Description
Object Versioning retains noncurrent versions when live objects are replaced or deleted, helping recover a particular version. Other recovery measures, such as soft delete, can exist when versioning is disabled, so assess the actual recovery policy.
Potential impact
- Mistaken changes can be difficult to reverse without required earlier versions or another recovery path.
- Versioning does not protect against bucket deletion or itself prevent authorized deletion of noncurrent versions.
Remediation
- Set
versioning { enabled = true }when ongoing access to earlier versions is needed. Consider soft delete for recovery from accidental or malicious deletion. - Manage costs with lifecycle and retention policies, and test restoration. Restrict deletion permissions and configure any required immutability controls separately.
Examples
These excerpts compare one setting. Replace the bucket name with an available value and assess actual recovery requirements.
Before
hcl
resource "google_storage_bucket" "example" {
name = "foo"
location = "EU"
versioning {
enabled = false
}
}
After
hcl
resource "google_storage_bucket" "example" {
name = "foo"
location = "EU"
versioning {
enabled = true
}
}
Explanation:
- Before: New noncurrent versions are not accumulated. Check soft delete or separate backups independently.
- After: Versioning is enabled. It does not restore previously permanently deleted objects or prevent bucket deletion.