Back to Checks
openstack

Object storage containers have versioning enabled

objectstorage_container_versioning_enabled
Service: objectstorageSeverity: medium
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:OS::Swift::Container

OpenStack Swift containers are evaluated to verify that object versioning is enabled. Versioning preserves previous versions of objects when they are overwritten or deleted, enabling recovery from accidental modifications, ransomware attacks, and data corruption.

Prowler logoProwlerprowler-provider-openstack

Risk

Without versioning, overwritten or deleted objects cannot be recovered. Accidental deletions, ransomware encrypting objects, or malicious modifications result in permanent data loss. Versioning provides a safety net for forensic investigation and disaster recovery.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks objectstorage_container_versioning_enabled

Recommendation

Enable object versioning on all containers storing important data. Create a dedicated versions container and set the X-Versions-Location (stack mode) or X-History-Location (history mode) header. Implement lifecycle policies to manage version retention and storage costs. Combine with container backups for comprehensive data protection.

Remediation

CLI

swift post <container_name> -H 'X-Versions-Location: <versions_container>'

Other

1Create a versions container: `swift post <container_name>_versions`
2Enable versioning (stack mode): `swift post <container_name> -H 'X-Versions-Location: <container_name>_versions'`
3Or enable versioning (history mode): `swift post <container_name> -H 'X-History-Location: <container_name>_versions'`
4Verify: `swift stat <container_name>` shows Versions header

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_container_versioning_enabled(Check):
    """Ensure object storage containers have versioning enabled for data protection."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for container in objectstorage_client.containers:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=container)
            if container.versioning_enabled:
                report.status = "PASS"
                location = container.versions_location or container.history_location
                mode = "versions" if container.versions_location else "history"
                report.status_extended = f"Container {container.name} has versioning enabled ({mode} location: {location})."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Container {container.name} does not have versioning enabled."
                )

            findings.append(report)

        return findings

References