Back to Checks
gcp

Cloud Storage bucket has Object Versioning enabled

cloudstorage_bucket_versioning_enabled
Service: cloudstorageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:storage.googleapis.com/Bucket

Cloud Storage buckets with Object Versioning keep prior object generations. The finding indicates whether the bucket's versioning setting is enabled.

Prowler logoProwlerprowler-provider-gcp

Risk

Without Object Versioning, deleted or overwritten objects can't be restored, reducing availability and integrity. Compromised credentials or faulty processes can irreversibly delete or corrupt data, enabling ransomware-style destruction, accidental loss, and weakening forensic reconstruction.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_bucket_versioning_enabled

Recommendation

Enable Object Versioning on buckets holding important data. Pair with lifecycle rules to expire noncurrent versions and control cost. Enforce least privilege for delete/overwrite actions, and add bucket retention policies or object holds for defense-in-depth and auditability.

Remediation

CLI

gcloud storage buckets update gs://<BUCKET_NAME> --versioning

Terraform

resource "google_storage_bucket" "<example_resource_name>" {
  name     = "<example_resource_name>"
  location = "<LOCATION>"

  versioning {                 # Critical: enables Object Versioning
    enabled = true             # This makes the check pass
  }
}

Other

1In Google Cloud Console, go to Storage > Buckets and open <BUCKET_NAME>
2Click the Configuration tab, then click Edit
3Set Object versioning to Enabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_versioning_enabled(Check):
    """
    Ensure Cloud Storage buckets have Object Versioning enabled.

    Reports PASS if a bucket has versioning enabled, otherwise FAIL.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = (
                f"Bucket {bucket.name} does not have Object Versioning enabled."
            )

            if bucket.versioning_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} has Object Versioning enabled."
                )

            findings.append(report)
        return findings

References