Review S3 versioning settings

Description

Versioning helps recover earlier object versions after an overwrite or an ordinary delete request. Without it, recovering a file deleted by mistake or overwritten with incorrect content is harder.

Versioning does not guarantee immutable retention. An authorized principal can permanently delete a specific version, and enabling versioning does not recover data already lost beforehand.

Potential impact

Earlier content may be difficult to recover after deletion or overwrite.
A single mistake can lose operational files, backups, or deployment assets.
Malicious changes or ransomware can leave fewer recovery options.

Remediation

Set status = "Enabled" in aws_s3_bucket_versioning. Include versioning in creation templates for important buckets.
Manage lifecycle policies with retention and storage costs in mind, and test recovery procedures.
Restrict version-deletion permissions and consider S3 Object Lock when immutable retention is required.

Examples

These examples use the inline versioning and ACL syntax from AWS provider 3.x. Use a separate versioning resource for current configurations and replace the bucket name with your actual name.

Before

hcl

resource "aws_s3_bucket" "example" {
  bucket = "my-tf-test-bucket"
  acl    = "private"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }

  versioning {
    enabled = false
  }
}

After

hcl

resource "aws_s3_bucket" "example" {
  bucket = "my-tf-test-bucket"
  acl    = "private"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }

  versioning {
    enabled = true
  }
}

Explanation:

The second example enables versioning so earlier versions can be retained when objects change afterward. Distinguish delete markers from permanent version deletion, and test recovery of the versions you need.