Back to Checks
stackit

ObjectStorage buckets should have a default retention policy configured

objectstorage_bucket_retention_policy
Service: objectstorageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:NotDefined

An ObjectStorage default retention policy automatically applies a minimum retention period to every object uploaded to the bucket, preventing deletion or overwriting before the period expires. Without it, objects can be removed immediately after upload, undermining compliance and data durability requirements.

Prowler logoProwlerprowler-provider-stackit

Risk

Buckets without a default retention policy offer no automatic protection against premature object deletion. Compliance data, audit logs, and backups may be deleted before their required retention period elapses.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler stackit --checks objectstorage_bucket_retention_policy

Recommendation

Configure a default retention policy on every bucket that stores compliance-relevant or sensitive data. Choose COMPLIANCE mode for regulatory requirements and GOVERNANCE mode when administrative overrides are acceptable.

Remediation

Other

1Use the STACKIT Object Storage API or Portal to set a default retention policy on the bucket. Choose COMPLIANCE mode for strict immutability or GOVERNANCE mode to allow privileged users to override the policy.

Check Code

from prowler.lib.check.models import Check, CheckReportStackIT
from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_bucket_retention_policy(Check):
    def execute(self):
        findings = []
        for bucket in objectstorage_client.buckets:
            report = CheckReportStackIT(
                metadata=self.metadata(),
                resource=bucket,
            )
            report.resource_id = bucket.name
            report.resource_name = bucket.name
            report.location = bucket.region

            if bucket.retention_days and bucket.retention_days > 0:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} has a default retention policy of "
                    f"{bucket.retention_days} day(s) in {bucket.retention_mode} mode."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Bucket {bucket.name} does not have a default retention policy configured."

            findings.append(report)
        return findings

References