Back to Checks
oraclecloud

Object Storage bucket has versioning enabled

objectstorage_bucket_versioning_enabled
Service: objectstorageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Bucket

OCI Object Storage buckets are assessed for versioning being set to Enabled, indicating prior object versions are retained when updates or deletions occur.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

No versioning lets overwrites or deletions permanently remove data, harming availability and integrity. Malicious or accidental actions, automated jobs, or malware can wipe or corrupt objects without rollback, enabling ransomware-style encryption and large-scale data loss.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks objectstorage_bucket_versioning_enabled

Recommendation

Enable bucket versioning (Enabled) for data that needs recovery. Apply least privilege to delete and overwrite actions, use retention rules or legal holds for critical data, and add lifecycle policies to manage older versions-providing defense in depth against destructive changes.

Remediation

CLI

oci os bucket update --namespace-name <NAMESPACE> --bucket-name <BUCKET_NAME> --versioning Enabled

Terraform

resource "oci_objectstorage_bucket" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  name           = "<example_resource_name>"
  namespace      = "<example_resource_id>"
  versioning     = "Enabled" # Critical: enables bucket versioning to pass the check
}

Other

1Sign in to the OCI Console
2Go to Storage > Buckets and open the target bucket
3In Bucket details, find Versioning and click Edit
4Select Enabled and click Save

Check Code

"""Check Ensure Versioning is Enabled for Object Storage Buckets."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_bucket_versioning_enabled(Check):
    """Check Ensure Versioning is Enabled for Object Storage Buckets."""

    def execute(self) -> Check_Report_OCI:
        """Execute the objectstorage_bucket_versioning_enabled check."""
        findings = []

        # Check buckets have versioning enabled
        for bucket in objectstorage_client.buckets:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=bucket,
                region=bucket.region,
                resource_name=bucket.name,
                resource_id=bucket.id,
                compartment_id=bucket.compartment_id,
            )

            if bucket.versioning and bucket.versioning == "Enabled":
                report.status = "PASS"
                report.status_extended = f"Bucket {bucket.name} has versioning enabled."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} does not have versioning enabled."
                )

            findings.append(report)

        return findings

References