Logo of Trend Micro

Unused Table

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk level: Medium (should be achieved)
Rule ID: DynamoDB-001

Identify any unused Amazon DynamoDB tables available within your AWS account and remove them to help lower the cost of your monthly AWS bill. A DynamoDB table is considered unused if it’s ItemCount parameter, which describes the number of items in the table, is equal to 0 (zero).

This rule can help you work with the AWS Well-Architected Framework

This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS

Cost
optimisation

You are being charged for AWS DynamoDB Read & Write capacity, regardless whether or not you use the provisioned capacity units for your tables. Cloud Conformity recommends implementing the cleanup process outlined in the rule Remediation/Resolution section in order to avoid any unexpected charges on your AWS bill.

Audit

To identify the unused Amazon DynamoDB tables provisioned in your AWS account, perform the following:

Using AWS Console

01 Login to the AWS Management Console.

02 Navigate to DynamoDB dashboard at https://console.aws.amazon.com/dynamodb/.

03 In the left navigation panel, under Dashboard, click Tables.

04 Choose the DynamoDB table that you want to examine then click on its identifier (name) link:

Choose the DynamoDB table that you want to examine then click on its identifier (name) link

listed in the Name column to open its configuration panel.

05 On the table configuration panel, inside the Table details section, verify the Item count parameter value. If the Item count current value is equal to 0:

If the Item count current value is equal to 0

the selected Amazon DynamoDB table is not in use anymore and can be safely removed from your account in order to optimize your AWS monthly costs.

06 Repeat step no. 4 and 5 to verify the usage (ItemCount parameter value) of other DynamoDB tables provisioned in the current region.

07 Change the AWS region from the navigation bar and repeat the entire audit process for other regions.

Using AWS CLI

01 Run list-tables command (OSX/Linux/UNIX) using custom query filters to list the names of all DynamoDB tables provisioned in the selected region:

aws dynamodb list-tables
	--region us-east-1
	--output table
	--query 'TableNames'

02 The command output should return the requested NoSQL table names:

-------------------------------
|         ListTables          |
+-----------------------------+
|  cc-product-catalog-table   |
|  cc-client-comments-table   |
+-----------------------------+

03 Now run describe-table command (OSX/Linux/UNIX) using the name of table that you want to examine as identifier and the necessary query filters to return the number of items currently available in the selected DynamoDB table: 

aws dynamodb describe-table
	--region us-east-1
	--table-name cc-product-catalog-table
	--query 'Table.ItemCount'

04 Run list-tables The command output should the ItemCount parameter value for the requested table: 

0

If the command output returns 0 (zero) for the ItemCount parameter value, the selected Amazon DynamoDB table is not currently in use and can be safely removed from your AWS account.

05 Repeat step no. 3 and 4 to verify to verify the usage (ItemCount value) of other DynamoDB tables created in the current region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 - 5 to perform the audit process for other regions.

Remediation / Resolution

To remove any unused Amazon DynamoDB tables provisioned within your AWS account, perform the following commands:

Using AWS Console

01 Login to the AWS Management Console.

02 Navigate to DynamoDB dashboard at https://console.aws.amazon.com/dynamodb/.

03 In the left navigation panel, under Dashboard, click Tables.

04 Select the DynamoDB table that you want to remove.

05 Click on the Actions dropdown button from the dashboard top menu then select Delete table:

Click on the Actions dropdown button from the dashboard top menu then select Delete table

06 In the Delete table dialog box, choose whether you want to delete or not any AWS CloudWatch alarms associated with the selected table then click the Delete button to remove the table.

07 Repeat steps no. 4 - 6 to delete any unused Amazon DynamoDB tables provisioned within the current region.

08 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 Run delete-table command (OSX/Linux/UNIX) to remove the unused DynamoDB table available in the selected AWS region. Once the delete-table request is made, the selected table enters the DELETING state until DynamoDB service completes the removal process: 

aws dynamodb delete-table
	--region us-east-1
	--table-name cc-product-catalog-table

02 The command output should return the configuration metadata of the NoSQL table selected for deletion: 

{
    "TableDescription": {
        "TableArn": "arn:aws:dynamodb:us-east-1:123456789012:
                     table/cc-product-catalog-table",
        "ProvisionedThroughput": {
            "NumberOfDecreasesToday": 0,
            "WriteCapacityUnits": 5,
            "ReadCapacityUnits": 3
        },
        "TableSizeBytes": 0,
        "TableName": "cc-product-catalog-table",
        "TableStatus": "DELETING",
        "ItemCount": 0
    }
}

03 Repeat step no. 1 and 2 to delete any unused Amazon DynamoDB tables available within the current region.

04 Change the AWS region by updating the --region command parameter value and repeat the entire process for other regions.

References

Related DynamoDB rules

Unlock the Remediation Steps

Gain free unlimited access
to our full Knowledge Base

Over 750 rules & best practices
for AWS and Azure

You are auditing:

Unused Table

Risk level: Medium