Back to Checks
alibabacloud

Versioning is enabled for OSS buckets

oss_bucket_versioning_enabled
Service: ossSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:ALIYUN::OSS::Bucket

Alibaba Cloud OSS Bucket Versioning stores previous versions of objects when they are overwritten or deleted, allowing any version to be restored at a later time. Enabling versioning on all OSS buckets ensures that data can be recovered after unintended changes or deletions.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without OSS bucket versioning enabled, objects that are overwritten or deleted cannot be recovered. This increases the impact of accidental deletion, misconfigured automation, and malicious activity such as ransomware-style overwrites, as no prior object versions are retained for recovery.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks oss_bucket_versioning_enabled

Recommendation

Enable versioning on all OSS buckets so that overwritten or deleted objects can be recovered, protecting data against accidental loss and malicious overwrites.

Remediation

CLI

ossutil bucket-versioning --method put oss://<bucket-name> enabled

Terraform

resource "alicloud_oss_bucket_versioning" "example" {
  bucket = alicloud_oss_bucket.example.bucket
  status = "Enabled"
}

Other

1Log on to the **OSS Console**
2In the bucket-list pane, click on a target OSS bucket
3Find the **Versioning** setting
4Click **Configure** and select **Enabled**
5Click **Save**

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.oss.oss_client import oss_client


class oss_bucket_versioning_enabled(Check):
    """Check if versioning is enabled for OSS buckets."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for bucket in oss_client.buckets.values():
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=bucket)
            report.region = bucket.region
            report.resource_id = bucket.name
            report.resource_arn = bucket.arn

            if bucket.versioning_status == "Enabled":
                report.status = "PASS"
                report.status_extended = (
                    f"OSS bucket {bucket.name} has versioning enabled."
                )
            else:
                report.status = "FAIL"
                if bucket.versioning_status == "Suspended":
                    report.status_extended = (
                        f"OSS bucket {bucket.name} has versioning suspended."
                    )
                else:
                    report.status_extended = (
                        f"OSS bucket {bucket.name} does not have versioning enabled."
                    )

            findings.append(report)

        return findings

References