Description

Ensure object versioning is enabled on Object Storage buckets that hold critical data, so every change or deletion keeps the previous version of the object, which can be restored if needed.

Rationale

Without versioning, overwriting or deleting an object removes the old data permanently. Mistakes, faulty applications, or ransomware can then destroy data with no way to recover it. Versioning keeps earlier versions, and it is also required for Object Lock.

Impact

  • Overwritten or deleted objects can be restored

  • Protects against accidental changes and ransomware

  • Increases storage use, so lifecycle rules for old versions are recommended

Default Value

By default, versioning is disabled on buckets.

Pre-Requisites

  • Permission to manage Object Storage in the Public Cloud project

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Object Storage.

  4. Select the bucket and, in the General information tab, check the versioning status.

  5. Alternatively, run: aws s3api get-bucket-versioning --bucket <bucket_name>

  6. If versioning is not enabled on a critical bucket, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Object Storage.

  4. Select the bucket and, in the General information tab, enable versioning.

  5. Alternatively, run: aws s3api put-bucket-versioning --bucket <bucket_name> --versioning-configuration Status=Enabled

Backout Plan

  1. Run: aws s3api put-bucket-versioning --bucket <bucket_name> --versioning-configuration Status=Suspended. Existing versions are kept.

Reference