Description

Ensure that every Amazon S3 bucket has object versioning enabled. With versioning, S3 keeps every version of an object when it is overwritten or deleted, so earlier versions can be retrieved and restored.

Rationale

Without versioning, deleting or overwriting an object removes the only copy. Compromised credentials, ransomware, faulty applications or human error can then permanently delete or corrupt data. Versioning allows recovery of previous versions. It should be combined with least privilege for delete and overwrite permissions, lifecycle rules for older versions, and stronger protections such as S3 Object Lock, MFA Delete or replication for critical data.

Impact

  • Protects against accidental or malicious deletion and overwriting of objects

  • Allows earlier versions of objects to be restored

  • Storage costs increase because older versions are kept; lifecycle rules can expire noncurrent versions to control cost

  • Once enabled, versioning cannot be turned off, only suspended

Default Value

Versioning is disabled (the bucket is unversioned) by default when a bucket is created.

Pre-Requisites

  • IAM permissions: s3:ListAllMyBuckets, s3:GetBucketVersioning and s3:PutBucketVersioning

  • A lifecycle policy plan for noncurrent object versions, to control storage costs

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select Buckets.

  3. Select a bucket and open the Properties tab.

  4. In the Bucket Versioning section, check that versioning is Enabled.

  5. Repeat for each bucket.

  6. If versioning is disabled or suspended, follow the implementation steps.

CLI:

List all buckets:

aws s3api list-buckets --query "Buckets[].Name"

Show the versioning status of a bucket:

aws s3api get-bucket-versioning --bucket <BUCKET_NAME>

A bucket fails if Status is not Enabled, that is, if it is Suspended or missing from the output.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select Buckets.

  3. Select the bucket and open the Properties tab.

  4. In the Bucket Versioning section, choose Edit.

  5. Select Enable.

  6. Choose Save changes.

  7. Repeat for each affected bucket.

CLI:

Enable versioning for a bucket:

aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console, select the bucket and open the Properties tab.

  3. In the Bucket Versioning section, choose Edit.

  4. Select Suspend and choose Save changes.

CLI:

aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Suspended

Note: suspending versioning stops new versions from being kept, but existing versions remain and continue to be charged until they are deleted. A bucket cannot return to the unversioned state.

Reference