Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
cloudstorage_bucket_versioning_enabledProvider: GCP
Service:
cloudstorageSeverity: MEDIUM
Categories:
resilienceResource type:
storage.googleapis.com/BucketWhat this check verifies
Cloud Storage buckets with Object Versioning keep prior object generations. The finding indicates whether the bucket’sversioning setting is enabled.
Risk
Without Object Versioning, deleted or overwritten objects can’t be restored, reducing availability and integrity. Compromised credentials or faulty processes can irreversibly delete or corrupt data, enabling ransomware-style destruction, accidental loss, and weakening forensic reconstruction.Recommendation
Enable Object Versioning on buckets holding important data. Pair withlifecycle rules to expire noncurrent versions and control cost. Enforce least privilege for delete/overwrite actions, and add bucket retention policies or object holds for defense-in-depth and auditability.
Remediation
- CLI
- Terraform
- Dashboard steps
gcloud storage buckets update gs://<BUCKET_NAME> —versioning
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudStorage/enable-versioning.html
- https://docs.cloud.google.com/storage/docs/object-versioning
- https://docs.cloud.google.com/storage/docs/using-object-versioning
- https://docs.cloud.google.com/storage/docs/deleting-objects#restoring_noncurrent_versions
- https://docs.cloud.google.com/storage/docs/lifecycle#delete
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudstorage_bucket_versioning_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks