DynamoDB tables should be present in a backup plan
Confirms that each DynamoDB table is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery point, so its data can be restored after loss or deletion. A resource assignment with both a resource list and a tag list must match both here.
- service
- DynamoDB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
AWS Backup → Backup plans → the plan → Resource assignments → Assign resources
- IAM role
- Default role, or a role allowed to back up DynamoDB tables
- Define resource selection
- Include specific resource types; Include all resource types needs DynamoDB opted in to AWS Backup
- Select resource types
- DynamoDB, with this table left selected (by default every DynamoDB table is)
- Refine selection using tags
- Optional; the table must match every tag condition you add
With the AWS CLI
aws backup create-backup-selection --backup-plan-id <backup-plan-id> --backup-selection '{"SelectionName":"dynamodb-tables","IamRoleArn":"<backup-role-arn>","Resources":["arn:aws:dynamodb:*:*:table/*"]}' --region <region>With Terraform
resource "aws_backup_selection" "this" {
name = "dynamodb-tables"
plan_id = var.backup_plan_id
iam_role_arn = var.backup_role_arn
resources = ["arn:aws:dynamodb:*:*:table/*"]
}
See which of your accounts this check is failing on.
Book a live scan