Back to Checks
aws

S3 bucket has a lifecycle configuration enabled

s3_bucket_lifecycle_enabled
Service: s3Severity: low
OfficialBuilt-inVerified
Resource Type:AwsS3Bucket

Amazon S3 buckets use Lifecycle configurations with at least one rule Status: Enabled to automate object Transitions and Expiration based on age, prefix, or tags

Prowler logoProwlerprowler-provider-aws

Risk

Without lifecycle rules, objects persist indefinitely, driving costs and retaining sensitive data beyond policy. Unchecked log/version growth strains operations and recovery. Long-lived data increases exposure if the account is compromised and can break required deletion timelines, affecting confidentiality and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_bucket_lifecycle_enabled

Recommendation

Define Lifecycle policies by data classification: set Expiration to enforce retention, use Transitions to lower-cost classes, and enable AbortIncompleteMultipartUpload. For critical logs, keep versioning and, if required, Object Lock. Limit who can change lifecycle using least privilege and separation of duties.

Remediation

CLI

aws s3api put-bucket-lifecycle-configuration --bucket <BUCKET_NAME> --lifecycle-configuration '{"Rules":[{"Status":"Enabled","Filter":{"Prefix":""},"AbortIncompleteMultipartUpload":{"DaysAfterInitiation":7}}]}'

Terraform

# Minimal lifecycle configuration to mark the bucket as having an enabled rule
resource "aws_s3_bucket_lifecycle_configuration" "<example_resource_name>" {
  bucket = "<example_resource_name>"

  rule {
    status = "Enabled"  # CRITICAL: Enables lifecycle rule to pass the check
    filter {}            # Applies to all objects

    abort_incomplete_multipart_upload {
      days_after_initiation = 7  # Minimal action to satisfy schema
    }
  }
}

NativeIaC

# CloudFormation: enable a minimal S3 Lifecycle configuration
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:  # CRITICAL: Adds a Lifecycle configuration to the bucket
        Rules:
          - Status: Enabled     # CRITICAL: Rule must be Enabled to pass the check
            Filter:
              Prefix: ""        # Applies to all objects
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7  # Minimal action to satisfy schema

Other

1In the AWS Console, go to S3 and open the target bucket
2Select the Management tab, then click Create lifecycle rule
3Enter a name and choose This rule applies to all objects in the bucket
4Under Lifecycle rule actions, select Clean up incomplete multipart uploads and set Days after initiation to 7
5Ensure Status is Enabled and click Create rule

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client


class s3_bucket_lifecycle_enabled(Check):
    def execute(self):
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = f"S3 Bucket {bucket.name} does not have a lifecycle configuration enabled."

            if bucket.lifecycle:
                for configuration in bucket.lifecycle:
                    if configuration.status == "Enabled":
                        report.status = "PASS"
                        report.status_extended = f"S3 Bucket {bucket.name} has a lifecycle configuration enabled."
                        break

            findings.append(report)

        return findings

References