DynamoDB table without point-in-time recovery

Fast to write, impossible to restore — no PITR, no encryption choice.

1 resource · AWS::DynamoDB::Table

Your stack

Ready when you are

Press Run. The stack loaded here fails in a way worth seeing.

See the full engine grade a real project — Town Crier · first checkpoint free

▸What the engine finds2 findings

Not examples — DynamoDB table without point-in-time recovery was run through the real engine when this page was built, and this is what it returned.

1 intent check failed· 1 informational

intent 1info 1

Without PITR there is no way back from a bad write.INTENT

▸ 1 informational finding — no point-in-time recovery

No point-in-time recoveryAwsSolutions-DDB3Sessions

Without point-in-time recovery a bad write or a bad deploy is permanent. There is no window in which to go back.

pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true }

New to DynamoDB? Start the DynamoDB concept

Full rule text

The DynamoDB table does not have Point-in-time Recovery enabled. DynamoDB continuous backups represent an additional layer of insurance against accidental loss of data on top of on-demand backups. The DynamoDB service can back up the data with per-second granularity and restore it to any single second from the time PITR was enabled up to the prior 35 days. AwsSolutions-DDB3 guide →

Presets

Or start from a stack that fails interestingly

Public S3 bucket

The single most common AI-generated CDK mistake: a bucket left open to the world.

3 rules · 2 intent checks

From Concepts · S3 · Granting public read access

Security group open to 0.0.0.0/0

SSH open to the entire internet — the classic copy-paste ingress rule.

2 rules · 1 intent check

From Concepts · EC2 · Opening the security group for HTTP

S3 static website

Website hosting straight off a bucket — no CDN, no TLS, no access logging.

3 rules · 2 intent checks

Unencrypted RDS instance

A database with storage encryption off and backups barely configured.

6 rules · 2 intent checks

Wildcard IAM policy

Action "*" on Resource "*" — the permission grant that ends incident reviews.

1 rule · 2 intent checks

Public API Gateway with no authorizer

A REST API wired to Lambda, wide open, with no access logging.

7 rules · 1 intent check

DynamoDB table without point-in-time recovery

Fast to write, impossible to restore — no PITR, no encryption choice.

1 rule · 1 intent check

CloudFront distribution allowing HTTP

A CDN that will happily serve your site unencrypted, with no logging.

6 rules · 1 intent check

Unencrypted SQS queue

A queue with no server-side encryption and no dead-letter queue.

2 rules · 2 intent checks

VPC without flow logs

Network traffic no one can reconstruct after the fact.

1 rule · 1 intent check

Cognito pool with a weak password policy

Six characters, no symbols, no MFA — defaults nobody revisited.

3 rules · 2 intent checks

Clean serverless data layerPasses

The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.

no findings — this is what passing looks like