Amazon S3 buckets are evaluated for object versioning being Enabled, which maintains multiple versions of the same object key for historical state retention
Risk
Without versioning, deletions and overwrites remove the only copy, undermining availability and integrity.
- Compromised identities or buggy apps can mass-delete/corrupt data
- No historical versions means limited rollback and irrecoverable loss
Run this check with Prowler CLI
prowler aws --checks s3_bucket_object_versioning
Recommendation
Enable S3 versioning for buckets holding important or shared data.
- Enforce least privilege to limit delete/overwrite
- Use Object Lock and/or MFA Delete for stronger protection
- Apply lifecycle rules to manage noncurrent versions and costs
- Layer with backups/replication for defense in depth
Remediation
CLI
aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled
Native IaC
Terraform
Other
- In the AWS Console, go to S3 > Buckets and select the target bucket
- Open the Properties tab
- Find Bucket Versioning and click Edit
- Select Enable and click Save changes
Source Code
Resource Type
AwsS3Bucket