Skip to main content

OCI Storage Buckets Should Have Versioning Enabled

More Info:​

Object Storage bucket versioning should be enabled. Versioning protects data against accidental deletion, application failures, and malicious encryption (like ransomware) by preserving previous object states securely

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate “OCI Storage Buckets Should Have Versioning Enabled” using the OCI Console:

  1. Sign in to OCI Console
    Log in to the OCI Console with an account that has permissions to manage Object Storage buckets.

  2. Go to Object Storage

    • Open the hamburger menu (☰) in the top-left.
    • Navigate to: Storage → Buckets (under “Object Storage & Archive Storage”).

  3. Select the Correct Compartment

    • In the left-side Compartment selector, choose the compartment that contains the non‑compliant bucket(s).

  4. Open the Target Bucket

    • Locate the bucket that needs versioning.
    • Click the bucket Name to open its details page.

  5. Edit Bucket Properties

    • On the bucket details page, click Edit (or Edit bucket).

  6. Enable Versioning

    • Find the Versioning section.
    • Set Versioning to Enabled (or select Enable object versioning).
    • Review any warning about impact (e.g., additional storage costs for multiple versions).

  7. Save Changes

    • Click Save changes (or Update).

  8. Validate

    • After saving, confirm on the bucket details page that Versioning: Enabled is shown.
    • If your security/monitoring control is via Cloud Guard or Security Zones, wait for the next evaluation cycle and verify the problem is cleared in:
      • Cloud Guard → Targets / Problems, or
      • Security Zones → Violations, depending on your setup.

  9. Repeat for Other Buckets

    • Repeat steps 3–8 for all buckets that must comply with the “Versioning Enabled” requirement in the monitored compartments/tenancies.

If you tell me whether you’re using Cloud Guard, Security Zones, or another policy pack, I can tailor the verification step to that specific OCI monitoring service.

Using CLI

Below are step‑by‑step OCI CLI instructions to enable versioning on Object Storage buckets.

Assumptions:

  • You already have oci CLI installed and configured (oci setup config).
  • You know your compartment OCID and namespace (or can retrieve them).

1. Get the Object Storage namespace​

oci os ns get

Output will look like:

{
  "data": "my_namespace"
}

Note the value (e.g., my_namespace).

2. List buckets in a compartment (optional, to find targets)​

COMPARTMENT_ID="ocid1.compartment.oc1..xxxx"

oci os bucket list \
  --namespace-name my_namespace \
  --compartment-id "$COMPARTMENT_ID"

From the output, note the name of each bucket you need to fix.

3. Check current versioning status for a bucket​

BUCKET_NAME="my-bucket"

oci os bucket get \
  --namespace-name my_namespace \
  --name "$BUCKET_NAME" \
  --query 'data."versioning"' \
  --raw-output

If it returns Disabled or empty, versioning is not enabled.

4. Enable versioning for a single bucket​

oci os bucket update \
  --namespace-name my_namespace \
  --name "$BUCKET_NAME" \
  --versioning Enabled

5. Verify versioning is enabled​

oci os bucket get \
  --namespace-name my_namespace \
  --name "$BUCKET_NAME" \
  --query 'data."versioning"' \
  --raw-output

It should now output:

Enabled

6. (Optional) Bulk‑enable versioning on all buckets in a compartment​

COMPARTMENT_ID="ocid1.compartment.oc1..xxxx"
NAMESPACE="my_namespace"

for BUCKET in $(oci os bucket list \
  --namespace-name "$NAMESPACE" \
  --compartment-id "$COMPARTMENT_ID" \
  --query 'data[].name' \
  --raw-output); do

  echo "Enabling versioning on bucket: $BUCKET"
  oci os bucket update \
    --namespace-name "$NAMESPACE" \
    --name "$BUCKET" \
    --versioning Enabled
done

This will remediate the “OCI Storage Buckets Should Have Versioning Enabled” finding via OCI CLI.

Using Python

Below are step‑by‑step instructions and a Python example to detect and remediate OCI Object Storage buckets that do not have versioning enabled.

1. Prerequisites​

  1. Install OCI Python SDK

    pip install oci

  2. Configure OCI credentials (one of):

    • ~/.oci/config file with a profile (e.g., DEFAULT), or
    • Instance principal / resource principal in OCI (for running on OCI compute / functions).

