All checks
Medium DynamoDB · regional

DynamoDB tables should be present in a backup plan

Confirms that each DynamoDB table is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery point, so its data can be restored after loss or deletion. A resource assignment with both a resource list and a tag list must match both here.

service
DynamoDB
severity
Medium
scope
evaluated in every region

How to fix it

In the console

AWS Backup → Backup plans → the plan → Resource assignments → Assign resources

IAM role
Default role, or a role allowed to back up DynamoDB tables
Define resource selection
Include specific resource types; Include all resource types needs DynamoDB opted in to AWS Backup
Select resource types
DynamoDB, with this table left selected (by default every DynamoDB table is)
Refine selection using tags
Optional; the table must match every tag condition you add

With the AWS CLI

aws backup create-backup-selection --backup-plan-id <backup-plan-id> --backup-selection '{"SelectionName":"dynamodb-tables","IamRoleArn":"<backup-role-arn>","Resources":["arn:aws:dynamodb:*:*:table/*"]}' --region <region>

With Terraform

resource "aws_backup_selection" "this" {
  name         = "dynamodb-tables"
  plan_id      = var.backup_plan_id
  iam_role_arn = var.backup_role_arn
  resources    = ["arn:aws:dynamodb:*:*:table/*"]
}

See which of your accounts this check is failing on.

Book a live scan