# Using on-demand DynamoDB backup and restore
<a name="backuprestore_HowItWorks"></a>

Amazon DynamoDB supports stand-alone on-demand backup and restore features. Those features are available to you independent of whether you use AWS Backup.

You can use the DynamoDB on-demand backup capability to create full backups of your tables for long-term retention and archival for regulatory compliance needs. You can back up and restore your table data anytime with a single click on the AWS Management Console or with a single API call. Backup and restore actions run with zero impact on table performance or availability.

You can create table backups using the console, the AWS Command Line Interface (AWS CLI), or the DynamoDB API. For more information, see [Backing up a DynamoDB table](Backup.Tutorial.md).

For information about restoring a table from a backup, see [Restoring a DynamoDB table from a backup](Restore.Tutorial.md).

# Backing up and restoring DynamoDB tables with DynamoDB: How it works
<a name="CreateBackup"></a>

You can use the DynamoDB on-demand backup feature to create full backups of your Amazon DynamoDB tables. This feature is available independently from AWS backup. This section provides an overview of what happens during the DynamoDB backup and restore process.

## Backups
<a name="CreateBackup_HowItWorks"></a>

When you create an on-demand backup with DynamoDB, a time marker of the request is cataloged. The backup is created asynchronously by applying all changes until the time of the request to the last full table snapshot. DynamoDB backup requests are processed instantaneously and become available for restore within minutes.

**Note**  
Each time you create an on-demand backup, the entire table data is backed up. There is no limit to the number of on-demand backups that can be taken.

All backups in DynamoDB work without consuming any provisioned throughput on the table.

DynamoDB backups do not guarantee causal consistency across items; however, the skew between updates in a backup is usually much less than a second.

While a backup is in progress, you can't do the following:
+ Pause or cancel the backup operation.
+ Delete the source table of the backup.
+ Disable backups on a table if a backup for that table is in progress.

If you don't want to create scheduling scripts and cleanup jobs, you can use AWS Backup to create backup plans with schedules and retention policies for your DynamoDB tables. AWS Backup runs the backups and deletes them when they expire. For more information, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html).

In addition to AWS Backup, you can schedule periodic or future backups by using AWS Lambda functions. For more information, see the blog post [A serverless solution to schedule your Amazon DynamoDB On-Demand backup](https://aws.amazon.com/blogs/database/a-serverless-solution-to-schedule-your-amazon-dynamodb-on-demand-backup/).

If you're using the console, any backups created using AWS Backup are listed on the **Backups** tab with the **Backup type** set to `AWS`.

**Note**  
You can't delete backups marked with a **Backup type** of AWS using the DynamoDB console. To manage these backups, use the AWS Backup console.

To learn how to perform a backup, see [Backing up a DynamoDB table](Backup.Tutorial.md).

## Restores
<a name="CreateBackup_HowItWorks-restore"></a>

You restore a table without consuming any provisioned throughput on the table. You can do a full table restore from your DynamoDB backup, or you can configure the destination table settings. When you do a restore, you can change the following table settings:
+ Global secondary indexes (GSIs)
+ Local secondary indexes (LSIs)
+ Billing mode
+ Provisioned read and write capacity
+ Encryption settings

**Important**  
When you do a full table restore, the destination table is set with the same provisioned read capacity units and write capacity units as the source table, as recorded at the time the backup was requested. The restore process also restores the local secondary indexes and the global secondary indexes.

You can also restore your DynamoDB table data across AWS Regions such that the restored table is created in a different Region from where the backup resides. You can do cross-Region restores between AWS commercial Regions, AWS China Regions, and AWS GovCloud (US) Regions. You pay only for the data that you transfer out of the source Region and for restoring to a new table in the destination Region.

Restores can be faster and more cost-efficient if you choose to exclude some or all secondary indexes from being created on the new restored table.

You must manually set up the following on the restored table:
+ Auto scaling policies
+ AWS Identity and Access Management (IAM) policies
+ Amazon CloudWatch metrics and alarms
+ Tags
+ Stream settings
+ Time to Live (TTL) settings
+ Deletion protection settings
+ Point in time recovery (PITR) settings

You can only restore the entire table data to a new table from a backup. You can write to the restored table only after it becomes active.