    Example ~/.oci/config:

    [DEFAULT]
    user=ocid1.user.oc1..aaaa...
    fingerprint=aa:bb:cc:dd:...
    key_file=/path/to/oci_api_key.pem
    tenancy=ocid1.tenancy.oc1..aaaa...
    region=us-ashburn-1

2. Concept​

  • Versioning status is set at the bucket level.
  • API: ObjectStorageClient.update_bucket with UpdateBucketDetails.versioning = "Enabled".

We’ll:

  1. List all buckets in a compartment.
  2. Check each bucket’s versioning status.
  3. For those not "Enabled", call update_bucket to enable it.
  4. Wrap this in a script that can be used for periodic monitoring/remediation.

3. Python Script: Detect & Remediate Bucket Versioning​

import oci
from oci.object_storage.models import UpdateBucketDetails

# CONFIGURATION
CONFIG_PROFILE = "DEFAULT"         # profile name in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxx"  # compartment to scan
NAMESPACE_OVERRIDE = None          # set to string if you want to force a namespace

def get_object_storage_client():
    config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
    return oci.object_storage.ObjectStorageClient(config), config

def list_buckets(client, namespace, compartment_id):
    buckets = []
    resp = client.list_buckets(namespace_name=namespace,
                               compartment_id=compartment_id)
    buckets.extend(resp.data)
    while resp.has_next_page:
        resp = client.list_buckets(namespace_name=namespace,
                                   compartment_id=compartment_id,
                                   page=resp.next_page)
        buckets.extend(resp.data)
    return buckets

def get_namespace(client, config):
    if NAMESPACE_OVERRIDE:
        return NAMESPACE_OVERRIDE
    resp = client.get_namespace(compartment_id=config["tenancy"])
    return resp.data

def enable_versioning_for_bucket(client, namespace, bucket_name):
    update_details = UpdateBucketDetails(versioning="Enabled")
    client.update_bucket(
        namespace_name=namespace,
        bucket_name=bucket_name,
        update_bucket_details=update_details
    )

def main():
    client, config = get_object_storage_client()
    namespace = get_namespace(client, config)

    print(f"Using namespace: {namespace}")
    print(f"Scanning compartment: {COMPARTMENT_OCID}")

    buckets = list_buckets(client, namespace, COMPARTMENT_OCID)
    print(f"Found {len(buckets)} buckets.")

    for b in buckets:
        name = b.name
        versioning = b.versioning  # may be None, "Enabled" or "Suspended"
        print(f"Bucket: {name}, versioning: {versioning}")

        if versioning != "Enabled":
            print(f" -> Enabling versioning on bucket: {name}")
            enable_versioning_for_bucket(client, namespace, name)
            print(f" -> Versioning enabled on bucket: {name}")

    print("Completed versioning remediation.")

if __name__ == "__main__":
    main()

4. How to Use for Monitoring​

  • Run this script on a schedule (e.g., cron, OCI Functions + OCI Events) to:
    • Log buckets and their versioning status (monitoring).
    • Automatically remediate any non‑compliant bucket (enable versioning).

Example cron (every hour):

0 * * * * /usr/bin/python3 /path/to/oci_bucket_versioning_remediation.py >> /var/log/oci_bucket_versioning.log 2>&1

This setup continuously monitors and remediates the “versioning disabled” misconfiguration on OCI Object Storage buckets using Python.

Using Terraform
resource "oci_objectstorage_bucket" "MONITORED_BUCKET" {
  # Replace with your values
  compartment_id = OCI_COMPARTMENT_OCID
  namespace      = OCI_OBJECTSTORAGE_NAMESPACE
  name           = "BUCKET_NAME"
  storage_tier   = "Standard"

  # Remediation: enable bucket versioning
  versioning = "Enabled"
}

Enabling versioning on an existing oci_objectstorage_bucket is an in‑place update in OCI and does not force bucket replacement.

After updating your configuration, terraform plan should show a single in‑place update (~ on oci_objectstorage_bucket.MONITORED_BUCKET) changing versioning from "Disabled" (or null) to "Enabled".