacity scaling viaon-demand mode or PROVISIONED mode with auto scaling enabled for both read and write capacity units.
Provisioned tables are evaluated for scaling on both dimensions.
Risk
Insufficient capacity scaling causes throttling that degrades availability and increases latency. Sustained throttling can trigger retry storms, timeouts, and backlogs, risking missed writes or out-of-order processing that impacts data integrity and drives operational costs.Recommendation
Adopt elastic capacity: preferon-demand for unpredictable traffic, or use PROVISIONED with auto scaling on both reads and writes.
Define safe utilization targets and bounds, monitor consumption, and plan for bursts to maintain availability and resilience over manual fixed throughput.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
aws dynamodb update-table —table-name <table-name> —billing-mode PAY_PER_REQUEST
References
- https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html#dynamodb-1
- https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/AutoScaling.Console.html#AutoScaling.Console.ExistingTable
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = dynamodb_table_autoscaling_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks