DynamoDB table has deletion protection enabled

Check ID: dynamodb_table_deletion_protection_enabled
Provider: AWS
Service: dynamodb
Severity: MEDIUM
Categories: resilience
Resource type: AwsDynamoDbTable

What this check verifies

DynamoDB tables have deletion protection enabled via the deletion protection setting, meaning delete operations require this setting to be disabled first

Risk

Without deletion protection, tables can be removed by authorized actions or misconfigured automation, causing irrecoverable data loss and service outage. This impacts integrity and availability, and increases the blast radius of compromised credentials or mistaken runbooks.

Recommendation

Enable deletion protection on critical tables.

Enforce least privilege to restrict who can modify this setting
Require change control to disable it before planned deletes
Combine with PITR and backups for defense in depth
Use automation to make this the default for new tables

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws dynamodb update-table —table-name <TABLE_NAME> —deletion-protection-enabled

resource "aws_dynamodb_table" "<example_resource_name>" {
  name     = "<example_resource_name>"
  hash_key = "id"

  attribute {
    name = "id"
    type = "S"
  }

  deletion_protection_enabled = true  # CRITICAL: Prevents accidental table deletion
}

Resources:
  <example_resource_name>:
    Type: AWS::DynamoDB::Table
    Properties:
      DeletionProtectionEnabled: true  # CRITICAL: Enables deletion protection to prevent table deletion

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dynamodb_table_deletion_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

DynamoDB table policy blocks cross-account access DynamoDB table is protected by a backup plan

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires