S3 bucket has a lifecycle configuration enabled

Check ID: s3_bucket_lifecycle_enabled
Provider: AWS
Service: s3
Severity: LOW
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets use Lifecycle configurations with at least one rule Status: Enabled to automate object Transitions and Expiration based on age, prefix, or tags

Risk

Without lifecycle rules, objects persist indefinitely, driving costs and retaining sensitive data beyond policy. Unchecked log/version growth strains operations and recovery. Long-lived data increases exposure if the account is compromised and can break required deletion timelines, affecting confidentiality and availability.

Recommendation

Define Lifecycle policies by data classification: set Expiration to enforce retention, use Transitions to lower-cost classes, and enable AbortIncompleteMultipartUpload. For critical logs, keep versioning and, if required, Object Lock. Limit who can change lifecycle using least privilege and separation of duties.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-lifecycle-configuration --bucket <BUCKET_NAME> --lifecycle-configuration '{"Rules":[{"Status":"Enabled","Filter":{"Prefix":""},"AbortIncompleteMultipartUpload":{"DaysAfterInitiation":7}}]}'

# Minimal lifecycle configuration to mark the bucket as having an enabled rule
resource "aws_s3_bucket_lifecycle_configuration" "<example_resource_name>" {
  bucket = "<example_resource_name>"

  rule {
    status = "Enabled"  # CRITICAL: Enables lifecycle rule to pass the check
    filter {}            # Applies to all objects

    abort_incomplete_multipart_upload {
      days_after_initiation = 7  # Minimal action to satisfy schema
    }
  }
}

# CloudFormation: enable a minimal S3 Lifecycle configuration
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:  # CRITICAL: Adds a Lifecycle configuration to the bucket
        Rules:
          - Status: Enabled     # CRITICAL: Rule must be Enabled to pass the check
            Filter:
              Prefix: ""        # Applies to all objects
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7  # Minimal action to satisfy schema

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_lifecycle_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has Block Public Access enabled S3 bucket has MFA Delete enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires