Why can't I delete DynamoDB backups that AWS Backup created?

Short description

If you activated advanced DynamoDB backup, then you might receive one of the following error messages:

• On the DynamoDB console: "To delete a backup, you must proceed to the AWS Backup vault where it is stored. View and delete it from the backup vault if permissions allow."
• In the AWS Command Line Interface (AWS CLI): "An error occurred (ValidationException) when calling the DeleteBackup operation: Invalid Backup ARN."

If you didn't activate advanced DynamoDB backup, then you might receive one of the following error messages:

• On the DynamoDB console: "Invalid Request: User is not allowed to delete the AWS Backup initiated backup."
• In the AWS CLI: "An error occurred (ValidationException) when calling the DeleteBackup operation: Invalid Request: User is not allowed to delete the AWS Backup initiated backup."

When AWS Backup creates a DynamoDB backup, it stores the backup in an AWS Backup vault instead of as a native DynamoDB backup. To delete the recovery points, you must use AWS Backup.

Resolution

You can use either the AWS Backup console to delete the recovery points or the AWS CLI.

Use the AWS Backup console

Complete the following steps:

1. Open the AWS Backup console.
2. In the navigation pane, choose Backup vaults.
3. Select the backup vault that contains your DynamoDB backup recovery points.
4. Select the recovery point you want to delete.
5. Choose Actions, and then choose Delete.

Use the AWS CLI

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Complete the following steps:

1. Run the list-recovery-points-by-backup-vault command to get the DynamoDB recovery points that you want to delete:

   aws backup list-recovery-points-by-backup-vault \
       --backup-vault-name "your-backup-vault-name"
       --by-resource-type "DynamoDB"

   Note: Replace your-backup-vault-name with the name of your backup.

2. Run the delete-recovery-point command to delete your recovery point:

   aws backup delete-recovery-point --backup-vault-name VAULT_NAME \ 
   --recovery-point-arn "arn:aws:backup:region:account-id:recovery-point:recovery-point-id"

   Note: Replace your-backup-vault-name with the name of your backup and recovery-point-arn with the Amazon Resource Name (ARN) of your recovery point.

3. Run the describe-recovery-point command to confirm that you deleted the recovery point:

   aws backup describe-recovery-point \
   --backup-vault-name "your-backup-vault-name" \
   --recovery-point-arn "arn:aws:backup:region:account-id:recovery-point:recovery-point-id"

   Note: Replace your-backup-vault-name with the name of your backup and recovery-point-arn with the ARN of your recovery point.

Related information

Backup deletion

Deleting a backup of a DynamoDB table with AWS Backup