OCI Storage Buckets Should Have Versioning Enabled

Using Console

To remediate “OCI Storage Buckets Should Have Versioning Enabled” using the OCI Console:

Sign in to OCI Console
Log in to the OCI Console with an account that has permissions to manage Object Storage buckets.
Go to Object Storage
- Open the hamburger menu (☰) in the top-left.
- Navigate to: Storage → Buckets (under “Object Storage & Archive Storage”).
Select the Correct Compartment
- In the left-side Compartment selector, choose the compartment that contains the non‑compliant bucket(s).
Open the Target Bucket
- Locate the bucket that needs versioning.
- Click the bucket Name to open its details page.
Edit Bucket Properties
- On the bucket details page, click Edit (or Edit bucket).
Enable Versioning
- Find the Versioning section.
- Set Versioning to Enabled (or select Enable object versioning).
- Review any warning about impact (e.g., additional storage costs for multiple versions).
Save Changes
- Click Save changes (or Update).
Validate
- After saving, confirm on the bucket details page that Versioning: Enabled is shown.
- If your security/monitoring control is via Cloud Guard or Security Zones, wait for the next evaluation cycle and verify the problem is cleared in:
  - Cloud Guard → Targets / Problems, or
  - Security Zones → Violations, depending on your setup.
Repeat for Other Buckets
- Repeat steps 3–8 for all buckets that must comply with the “Versioning Enabled” requirement in the monitored compartments/tenancies.

If you tell me whether you’re using Cloud Guard, Security Zones, or another policy pack, I can tailor the verification step to that specific OCI monitoring service.

Using CLI

Below are step‑by‑step OCI CLI instructions to enable versioning on Object Storage buckets.Assumptions:

You already have oci CLI installed and configured (oci setup config).
You know your compartment OCID and namespace (or can retrieve them).

1. Get the Object Storage namespace

oci os ns get

Output will look like:

{
  "data": "my_namespace"
}

Note the value (e.g., my_namespace).

2. List buckets in a compartment (optional, to find targets)

COMPARTMENT_ID="ocid1.compartment.oc1..xxxx"

oci os bucket list \
  --namespace-name my_namespace \
  --compartment-id "$COMPARTMENT_ID"

From the output, note the name of each bucket you need to fix.

3. Check current versioning status for a bucket

BUCKET_NAME="my-bucket"

oci os bucket get \
  --namespace-name my_namespace \
  --name "$BUCKET_NAME" \
  --query 'data."versioning"' \
  --raw-output

If it returns Disabled or empty, versioning is not enabled.

4. Enable versioning for a single bucket

oci os bucket update \
  --namespace-name my_namespace \
  --name "$BUCKET_NAME" \
  --versioning Enabled

5. Verify versioning is enabled

oci os bucket get \
  --namespace-name my_namespace \
  --name "$BUCKET_NAME" \
  --query 'data."versioning"' \
  --raw-output

It should now output:

Enabled

6. (Optional) Bulk‑enable versioning on all buckets in a compartment

COMPARTMENT_ID="ocid1.compartment.oc1..xxxx"
NAMESPACE="my_namespace"

for BUCKET in $(oci os bucket list \
  --namespace-name "$NAMESPACE" \
  --compartment-id "$COMPARTMENT_ID" \
  --query 'data[].name' \
  --raw-output); do

  echo "Enabling versioning on bucket: $BUCKET"
  oci os bucket update \
    --namespace-name "$NAMESPACE" \
    --name "$BUCKET" \
    --versioning Enabled
done

This will remediate the “OCI Storage Buckets Should Have Versioning Enabled” finding via OCI CLI.

Using Python

Below are step‑by‑step instructions and a Python example to detect and remediate OCI Object Storage buckets that do not have versioning enabled.

1. Prerequisites

Install OCI Python SDK
pip install oci
Configure OCI credentials (one of):
- ~/.oci/config file with a profile (e.g., DEFAULT), or
- Instance principal / resource principal in OCI (for running on OCI compute / functions).
Example ~/.oci/config:
[DEFAULT] user=ocid1.user.oc1..aaaa... fingerprint=aa:bb:cc:dd:... key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..aaaa... region=us-ashburn-1

2. Concept

Versioning status is set at the bucket level.
API: ObjectStorageClient.update_bucket with UpdateBucketDetails.versioning = "Enabled".

We’ll:

List all buckets in a compartment.
Check each bucket’s versioning status.
For those not "Enabled", call update_bucket to enable it.
Wrap this in a script that can be used for periodic monitoring/remediation.

