# Inspect DynamoDB PITR status instead of relying on ContinuousBackupsStatus

> An ENABLED continuous-backup status does not itself show that point-in-time recovery has been enabled.

- Canonical URL: https://update.dsesecurity.com/updates/aws-dynamodb-pitr-status-continuous-backups-distinction/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:11+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

An ENABLED continuous-backup status does not itself show that point-in-time recovery has been enabled.

## Potentially affected

This concerns DynamoDB PITR configuration and reported recovery windows. It does not establish that an existing table has the required protection or that a restore has been exercised.

## DSE recommendation

DSE recommends making the PITR-specific state and actual earliest and latest restorable times visible in the protection inventory.

## Article

An ENABLED continuous-backup status does not itself show that point-in-time recovery has been enabled.

## Source facts

AWS distinguishes ContinuousBackupsStatus from PointInTimeRecoveryStatus. ContinuousBackupsStatus is always ENABLED for a DynamoDB table, while PITR is disabled by default until enabled separately. PITR can use a recovery period between one and thirty-five days. Increasing that period does not immediately move the earliest recovery point backward because the longer history still needs to accumulate.

Source: [AWS — Enable point-in-time recovery in DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html).

## Applicability

This concerns DynamoDB PITR configuration and reported recovery windows. It does not establish that an existing table has the required protection or that a restore has been exercised.

## DSE recommendation

DSE recommends making the PITR-specific state and actual earliest and latest restorable times visible in the protection inventory. Compare the selected period with the data owner’s recovery needs. Treat a period increase as a future coverage change until the reported history catches up. Review a proposed reduction carefully, identifying any recovery dates that would become unavailable before applying it. Use the PITR-specific field in the protection acceptance checklist and retain the reported time range with it. Ask the data owner to approve the interval that is actually available today, and schedule a later check when an increased history period is expected to have accumulated.

## Verification

Proposed verification: for an approved test table, inspect both status fields and the reported recovery range before and after enabling PITR. Confirm that monitoring distinguishes the two fields. After a period change, observe the actual range and perform a permitted restore within it rather than assuming the configured number of days already exists.

## Official reference

[AWS — Enable point-in-time recovery in DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — Enable point-in-time recovery in DynamoDB
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/PointInTimeRecovery_Howitworks.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Inspect DynamoDB PITR status instead of relying on ContinuousBackupsStatus,” DSE Security, https://update.dsesecurity.com/updates/aws-dynamodb-pitr-status-continuous-backups-distinction/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.