# Ensure S3 buckets have object versioning enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292221624322-ensure-s3-buckets-have-object-versioning-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon S3 bucket has object versioning enabled. With versioning, S3 keeps every version of an object when it is overwritten or deleted, so earlier versions can be retrieved and restored.

**Rationale**

Without versioning, deleting or overwriting an object removes the only copy. Compromised credentials, ransomware, faulty applications or human error can then permanently delete or corrupt data. Versioning allows recovery of previous versions. It should be combined with least privilege for delete and overwrite permissions, lifecycle rules for older versions, and stronger protections such as S3 Object Lock, MFA Delete or replication for critical data.

**Impact**

-   Protects against accidental or malicious deletion and overwriting of objects
    
-   Allows earlier versions of objects to be restored
    
-   Storage costs increase because older versions are kept; lifecycle rules can expire noncurrent versions to control cost
    
-   Once enabled, versioning cannot be turned off, only suspended
    

**Default Value**

Versioning is disabled (the bucket is unversioned) by default when a bucket is created.

**Pre-Requisites**

-   IAM permissions: s3:ListAllMyBuckets, s3:GetBucketVersioning and s3:PutBucketVersioning
    
-   A lifecycle policy plan for noncurrent object versions, to control storage costs
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select **Buckets**.
    
3.  Select a bucket and open the **Properties** tab.
    
4.  In the **Bucket Versioning** section, check that versioning is **Enabled**.
    
5.  Repeat for each bucket.
    
6.  If versioning is disabled or suspended, follow the implementation steps.
    

**CLI:**

List all buckets:

aws s3api list-buckets --query "Buckets\[\].Name"

Show the versioning status of a bucket:

aws s3api get-bucket-versioning --bucket <BUCKET\_NAME>

A bucket fails if Status is not Enabled, that is, if it is Suspended or missing from the output.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select **Buckets**.
    
3.  Select the bucket and open the **Properties** tab.
    
4.  In the **Bucket Versioning** section, choose **Edit**.
    
5.  Select **Enable**.
    
6.  Choose **Save changes**.
    
7.  Repeat for each affected bucket.
    

**CLI:**

Enable versioning for a bucket:

aws s3api put-bucket-versioning --bucket <BUCKET\_NAME> --versioning-configuration Status=Enabled

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console, select the bucket and open the **Properties** tab.
    
3.  In the **Bucket Versioning** section, choose **Edit**.
    
4.  Select **Suspend** and choose **Save changes**.
    

**CLI:**

aws s3api put-bucket-versioning --bucket <BUCKET\_NAME> --versioning-configuration Status=Suspended

Note: suspending versioning stops new versions from being kept, but existing versions remain and continue to be charged until they are deleted. A bucket cannot return to the unversioned state.

**Reference**

-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html)
    
-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.