DynamoDB PITR and S3 Export for MCP Servers — Point-in-Time Recovery, Incremental Export, Athena

PITR mechanics and what it protects against

PITR maintains a rolling 35-day window of continuous backups. Every item written to the table is captured at per-item granularity, not at transaction granularity — this means you can restore to any second in the 35-day window, not just to the exact timestamps of explicit backup operations.

PITR protects against application-layer corruption: a probe runner bug that writes incorrect status to all server records, an IAM policy that accidentally granted REMOVE permissions to a Lambda function that deleted active server registrations, or a migration script that overwrote subscription metadata with test values. It does not protect against malicious actor with root access or AWS account-level events — those require AWS Backup with cross-account or cross-region copies.

# Restore to 24 hours ago (moment before a bad migration ran)
aws dynamodb restore-table-to-point-in-time \
  --source-table-name alivemcp-probe-state \
  --target-table-name alivemcp-probe-state-restored-20261031 \
  --restore-date-time "2026-10-30T14:00:00Z" \
  --billing-mode-override PAY_PER_REQUEST \
  --region us-east-1

# Note: target table must not exist
# Provisioned capacity can be overridden via --provisioned-throughput-override
# SSE settings can be overridden via --sse-specification-override
# Restore time scales with table size — small tables (<1 GB): minutes; large tables (>100 GB): hours

ExportTableToPointInTime for S3 archive

The export API creates a consistent snapshot of the table (or a subset via a filter expression) at a specific point in time and writes it to S3. Unlike PITR restore (which creates a new DynamoDB table), ExportTableToPointInTime writes DynamoDB JSON or ION-formatted records to S3 for downstream processing.

// CDK: scheduled monthly export for SLA report generation
import * as events from 'aws-cdk-lib/aws-events';
import * as targets from 'aws-cdk-lib/aws-events-targets';

// EventBridge Scheduler: run at midnight on the first of each month
const monthlyExportRule = new events.Rule(this, 'MonthlyDynamoExport', {
  schedule: events.Schedule.cron({
    minute: '0',
    hour: '0',
    day: '1',
    month: '*',
    year: '*'
  })
});

monthlyExportRule.addTarget(new targets.LambdaFunction(exportTriggerFn));

// Lambda: trigger the export via SDK
import { DynamoDB } from '@aws-sdk/client-dynamodb';

const dynamodb = new DynamoDB({ region: 'us-east-1' });

export const handler = async () => {
  const now = new Date();
  const exportPoint = new Date(now.getFullYear(), now.getMonth(), 1);  // First of current month

  const result = await dynamodb.exportTableToPointInTime({
    TableArn: process.env.TABLE_ARN!,
    ExportTime: exportPoint,
    S3Bucket: process.env.EXPORT_BUCKET!,
    S3Prefix: `exports/monthly/${exportPoint.getFullYear()}-${String(exportPoint.getMonth() + 1).padStart(2, '0')}/`,
    ExportFormat: 'DYNAMODB_JSON',  // DynamoDB JSON (type descriptors) or ION (binary)
    // S3SseAlgorithm: 'AES256',  // or 'KMS' with S3SseKmsKeyId
    ExportType: 'FULL_EXPORT'  // or 'INCREMENTAL_EXPORT' with ExportFromTime/ExportToTime
  });

  console.log('Export ARN:', result.ExportDescription?.ExportArn);
  console.log('Export status:', result.ExportDescription?.ExportStatus);  // PENDING initially
  // Export runs asynchronously; poll DescribeExport or receive EventBridge notification on completion
};

Export format comparison:

Incremental export for continuous probe history

Incremental export (ExportType: INCREMENTAL_EXPORT) captures only the items that were created, modified, or deleted within a specified time window. This enables CDC-style probe history in S3 without continuously streaming from DynamoDB Streams to a separate pipeline.

// Incremental export: capture all probe state changes in the past hour
const hourAgo = new Date(Date.now() - 3600 * 1000);
const now = new Date();

await dynamodb.exportTableToPointInTime({
  TableArn: process.env.TABLE_ARN!,
  ExportFormat: 'DYNAMODB_JSON',
  ExportType: 'INCREMENTAL_EXPORT',
  IncrementalExportSpecification: {
    ExportFromTime: hourAgo,           // Inclusive start of the window
    ExportToTime: now,                  // Exclusive end of the window
    ExportViewType: 'NEW_AND_OLD_IMAGES'  // Include both before/after state for each changed item
    // ExportViewType: 'NEW_IMAGE'       // Only include the final state of changed items
  },
  S3Bucket: process.env.EXPORT_BUCKET!,
  S3Prefix: `exports/incremental/${now.toISOString().slice(0, 13)}/`  // Hourly prefix
});

Incremental export constraints:

S3 export structure and Athena integration

DynamoDB exports to S3 using a consistent folder structure. Each export produces a manifest file and data files:

# S3 folder structure for a DynamoDB JSON export:
s3://alivemcp-exports/exports/monthly/2026-10/
  manifest-summary.json          # Export metadata (table ARN, export time, item count, etc.)
  manifest-files.json            # List of data files with row counts
  AWSDynamoDB/
    01JD1EXAMPLE2XAMPLE3XAMPLE4/  # Export ID folder
      data/
        kn96rkrfqbpx.json.gz      # Compressed NDJSON of DynamoDB records
        l0e2tpmr3cqx.json.gz      # Multiple data files for large tables
      _started
      _finished

-- Athena DDL: query DynamoDB JSON export with partition projection
-- Requires aws-glue-hive-serde (Amazon S3 Select for DynamoDB JSON)
CREATE EXTERNAL TABLE probe_state_archive (
  Item struct<
    PK: struct<S: string>,
    SK: struct<S: string>,
    status: struct<S: string>,
    latencyMs: struct<N: string>,
    lastCheckedAt: struct<N: string>,
    consecutiveFailures: struct<N: string>
  >
)
ROW FORMAT SERDE 'com.amazonaws.glue.serde.GrokSerDe'
STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
LOCATION 's3://alivemcp-exports/exports/monthly/'
TBLPROPERTIES (
  'classification'='json',
  'compressionType'='gzip'
);

-- Query: find all MCP servers with >1% downtime in October 2026
SELECT
  Item.PK.S AS server_slug,
  COUNT(*) AS total_probes,
  SUM(CASE WHEN Item.status.S != 'HEALTHY' THEN 1 ELSE 0 END) AS failed_probes,
  100.0 * SUM(CASE WHEN Item.status.S != 'HEALTHY' THEN 1 ELSE 0 END) / COUNT(*) AS downtime_pct
FROM probe_state_archive
WHERE Item.SK.S = 'STATUS'
GROUP BY Item.PK.S
HAVING downtime_pct > 1.0
ORDER BY downtime_pct DESC;

Cost modeling for PITR and export

For an AliveMCP probe state table with 100,000 monitored endpoints, roughly 1 KB average item size, 60-second probe interval:

For a 100,000-server probe table, the full PITR + export archival system costs roughly $0.23/month — negligible compared to the probe runner compute and DynamoDB write costs, but providing 35-day point-in-time recovery and unlimited Athena analytical history.

Complete failure mode reference