Description

Ensure that Cloud Storage buckets have Object Versioning enabled so that prior versions of an object are preserved when the object is overwritten or deleted, rather than being immediately and permanently lost.

Rationale

Without Object Versioning, overwriting or deleting an object permanently replaces or removes its data with no built-in recovery path. Object Versioning preserves noncurrent versions of objects, allowing accidental overwrites or deletions (including those caused by application bugs, misconfigured scripts, or compromised credentials) to be recovered by restoring an earlier version.

Impact

  • Allows recovery of prior object content after an accidental or malicious overwrite or deletion

  • Improves resilience against application bugs and compromised credentials that delete or corrupt data

  • Increases storage cost, since noncurrent object versions continue to be stored and billed until removed by a lifecycle rule

Default Value

By default, Object Versioning is disabled on newly created Cloud Storage buckets.

Pre-Requisites

  • IAM permissions to view and edit Cloud Storage bucket configuration (e.g., Storage Admin)

  • A lifecycle rule strategy to eventually clean up noncurrent versions and control storage cost

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Storage > Buckets and select the bucket to review.

  4. Open the Protection tab.

  5. Verify that Object versioning shows as Enabled.

  6. If versioning is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Storage > Buckets and select the bucket to update.

  4. Open the Protection tab.

  5. Locate Object versioning and select Edit (or the corresponding toggle).

  6. Enable Object versioning and confirm.

  7. Consider adding a lifecycle rule to automatically delete or transition noncurrent versions after a defined period to manage storage cost.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Storage > Buckets and select the affected bucket.

  4. Open the Protection tab.

  5. Locate Object versioning and select Edit, then disable it.

  6. Confirm the change.

Reference