3. Python Script: Detect & Remediate Bucket Versioning

import oci
from oci.object_storage.models import UpdateBucketDetails

# CONFIGURATION
CONFIG_PROFILE = "DEFAULT"         # profile name in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxx"  # compartment to scan
NAMESPACE_OVERRIDE = None          # set to string if you want to force a namespace

def get_object_storage_client():
    config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
    return oci.object_storage.ObjectStorageClient(config), config

def list_buckets(client, namespace, compartment_id):
    buckets = []
    resp = client.list_buckets(namespace_name=namespace,
                               compartment_id=compartment_id)
    buckets.extend(resp.data)
    while resp.has_next_page:
        resp = client.list_buckets(namespace_name=namespace,
                                   compartment_id=compartment_id,
                                   page=resp.next_page)
        buckets.extend(resp.data)
    return buckets

def get_namespace(client, config):
    if NAMESPACE_OVERRIDE:
        return NAMESPACE_OVERRIDE
    resp = client.get_namespace(compartment_id=config["tenancy"])
    return resp.data

def enable_versioning_for_bucket(client, namespace, bucket_name):
    update_details = UpdateBucketDetails(versioning="Enabled")
    client.update_bucket(
        namespace_name=namespace,
        bucket_name=bucket_name,
        update_bucket_details=update_details
    )

def main():
    client, config = get_object_storage_client()
    namespace = get_namespace(client, config)

    print(f"Using namespace: {namespace}")
    print(f"Scanning compartment: {COMPARTMENT_OCID}")

    buckets = list_buckets(client, namespace, COMPARTMENT_OCID)
    print(f"Found {len(buckets)} buckets.")

    for b in buckets:
        name = b.name
        versioning = b.versioning  # may be None, "Enabled" or "Suspended"
        print(f"Bucket: {name}, versioning: {versioning}")

        if versioning != "Enabled":
            print(f" -> Enabling versioning on bucket: {name}")
            enable_versioning_for_bucket(client, namespace, name)
            print(f" -> Versioning enabled on bucket: {name}")

    print("Completed versioning remediation.")

if __name__ == "__main__":
    main()

4. How to Use for Monitoring

Run this script on a schedule (e.g., cron, OCI Functions + OCI Events) to:
- Log buckets and their versioning status (monitoring).
- Automatically remediate any non‑compliant bucket (enable versioning).

Example cron (every hour):

0 * * * * /usr/bin/python3 /path/to/oci_bucket_versioning_remediation.py >> /var/log/oci_bucket_versioning.log 2>&1

This setup continuously monitors and remediates the “versioning disabled” misconfiguration on OCI Object Storage buckets using Python.

Using Terraform

resource "oci_objectstorage_bucket" "MONITORED_BUCKET" {
  # Replace with your values
  compartment_id = OCI_COMPARTMENT_OCID
  namespace      = OCI_OBJECTSTORAGE_NAMESPACE
  name           = "BUCKET_NAME"
  storage_tier   = "Standard"

  # Remediation: enable bucket versioning
  versioning = "Enabled"
}

Enabling versioning on an existing oci_objectstorage_bucket is an in‑place update in OCI and does not force bucket replacement.After updating your configuration, terraform plan should show a single in‑place update (~ on oci_objectstorage_bucket.MONITORED_BUCKET) changing versioning from "Disabled" (or null) to "Enabled".

OCI Misconfigurations

OCI Storage Buckets Should Have Versioning Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Get the Object Storage namespace

2. List buckets in a compartment (optional, to find targets)

3. Check current versioning status for a bucket

4. Enable versioning for a single bucket

5. Verify versioning is enabled

6. (Optional) Bulk‑enable versioning on all buckets in a compartment

1. Prerequisites

2. Concept

3. Python Script: Detect & Remediate Bucket Versioning

4. How to Use for Monitoring

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Get the Object Storage namespace

​2. List buckets in a compartment (optional, to find targets)

​3. Check current versioning status for a bucket

​4. Enable versioning for a single bucket

​5. Verify versioning is enabled

​6. (Optional) Bulk‑enable versioning on all buckets in a compartment

​1. Prerequisites

​2. Concept

​3. Python Script: Detect & Remediate Bucket Versioning

​4. How to Use for Monitoring

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Get the Object Storage namespace

2. List buckets in a compartment (optional, to find targets)

3. Check current versioning status for a bucket

4. Enable versioning for a single bucket

5. Verify versioning is enabled

6. (Optional) Bulk‑enable versioning on all buckets in a compartment

1. Prerequisites

2. Concept

3. Python Script: Detect & Remediate Bucket Versioning

4. How to Use for Monitoring