# Ensure S3 buckets have object versioning enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000236264-ensure-s3-buckets-have-object-versioning-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

-   Level 1

  

### **Description:**

This control ensures that Amazon S3 Object Versioning is enabled for all critical and sensitive data buckets. Object Versioning protects against accidental or malicious deletion or overwriting of objects by maintaining multiple versions of each object in a bucket. Enabling versioning allows recovery of previous versions of objects and supports compliance with data retention and audit requirements.

  

### **Rationale:**

Versioning helps ensure data durability, integrity, and recoverability in the event of:

-   Accidental overwrites or deletions by users or processes.
    
-   Application errors or malicious modifications.
    
-   Compliance or audit requirements mandating historical data retention.
    

When versioning is enabled, S3 preserves prior object versions, allowing administrators to restore data to a known good state easily. This improves resiliency, supports compliance, and enhances disaster recovery capabilities.

  

### **Impact:**

-   Positive Impact:Protects critical data from accidental loss or overwrites.Enables easy recovery of deleted or modified files.Supports compliance with regulatory and data retention requirements.
-   Negative Impact:Increases S3 storage costs due to retention of multiple object versions.Requires lifecycle management rules to prevent indefinite storage growth.

  

### **Default Value:**

By default, S3 Object Versioning is disabled for all buckets. It must be explicitly enabled.

  

### **Pre-Requisite:**

-   IAM permissions required:
    
    -   `s3:GetBucketVersioning`
        
    -   `s3:PutBucketVersioning`
        
-   Optional: Define lifecycle policies to manage older versions and reduce cost (e.g., automatically delete or transition versions to Glacier after a period).
    

  

  

### **Remediation**

#### **Test Plan**

### **Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to Amazon S3 → Buckets.
    
3.  Select a bucket.
    
4.  Go to the Properties tab.
    
5.  Scroll to Bucket Versioning.
    
6.  Verify the status:
    

###   

### **Implementation Plan**

### **Using AWS Console:**

1.  Navigate to Amazon S3 → Buckets.
    
2.  Select the desired bucket.
    
3.  Go to the Properties tab.
    
4.  Scroll to Bucket Versioning and click Edit.
    
5.  Choose Enable.
    
6.  Click Save changes.
    

  

### **Backout Plan**

#### **Using AWS Console:**

1.  Navigate to Amazon S3 → Buckets → \[Your Bucket\] → Properties.
    
2.  Under Bucket Versioning, click Edit.
    
3.  Change the status to Suspend.
    
4.  Click Save changes.
    

  

### **References:**

-   [Amazon S3 Versioning Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html)
    
-   [AWS CLI Command Reference – put-bucket-versioning](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html)
    
-   [S3 Lifecycle Management Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.