**Note**  
 You can't overwrite an existing table during a restore operation.

Restore times are directly related to the configuration of your tables (such as the size of your tables and the number of underlying partitions) and other related variables. A best practice when planning for disaster recovery is to regularly document average restore completion times and establish how these times affect your overall Recovery Time Objective.

To learn how to perform a restore, see [Restoring a DynamoDB table from a backup](Restore.Tutorial.md).

You can use IAM policies for access control. For more information, see [Using IAM with DynamoDB backup and restore](backuprestore_IAM.md).

All backup and restore console and API actions are captured and recorded in AWS CloudTrail for logging, continuous monitoring, and auditing.

# Backing up a DynamoDB table
<a name="Backup.Tutorial"></a>

This section describes how to use the Amazon DynamoDB console or the AWS Command Line Interface to back up a table.

**Topics**

## Creating a table backup (console)
<a name="backup_console"></a>

Follow these steps to create a backup named `MusicBackup` for an existing `Music` table using the AWS Management Console.

**To create a table backup**

1. Sign in to the AWS Management Console and open the DynamoDB console at [https://console.aws.amazon.com/dynamodb/](https://console.aws.amazon.com/dynamodb/).

1. You can create a backup by doing one of the following:
   + On the **Backups** tab of the `Music` table, choose **Create backup**.
   + In the navigation pane on the left side of the console, choose **Backups**. Then choose **Create backup**.

1. Make sure that `Music` is the table name, and enter **MusicBackup** for the backup name. Then, choose **Create backup** to create the backup.  
![\[Create backup console screen with the table name and backup name filled in.\]](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/images/confirm_createbackup.png)
**Note**  
If you create backups using the **Backups** section in the navigation pane, the table isn't preselected for you. You have to manually choose the source table name for the backup.

   While the backup is being created, the backup status is set to **Creating**. After the backup is complete, the backup status changes to **Available**.  
![\[On-demand backups console page. Status of MusicBackup is showing as Available.\]](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/images/confirm_backup.png)

## Creating a table backup (AWS CLI)
<a name="backup_cli"></a>

Follow these steps to create a backup for an existing table `Music` using the AWS CLI.

**To create a table backup**
+ Create a backup with the name `MusicBackup` for the `Music` table.

  ```
  aws dynamodb create-backup --table-name Music \
   --backup-name MusicBackup
  ```

   While the backup is being created, the backup status is set to `CREATING`.

  ```
  {
      "BackupDetails": {
          "BackupName": "MusicBackup", 
          "BackupArn": "arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489602797149-73d8d5bc", 
          "BackupStatus": "CREATING", 
          "BackupCreationDateTime": 1489602797.149
      }
  }
  ```

After the backup is complete, its `BackupStatus` should change to `AVAILABLE`. To confirm this, use the `describe-backup` command. You can get the input value of `backup-arn` from the output of the previous step or by using the `list-backups` command.

```
aws dynamodb describe-backup \
--backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489173575360-b308cd7d
```

 To keep track of your backups, you can use the `list-backups` command. It lists all your backups that are in `CREATING` or `AVAILABLE` status.

```
aws dynamodb list-backups
```

 The `list-backups` command and the `describe-backup` command are useful to check information about the source table of the backup.

# Restoring a DynamoDB table from a backup
<a name="Restore.Tutorial"></a>

This section describes how to restore a table from a backup using the Amazon DynamoDB console or the AWS Command Line Interface (AWS CLI). 

**Note**  
If you want to use the AWS CLI, you must configure it first. For more information, see [Accessing DynamoDB](AccessingDynamoDB.md).

**Topics**

## Restoring a table from a backup (console)
<a name="restoretable_console"></a>

The following procedure shows how to restore the `Music` table by using the `MusicBackup` file that is created in the [Backing up a DynamoDB table](Backup.Tutorial.md) tutorial. 

**Note**  
This procedure assumes that the `Music` table no longer exists before restoring it using the `MusicBackup` file.

**To restore a table from a backup**

1. Sign in to the AWS Management Console and open the DynamoDB console at [https://console.aws.amazon.com/dynamodb/](https://console.aws.amazon.com/dynamodb/).

