S3 bucket has object versioning enabled

Check ID: s3_bucket_object_versioning
Provider: AWS
Service: s3
Severity: MEDIUM
Categories: resilience
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets are evaluated for object versioning being Enabled, which maintains multiple versions of the same object key for historical state retention

Risk

Without versioning, deletions and overwrites remove the only copy, undermining availability and integrity.

Compromised identities or buggy apps can mass-delete/corrupt data
No historical versions means limited rollback and irrecoverable loss

Recommendation

Enable S3 versioning for buckets holding important or shared data.

Enforce least privilege to limit delete/overwrite
Use Object Lock and/or MFA Delete for stronger protection
Apply lifecycle rules to manage noncurrent versions and costs
Layer with backups/replication for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled

# Enable versioning on an existing S3 bucket
resource "aws_s3_bucket_versioning" "<example_resource_name>" {
  bucket = "<example_resource_name>"
  versioning_configuration {
    status = "Enabled"  # Critical: enables bucket versioning to remediate the finding
  }
}

# CloudFormation: enable versioning on an S3 bucket
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled  # Critical: turns on object versioning to pass the check

References

https://docs.aws.amazon.com/AmazonS3/latest/dev-retired/Versioning.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_object_versioning. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 bucket has Object Lock enabled S3 bucket policy does not allow public write access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires