Control: 6 DynamoDB tables should have deletion protection enabled
Description
This control checks whether an Amazon DynamoDB table has deletion protection enabled. The control fails if a DynamoDB table doesn't have deletion protection enabled.
You can protect a DynamoDB table from accidental deletion with the deletion protection property. Enabling this property for tables helps ensure that tables don't get accidentally deleted during regular table management operations by your administrators. This helps prevent disruption to your normal business operations.
Remediation
To enable deletion protection for a DynamoDB table, see Using deletion protection in the Amazon DynamoDB Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_dynamodb_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_dynamodb_6 --shareSQL
This control uses a named query:
select arn as resource, case when deletion_protection_enabled then 'ok' else 'alarm' end as status, case when deletion_protection_enabled then title || ' deletion protection enabled.' else title || ' deletion protection disabled.' end as reason , region, account_idfrom aws_dynamodb_table;