More Info:
Your AWS S3 buckets should have the versioning flag enabled in order to preserve and recover overwritten and deleted S3 objects as an extra layer of data protection and/or data retention.Risk Level
HighAddress
Reliability, SecurityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- DPDPA
- Digital Operational Resilience Act (EU)
- Essential 8
- HIPAA
- HITRUST CSF
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST
- NIST CSF
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- PCI
- Reserve Bank of India (RBI) Cyber Security Framework
- Reserve Bank of India (RBI) Master Direction – Information Technology Framework
- SOC2
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the S3 bucket versioning misconfiguration in AWS using the AWS console:
- Log in to the AWS Management Console and navigate to the S3 service.
- Select the bucket that needs versioning enabled.
- Click on the “Properties” tab and select “Versioning”.
- Click on the “Enable Versioning” button.
- In the pop-up window, click on the “Enable Versioning” button again to confirm.
- Once versioning is enabled, you will see a new column in the bucket’s file list showing the version ID for each file.
Using CLI
Using CLI
To remediate the misconfiguration of S3 buckets not having versioning enabled in AWS, you can follow the below steps using AWS CLI:
- Open the AWS CLI on your local machine or EC2 instance.
-
First, you need to list all the S3 buckets in your AWS account. To do this, run the following command:
This command will list all the S3 buckets in your AWS account.
-
Next, you need to enable versioning for each S3 bucket that does not have it enabled. To enable versioning, run the following command:
Replace
BUCKET_NAMEwith the name of the S3 bucket you want to enable versioning for. This command will enable versioning for the specified S3 bucket. - Repeat step 3 for each S3 bucket that does not have versioning enabled.
-
Once you have enabled versioning for all your S3 buckets, you can verify that versioning is enabled by running the following command:
Replace
BUCKET_NAMEwith the name of the S3 bucket you want to verify versioning for. This command will return the versioning configuration for the specified S3 bucket.
Using Python
Using Python
To remediate the misconfiguration of S3 Buckets not having versioning enabled in AWS, you can follow these steps using Python:
- Import the Boto3 library to interact with AWS services:
- Create a client for the S3 service:
- List all the S3 buckets in your account:
- Iterate through each S3 bucket and enable versioning:
- This script will enable versioning for all S3 buckets in your AWS account. You can run this script periodically to ensure that new buckets created in the future also have versioning enabled.
Using Terraform
Using Terraform
Suspended), and retaining multiple versions may increase storage costs; configure lifecycle rules separately if needed.terraform plan should show creation (or update) of aws_s3_bucket_versioning.TARGET_BUCKET_VERSIONING with versioning_configuration.status = "Enabled" and no other unrelated changes.
