Check provider logo

S3 bucket has a lifecycle configuration enabled

s3_bucket_lifecycle_enabled

Severitylow
Services3
by Prowler

Amazon S3 buckets use Lifecycle configurations with at least one rule Status: Enabled to automate object Transitions and Expiration based on age, prefix, or tags

Risk

Without lifecycle rules, objects persist indefinitely, driving costs and retaining sensitive data beyond policy. Unchecked log/version growth strains operations and recovery. Long-lived data increases exposure if the account is compromised and can break required deletion timelines, affecting confidentiality and availability.

Run this check with Prowler CLI

prowler aws --checks s3_bucket_lifecycle_enabled

Run in Prowler Cloud

Recommendation

Define Lifecycle policies by data classification: set Expiration to enforce retention, use Transitions to lower-cost classes, and enable AbortIncompleteMultipartUpload. For critical logs, keep versioning and, if required, Object Lock. Limit who can change lifecycle using least privilege and separation of duties.

Remediation

CLI

aws s3api put-bucket-lifecycle-configuration --bucket <BUCKET_NAME> --lifecycle-configuration '{"Rules":[{"Status":"Enabled","Filter":{"Prefix":""},"AbortIncompleteMultipartUpload":{"DaysAfterInitiation":7}}]}'

Native IaC
Terraform
Other
  1. In the AWS Console, go to S3 and open the target bucket
  2. Select the Management tab, then click Create lifecycle rule
  3. Enter a name and choose This rule applies to all objects in the bucket
  4. Under Lifecycle rule actions, select Clean up incomplete multipart uploads and set Days after initiation to 7
  5. Ensure Status is Enabled and click Create rule

Source Code

Resource Type

AwsS3Bucket

References