S3 bucket must have versioning enabled

High AWS General aws-s3-bucket-versioning

Applies to

AWS::S3::Bucket

What CGPulse checks

A resource passes this rule when versioningEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable versioning to allow recovery from accidental deletions or overwrites. In AWS Console: S3 > Bucket > Properties > Bucket Versioning > Enable. See: https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html

CLI

aws s3api put-bucket-versioning --bucket "{name}" --versioning-configuration Status=Enabled

Terraform

resource "aws_s3_bucket_versioning" "{name}" {
  bucket = aws_s3_bucket.{name}.id
  versioning_configuration {
    status = "Enabled"
  }
}

Compliance frameworks

Cloud Foundations Benchmark v3.02.1.4
Cloud Security: AWS Foundations
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.312(c)(1)

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan

Related AWS rules

ACM certificate must be eligible for renewal
ACM certificate must be in issued status
Amplify app should have basic auth disabled for production
API Gateway REST API must have an endpoint configuration
API Gateway V2 API must be properly configured
App Runner service must have encryption enabled
AppSync API must have logging configured
AppSync API must have X-Ray tracing enabled