1. In the navigation pane on the left side of the console, choose **Backups**.

1. In the list of backups, choose `MusicBackup`.  
![\[Screenshot of the backups list and the create backup button.\]](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/images/select_musicbackup.png)

1. Choose **Restore**.

1. Enter **Music** as the new table name. Confirm the backup name and other backup details. Then choose **Restore table** to start the restore process.
**Note**  
You can restore the table to the same AWS Region or to a different Region from where the backup resides. You can also exclude secondary indexes from being created on the new restored table. In addition, you can specify a different encryption mode.  
Tables restored from backups are always created using the DynamoDB Standard table class.  
![\[Screenshot of the restore table from backup screen with backup table details.\]](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/images/restore_table.png)

   The table that is being restored is shown with the status **Creating**. After the restore process is finished, the status of the `Music` table changes to **Active**.

## Restoring a table from a backup (AWS CLI)
<a name="restoretable_cli"></a>

Follow these steps to use the AWS CLI to restore the `Music` table using the `MusicBackup` that is created in the [Backing up a DynamoDB table](Backup.Tutorial.md) tutorial.

**To restore a table from a backup**

1. Confirm the backup that you want to restore by using the `list-backups` command. This example uses `MusicBackup`.

   ```
   aws dynamodb list-backups
   ```

   To get additional details for the backup, use the `describe-backup` command. You can get the input `backup-arn` from the previous step.

   ```
   aws dynamodb describe-backup \
   --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489173575360-b308cd7d
   ```

1. Restore the table from the backup. In this case, the `MusicBackup` restores the `Music` table to the same AWS Region.

   ```
   aws dynamodb restore-table-from-backup \
   --target-table-name Music \
   --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489173575360-b308cd7d
   ```

1. Restore the table from the backup with custom table settings. In this case, the `MusicBackup` restores the `Music` table and specifies an encryption mode for the restored table.
**Note**  
The `sse-specification-override` parameter takes the same values as the `sse-specification-override` parameter used in the `CreateTable` command. To learn more, see [Managing encrypted tables in DynamoDB](encryption.tutorial.md).

   ```
   aws dynamodb restore-table-from-backup \
   --target-table-name Music \
   --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01581080476474-e177ebe2 \
   --sse-specification-override Enabled=true,SSEType=KMS,KMSMasterKeyId=abcd1234-abcd-1234-a123-ab1234a1b234
   ```

   You can restore the table to a different AWS Region from where the backup resides.
**Note**  
The `sse-specification-override` parameter is mandatory for cross-Region restores but optional for restores in the same Region as the source table.
When performing a cross-Region restore from the command line, you must set the default AWS Region to the desired destination Region. To learn more, see [Command line options](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-options.html) in the *AWS Command Line Interface User Guide*.

   ```
   aws dynamodb restore-table-from-backup \
   --target-table-name Music \
   --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01581080476474-e177ebe2 \
   --sse-specification-override Enabled=true,SSEType=KMS
   ```

   You can override the billing mode and the provisioned throughput for the restored table.

   ```
   aws dynamodb restore-table-from-backup \
   --target-table-name Music \
   --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489173575360-b308cd7d \
   --billing-mode-override PAY_PER_REQUEST
   ```

   You can exclude some or all secondary indexes from being created on the restored table.
**Note**  
Restores can be faster and more cost-efficient if you exclude some or all secondary indexes from being created on the restored table.

   ```
   aws dynamodb restore-table-from-backup \
   --target-table-name Music \
   --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01581081403719-db9c1f91 \
   --global-secondary-index-override '[]' \
   --sse-specification-override Enabled=true,SSEType=KMS
   ```
**Note**  
The secondary indexes provided should match existing indexes. You cannot create new indexes at the time of restore.

   You can use a combination of different overrides. For example, you can use a single global secondary index and change provisioned throughput at the same time, as follows.

   ```
   aws dynamodb restore-table-from-backup \
   --target-table-name Music \
   --backup-arn arn:aws:dynamodb:eu-west-1:123456789012:table/Music/backup/01581082594992-303b6239 \
   --billing-mode-override PROVISIONED \
   --provisioned-throughput-override ReadCapacityUnits=100,WriteCapacityUnits=100 \
   --global-secondary-index-override IndexName=singers-index,KeySchema=["{AttributeName=SingerName,KeyType=HASH}"],Projection="{ProjectionType=KEYS_ONLY}",ProvisionedThroughput="{ReadCapacityUnits=5,WriteCapacityUnits=5}" \
   --sse-specification-override Enabled=true,SSEType=KMS
   ```

 To verify the restore, use the `describe-table` command to describe the `Music` table.

```
aws dynamodb describe-table --table-name Music 
```

The table that is being restored from the backup is shown with the status **Creating**. After the restore process is finished, the status of the `Music` table changes to **Active**.

**Important**  
While a restore is in progress, don't modify or delete your IAM role policy; otherwise, unexpected behavior can result. For example, suppose that you removed write permissions for a table while that table is being restored. In this case, the underlying `RestoreTableFromBackup` operation would not be able to write any of the restored data to the table.  
After the restore operation is complete, you can modify or delete your IAM role policy.  
IAM policies involving [source IP restrictions](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceip) for accessing the target restore table should have the [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice) key set to `false` to ensure that the restrictions apply only to requests made directly by a principal. Otherwise, the restore will be canceled.  
If your backup is encrypted with an AWS managed key or a customer managed key, don't disable or delete the key while a restore is in progress, or the restore will fail.  
After the restore operation is complete, you can change the encryption key for the restored table and disable or delete the old key.

# Deleting a DynamoDB table backup
<a name="Delete.Tutorial"></a>

This section describes how to use the AWS Management Console or the AWS Command Line Interface (AWS CLI) to delete an Amazon DynamoDB table backup. 

**Note**  
If you want to use the AWS CLI, you have to configure it first. For more information, see [Using the AWS CLI](AccessingDynamoDB.md#Tools.CLI).

**Topics**

## Deleting a table backup (console)
<a name="deletebackup_console"></a>

The following procedure shows how to use the console to delete the `MusicBackup` that is created in the [Backing up a DynamoDB table](Backup.Tutorial.md) tutorial.

**To delete a backup**

1. Sign in to the AWS Management Console and open the DynamoDB console at [https://console.aws.amazon.com/dynamodb/](https://console.aws.amazon.com/dynamodb/).

1. In the navigation pane on the left side of the console, choose **Backups**.

1. In the list of backups, choose `MusicBackup`.  
![\[Screenshot showing the MusicBackup with status as available.\]](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/images/select_musicbackup.png)

1. Choose **Delete**. Confirm that you want to delete the backup by typing **delete** and clicking **Delete**.

## Deleting a table backup (AWS CLI)
<a name="deletebackup_cli"></a>

The following example deletes a backup for an existing table `Music` table using the AWS CLI.

```
aws dynamodb delete-backup \
--backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489602797149-73d8d5bc
```

# Using IAM with DynamoDB backup and restore
<a name="backuprestore_IAM"></a>

You can use AWS Identity and Access Management (IAM) to restrict Amazon DynamoDB backup and restore actions for some resources. The `CreateBackup` and `RestoreTableFromBackup` APIs operate on a per-table basis.

 For more information about using IAM policies in DynamoDB, see [Identity-based policies for DynamoDB](security_iam_service-with-iam.md#security_iam_service-with-iam-id-based-policies). 

The following are examples of IAM policies that you can use to configure specific backup and restore functionality in DynamoDB.

## Example 1: Allow the CreateBackup and RestoreTableFromBackup actions
<a name="access-policy-example1"></a>

The following IAM policy grants permissions to allow the `CreateBackup` and `RestoreTableFromBackup` DynamoDB actions on all tables:

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:CreateBackup",
                "dynamodb:RestoreTableFromBackup",
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:BatchWriteItem"   
            ],
            "Resource": "*"
        }
    ]
}
```

------

**Important**  
 DynamoDB RestoreTableFromBackup permissions are necessary on the source backup, and DynamoDB read and write permissions on the target table are necessary for restore functionality.  
 DynamoDB RestoreTableToPointInTime permissions are necessary on the source table, and DynamoDB read and write permissions on the target table are necessary for restore functionality. 

## Example 2: Allow CreateBackup and deny RestoreTableFromBackup
<a name="access-policy-example2"></a>

The following IAM policy grants permissions for the `CreateBackup` action and denies the `RestoreTableFromBackup` action:

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["dynamodb:CreateBackup"],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": ["dynamodb:RestoreTableFromBackup"],
            "Resource": "*"
        }
        
    ]
}
```

------

## Example 3: Allow ListBackups and deny CreateBackup and RestoreTableFromBackup
<a name="access-policy-example3"></a>

The following IAM policy grants permissions for the `ListBackups` action and denies the `CreateBackup` and `RestoreTableFromBackup` actions:

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["dynamodb:ListBackups"],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "dynamodb:CreateBackup",
                "dynamodb:RestoreTableFromBackup"
            ],
            "Resource": "*"
        }
        
    ]
}
```

------

## Example 4: Allow ListBackups and deny DeleteBackup
<a name="access-policy-example4"></a>

The following IAM policy grants permissions for the `ListBackups` action and denies the `DeleteBackup` action:

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["dynamodb:ListBackups"],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": ["dynamodb:DeleteBackup"],
            "Resource": "*"
        }
        
    ]
}
```

------

## Example 5: Allow RestoreTableFromBackup and DescribeBackup for all resources and deny DeleteBackup for a specific backup
<a name="access-policy-example5"></a>

The following IAM policy grants permissions for the `RestoreTableFromBackup` and `DescribeBackup` actions and denies the `DeleteBackup` action for a specific backup resource:

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeBackup",
                "dynamodb:RestoreTableFromBackup"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489173575360-b308cd7d"
        },
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:BatchWriteItem"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "dynamodb:DeleteBackup"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/01489173575360-b308cd7d"
        }
    ]
}
```

------

**Important**  
 DynamoDB RestoreTableFromBackup permissions are necessary on the source backup, and DynamoDB read and write permissions on the target table are necessary for restore functionality.  
 DynamoDB RestoreTableToPointInTime permissions are necessary on the source table, and DynamoDB read and write permissions on the target table are necessary for restore functionality. 

## Example 6: Allow CreateBackup for a specific table
<a name="access-policy-example6"></a>

The following IAM policy grants permissions for the `CreateBackup` action on the `Movies` table only:

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["dynamodb:CreateBackup"],
            "Resource": [
                "arn:aws:dynamodb:us-east-1:123456789012:table/Movies"
            ]
        }
    ]
}
```

------

## Example 7: Allow ListBackups
<a name="access-policy-example7"></a>

The following IAM policy grants permissions for the `ListBackups` action:

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["dynamodb:ListBackups"],
            "Resource": "*"
        }
    ]
}
```

------

**Important**  
 You can't grant permissions for the `ListBackups` action on a specific table. 

## Example 8: Allow access to AWS Backup features
<a name="access-policy-example8"></a>

You will need API permissions for the `StartAwsBackupJob` action for a successful backup with advanced features, and the `dynamodb:RestoreTableFromAwsBackup` action to successfully restore that backup.

The following IAM policy grants AWS Backup the permissions to trigger backups with advanced features and restores. Also note that if the tables are encrypted the policy will need access to the [AWS KMS key](encryption.usagenotes.html#dynamodb-kms-authz). 

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "DescribeQueryScanBooksTable",
            "Effect": "Allow",
            "Action": [
                "dynamodb:StartAwsBackupJob",
                "dynamodb:DescribeTable",
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": "arn:aws:dynamodb:us-west-2:111122223333:table/Books"
        },
        {
            "Sid": "AllowRestoreFromAwsBackup",
            "Effect": "Allow",
            "Action": [
                "dynamodb:RestoreTableFromAwsBackup"
            ],
            "Resource": "*"
        }
    ]
}
```

------

## Example 9: Deny RestoreTableToPointInTime for a Specific Source Table
<a name="access-policy-example9"></a>

The following IAM policy denies permissions for the `RestoreTableToPointInTime` action for a specific source table: 

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "dynamodb:RestoreTableToPointInTime"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Music"
        }
    ]
}
```

------

## Example 10: Deny RestoreTableFromBackup for all Backups for a Specific Source Table
<a name="access-policy-example10"></a>

The following IAM policy denies permissions for the `RestoreTableToPointInTime` action for all backups for a specific source table: 

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "dynamodb:RestoreTableFromBackup"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Music/backup/*"
        }
    ]
}
```

------