Check ID: objectstorage_container_versioning_enabled
Provider: OpenStack
Service: objectstorage
Severity: MEDIUM
Categories: forensics-ready
Resource type: OS::Swift::Container

​
What this check verifies

OpenStack Swift containers are evaluated to verify that object versioning is enabled. Versioning preserves previous versions of objects when they are overwritten or deleted, enabling recovery from accidental modifications, ransomware attacks, and data corruption.

​
Risk

Without versioning, overwritten or deleted objects cannot be recovered. Accidental deletions, ransomware encrypting objects, or malicious modifications result in permanent data loss. Versioning provides a safety net for forensic investigation and disaster recovery.

​
Recommendation

Enable object versioning on all containers storing important data. Create a dedicated versions container and set the X-Versions-Location (stack mode) or X-History-Location (history mode) header. Implement lifecycle policies to manage version retention and storage costs. Combine with container backups for comprehensive data protection.

​
Remediation

swift post <container_name> -H ‘X-Versions-Location: <versions_container>’

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_container_versioning_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks