AWS DynamoDB Point-in-Time Recovery Disabled

What it is

A significant availability and data integrity vulnerability where Amazon DynamoDB tables are configured without Point-in-Time Recovery (PITR), leaving the database vulnerable to permanent data loss from accidental deletions, corruption, or malicious attacks. Without PITR, there is no way to restore table data to any point within the last 35 days, making data recovery impossible after destructive operations. This can result in business continuity issues, compliance violations, and permanent loss of critical application data.

# VULNERABLE: DynamoDB table without PITR
resource "aws_dynamodb_table" "user_data" {
  name           = "user-data-table"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "user_id"
  
  attribute {
    name = "user_id"
    type = "S"
  }
  
  # VULNERABLE: No point_in_time_recovery block
  # Data cannot be recovered after accidental deletion
  
  tags = {
    Environment = "production"
  }
}

# SECURE: DynamoDB table with PITR enabled
resource "aws_dynamodb_table" "user_data" {
  name           = "user-data-table"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "user_id"
  
  attribute {
    name = "user_id"
    type = "S"
  }
  
  # SECURE: Enable Point-in-Time Recovery
  point_in_time_recovery {
    enabled = true
  }
  
  tags = {
    Environment = "production"
  }
}

Why it happens

Development teams create DynamoDB tables without enabling Point-in-Time Recovery, often due to cost concerns or lack of awareness about data protection requirements. PITR is disabled by default and must be explicitly enabled, leading many tables to operate without continuous backup protection. This commonly occurs in development environments that later become production systems.

Fixes

Related Vulnerabilities