cis-aws-database-4-9

name	cis-aws-database-4.9
description	Ensure Database has Backup enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","dynamodb","backup","pitr","disaster-recovery"]
cis_id	4.9
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-4.8"]
prerequisites	[]
severity_boost	{}

4.9 Ensure Database has Backup enabled

Description

Ensure your DynamoDB tables have backups enabled to protect against accidental data loss or corruption. This can be achieved in two ways: by enabling Point-in-Time Recovery (PITR), which provides continuous backups for up to 35 days, and by configuring on-demand backups that can be automated using the AWS Backup service.

Rationale

Backups are essential for restoring data after accidental deletions, application errors or malicious events. Enabling both continuous and scheduled backups maximizes data resilience while meeting recovery point objectives (RPO) and compliance mandates.

Impact

Without backups, data loss can be permanent which can lead to business disruption and potential regulatory penalties. Enabling backup provides assurance of data availability and accelerates recovery from incidents, supporting overall system reliability.

Audit Procedure

Using AWS Console

1. Check if Point-in-Time Recovery (PITR) is enabled

1.1 Log in to the AWS Management Console. 1.2 Navigate to DynamoDB in the AWS Services menu.

• Select "Tables" from the left sidebar. 1.3 Click on the specific table name that you want to audit. 1.4 Go to the "Backups" tab in the table's navigation bar. 1.5 Under the "Point-in-time recovery (PITR)" section:
• Verify that "Status" is "On", which means PITR is enabled.
• Check the "Backup recovery period" value, this displays the configured retention period in days.
• Optionally, review the Earliest restore point and Latest restore point timestamps to confirm the exact window for recovery.

Using AWS CLI

2. Check if automated backups are enabled via AWS Backup Service

2.1 Check if Table is Assigned to a Backup Plan

• List backup plans:

aws backup list-backup-plans --query "BackupPlansList[].BackupPlanName" --output table

• For each backup plan, list all backup selections (resource assignments):

aws backup list-backup-selections --backup-plan-id <your-backup-plan-id> --query "BackupSelections[].SelectionId" --output text

• For each selection, list assigned resources and search for your table:

aws backup get-backup-selection --backup-plan-id <your-backup-plan-id> --selection-id <selection-id> --query "BackupSelection.Resources" --output text