S3 bucket has no lifecycle policy

Severity: Info
Service: S3
Check ID: S3_NO_LIFECYCLE_POLICY

What this check finds

Without a lifecycle policy, objects accumulate indefinitely. This increases storage costs, retains stale or sensitive data longer than necessary, and means the bucket has no automated path to transition objects to cheaper storage tiers or expire data in compliance with retention requirements.

Passing looks like: S3 buckets have a lifecycle policy.

How to fix it

Create a lifecycle configuration with at least one rule. A minimal rule should expire non-current versions after 30-90 days and transition objects to S3-IA or Glacier after an appropriate period.

AWS CLI

aws s3api put-bucket-lifecycle-configuration --bucket BUCKET_NAME --lifecycle-configuration file://lifecycle.json

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

S3 → Bucket → Management → Lifecycle rules → Create rule.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to S3 bucket has no lifecycle policy
Framework	Controls
SOC 2 — Trust Services Criteria	C1.2 Access Restrictions and Secure Disposal

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More S3 checks

All S3 checks