Description
Ensure object versioning is enabled for Object Storage buckets that hold important data, so that every overwrite or deletion keeps the previous version of the object. Older versions can then be restored if an object is changed or deleted by mistake or by an attacker.
Rationale
Without versioning, overwriting or deleting an object removes the previous data permanently. Accidental changes, faulty applications, or ransomware can then destroy data with no way to recover it. Versioning keeps earlier copies, and combined with lifecycle rules for old versions, it balances recovery with storage cost.
Impact
Deleted or overwritten objects can be recovered
Protects against ransomware and accidental changes
Increases storage usage, so lifecycle rules for old versions are recommended
Default Value
By default, object versioning is disabled for new buckets.
Pre-Requisites
Permission to manage buckets in the compartment
Test Plan
Sign in to the OCI Console at https://cloud.oracle.com.
Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
Select the Bucket information tab and check the Object versioning value.
If it shows Disabled, follow the implementation steps.
Implementation Steps
Sign in to the OCI Console at https://cloud.oracle.com.
Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
Next to Object versioning, select Edit.
Select Enable versioning and confirm.
Optionally, add a lifecycle policy rule to delete previous versions after a set number of days.
Backout Plan
Sign in to the OCI Console at https://cloud.oracle.com.
Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
Next to Object versioning, select Edit, select Suspend versioning, and confirm. Existing versions are kept.
Reference