Check ID: dynamodb_table_protected_by_backup_plan
Provider: AWS
Service: dynamodb
Severity: MEDIUM
Categories: resilience
Resource type: AwsDynamoDbTable

​
What this check verifies

DynamoDB tables are evaluated for inclusion in an AWS Backup backup plan through resource assignments, including explicit tables, resource-type wildcards, or all-resources coverage. The result indicates whether a table is governed by scheduled backups and retention defined by the plan.

​
Risk

Without a backup plan, table data lacks governed copies, harming availability and integrity. Accidental deletes, corrupt writes, or malicious actions can become unrecoverable, and RPO/RTO worsen. You also forfeit cross-Region/account copies and immutability features, increasing downtime and data loss.

​
Recommendation

Place all critical tables under an AWS Backup backup plan following defense in depth and least privilege:
  • Use tag-based assignments for coverage at scale
  • Define schedules, retention, and cross-Region/account copies
  • Enable Vault Lock for immutability
  • Regularly test restores and restrict backup deletion

​
Remediation

# Terraform: Add DynamoDB tables to an AWS Backup plan
resource "aws_backup_plan" "<example_resource_name>" {
  name = "<example_resource_name>"
  rule {
    rule_name         = "r"
    target_vault_name = "Default"
  }
}

data "aws_iam_role" "<example_resource_name>" {
  name = "AWSServiceRoleForBackup"
}

resource "aws_backup_selection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  plan_id      = aws_backup_plan.<example_resource_name>.id
  iam_role_arn = data.aws_iam_role.<example_resource_name>.arn
  resources    = [
    "arn:aws:dynamodb:*:*:table/*" # CRITICAL: adds all DynamoDB tables to the backup plan, making them protected
  ]
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dynamodb_table_protected_by_backup_plan. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks