DynamoDB.2: DynamoDB tables should have PITR

What does AWS Security Hub DynamoDB.2 check?

DynamoDB.2 checks that point-in-time recovery (PITR) is enabled on a table. It reports FAILED when PITR is off, which is the default state for new tables.

Why does DynamoDB.2 matter?

PITR lets you restore a table to any second within the last 35 days, protecting against accidental writes, deletes or a bad deploy that corrupts data. Without it, there is no fine-grained rollback: your only recovery is whatever backup happened to exist, which may be hours or days stale.

How do I fix DynamoDB.2?

1. Check a table's PITR status with describe-continuous-backups.
2. Enable it with a single update-continuous-backups call (no downtime), but it only captures forward from the moment it is turned on.
3. Note that a restore creates a brand-new table rather than rolling the existing one back in place.
4. Enforce PITR across the account so new tables arrive protected.

# Set a 7-day backup floor on production databases below it (skip read replicas).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?ReadReplicaSourceDBInstanceIdentifier==`null` && BackupRetentionPeriod<`7`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --backup-retention-period 7 --no-apply-immediately
done

# Turn on DynamoDB point-in-time recovery (instant, no downtime).
aws dynamodb update-continuous-backups --table-name prod-orders \
  --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

# Stop any snapshot in the account from being shared publicly, ever.
aws ec2 enable-snapshot-block-public-access --state block-all-sharing