S3 bucket does not have versioning enabled
- Severity
- Info
- Service
- S3
- Check ID
- S3_VERSIONING_DISABLED
What this check finds
Without versioning, objects that are overwritten or deleted cannot be recovered. This makes the bucket vulnerable to accidental deletion, ransomware attacks that overwrite objects, and misconfigured deployments that overwrite production data.
Passing looks like: S3 versioning enabled.
How to fix it
Enable versioning on the bucket.
AWS CLI
aws s3api put-bucket-versioning --bucket BUCKET_NAME --versioning-configuration Status=Enabled
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
S3 → Bucket → Properties → Bucket Versioning → Edit → Enable.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| HIPAA Security Rule |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More S3 checks
- HighInternet accessible S3 bucket via policy
- HighPublic grant to S3 bucket via ACL
- MediumS3 bucket does not require SSL/HTTPS for all requests
- MediumS3 bucket has incomplete multipart uploads consuming storage
- LowS3 Block Public Access does not block all access types
- LowS3 Block Public Access is not enabled for the account
- LowS3 bucket does not have server-access logging enabled
- LowS3 bucket with versioning enabled does not have MFA delete configured