How to fix InvalidRestoreTimeException: An invalid restore time was specified in DynamoDB

# Using AWS CLI
aws dynamodb describe-continuous-backups   --table-name YourTableName   --query 'ContinuousBackupsDescription.PointInTimeRecoveryDescription'

# Output example:
# {
#   "PointInTimeRecoveryStatus": "ENABLED",
#   "EarliestRestorableDateTime": "2025-11-14T10:30:00.000Z",
#   "LatestRestorableDateTime": "2025-12-29T09:25:00.000Z"
# }

# Using Python to calculate a valid restore time
python3 << 'EOF'
from datetime import datetime, timedelta

# Get current time and subtract 5 minutes for LatestRestorableDateTime
now = datetime.utcnow()
latest_restorable = now - timedelta(minutes=5)
earliest_restorable = now - timedelta(days=35)

print(f"Current time: {now.isoformat()}Z")
print(f"Latest restorable (now - 5 min): {latest_restorable.isoformat()}Z")
print(f"Earliest restorable (now - 35 days): {earliest_restorable.isoformat()}Z")
print()
print("Valid restore times must be between:")
print(f"  {earliest_restorable.isoformat()}Z")
print(f"  and")
print(f"  {latest_restorable.isoformat()}Z")

# Example: restore to 1 hour ago (safe choice)
one_hour_ago = now - timedelta(hours=1)
print(f"
Safe choice - restore to 1 hour ago: {one_hour_ago.isoformat()}Z")
EOF

# Check when PITR was enabled
aws dynamodb describe-continuous-backups   --table-name YourTableName   --query 'ContinuousBackupsDescription.PointInTimeRecoveryDescription.PointInTimeRecoveryStatus'

# If just enabled, wait a few minutes before attempting restore
# PITR must be active for at least a few minutes before restore points exist

# If PITR is disabled, enable it first
aws dynamodb update-continuous-backups   --table-name YourTableName   --point-in-time-recovery-specification 'PointInTimeRecoveryEnabled=true'

# Wait for PITR activation (typically 1-2 minutes)
sleep 120

# Verify restore points are available
aws dynamodb describe-continuous-backups   --table-name YourTableName   --query 'ContinuousBackupsDescription.PointInTimeRecoveryDescription.EarliestRestorableDateTime'

# Method 1: Restore to specific point in time (at least 5 minutes ago)
RESTORE_TIME="2025-12-29T08:00:00.000Z"

aws dynamodb restore-table-to-point-in-time   --source-table-name YourTableName   --target-table-name YourTableName-restored   --restore-date-time "$RESTORE_TIME"

# Method 2: Restore to latest available time (safest option)
aws dynamodb restore-table-to-point-in-time   --source-table-name YourTableName   --target-table-name YourTableName-restored   --use-latest-restorable-time

# Monitor restore progress
aws dynamodb describe-table   --table-name YourTableName-restored   --query 'Table.TableStatus'

// AWS SDK v3 for JavaScript
import { DynamoDBClient, RestoreTableToPointInTimeCommand, DescribeContinuousBackupsCommand } from '@aws-sdk/client-dynamodb';

const client = new DynamoDBClient({ region: 'us-east-1' });

async function restoreTableWithValidation(sourceTable, targetTable, desiredRestoreTime) {
  try {
    // Get current restore window
    const backupsCmd = new DescribeContinuousBackupsCommand({
      TableName: sourceTable
    });

    const backups = await client.send(backupsCmd);
    const { PointInTimeRecoveryDescription } = backups.ContinuousBackupsDescription;

    if (PointInTimeRecoveryDescription.PointInTimeRecoveryStatus !== 'ENABLED') {
      throw new Error('PITR is not enabled on ' + sourceTable);
    }

    const earliest = new Date(PointInTimeRecoveryDescription.EarliestRestorableDateTime);
    const latest = new Date(PointInTimeRecoveryDescription.LatestRestorableDateTime);
    const restoreTime = new Date(desiredRestoreTime);

    // Validate restore time is within bounds
    if (restoreTime < earliest) {
      throw new Error(
        'Restore time is before EarliestRestorableDateTime (' +
        earliest.toISOString() + ')'
      );
    }

    if (restoreTime > latest) {
      throw new Error(
        'Restore time is after LatestRestorableDateTime (' +
        latest.toISOString() + '). Try a time at least 5 minutes ago.'
      );
    }

    // Perform the restore
    const restoreCmd = new RestoreTableToPointInTimeCommand({
      SourceTableName: sourceTable,
      TargetTableName: targetTable,
      RestoreDateTime: restoreTime
    });

    console.log('Restoring ' + sourceTable + ' to ' + restoreTime.toISOString());
    return await client.send(restoreCmd);

  } catch (error) {
    if (error.name === 'InvalidRestoreTimeException') {
      console.error('Invalid restore time:', error.message);
      console.error('Try using --use-latest-restorable-time instead');
    }
    throw error;
  }
}

# For EC2 instances or servers, ensure NTP is running
sudo systemctl status ntp  # or chronyd for newer systems

# Check system clock against AWS time
ntpdate -q time.nist.gov

# On AWS Lambda or managed services, time is typically synchronized automatically

# For Docker containers, ensure --cap-add=SYS_TIME if adjusting time
docker run --cap-add=SYS_TIME myimage

# Using CloudWatch metrics for monitoring
aws cloudwatch put-metric-alarm   --alarm-name DynamoDB-RestoreOperationFailures   --alarm-description "Alert on failed DynamoDB restore attempts"   --metric-name UserErrors   --namespace AWS/DynamoDB   --statistic Sum   --period 300   --threshold 1   --comparison-operator GreaterThanOrEqualToThreshold   --dimensions Name=TableName,Value=YourTableName

# Log restore operations with timestamps
aws dynamodb restore-table-to-point-in-time   --source-table-name YourTableName   --target-table-name YourTableName-restored   --use-latest-restorable-time 2>&1 |   tee -a restore-operations.log