> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Storage Buckets Should Have Versioning Enabled ### More Info: Object Storage bucket versioning should be enabled. Versioning protects data against accidental deletion, application failures, and malicious encryption (like ransomware) by preserving previous object states securely ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HIPAA * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate “OCI Storage Buckets Should Have Versioning Enabled” using the OCI Console: 1. **Sign in to OCI Console**\ Log in to the OCI Console with an account that has permissions to manage Object Storage buckets. 2. **Go to Object Storage** * Open the hamburger menu (☰) in the top-left. * Navigate to: **Storage → Buckets** (under “Object Storage & Archive Storage”). 3. **Select the Correct Compartment** * In the left-side Compartment selector, choose the compartment that contains the non‑compliant bucket(s). 4. **Open the Target Bucket** * Locate the bucket that needs versioning. * Click the bucket **Name** to open its details page. 5. **Edit Bucket Properties** * On the bucket details page, click **Edit** (or **Edit bucket**). 6. **Enable Versioning** * Find the **Versioning** section. * Set **Versioning** to **Enabled** (or select **Enable object versioning**). * Review any warning about impact (e.g., additional storage costs for multiple versions). 7. **Save Changes** * Click **Save changes** (or **Update**). 8. **Validate** * After saving, confirm on the bucket details page that **Versioning: Enabled** is shown. * If your security/monitoring control is via **Cloud Guard** or **Security Zones**, wait for the next evaluation cycle and verify the problem is cleared in: * **Cloud Guard → Targets / Problems**, or * **Security Zones → Violations**, depending on your setup. 9. **Repeat for Other Buckets** * Repeat steps 3–8 for all buckets that must comply with the “Versioning Enabled” requirement in the monitored compartments/tenancies. If you tell me whether you’re using Cloud Guard, Security Zones, or another policy pack, I can tailor the verification step to that specific OCI monitoring service. Below are step‑by‑step OCI CLI instructions to enable versioning on Object Storage buckets. Assumptions: * You already have `oci` CLI installed and configured (`oci setup config`). * You know your **compartment OCID** and **namespace** (or can retrieve them). *** ### 1. Get the Object Storage namespace ```bash theme={null} oci os ns get ``` Output will look like: ```json theme={null} { "data": "my_namespace" } ``` Note the value (e.g., `my_namespace`). *** ### 2. List buckets in a compartment (optional, to find targets) ```bash theme={null} COMPARTMENT_ID="ocid1.compartment.oc1..xxxx" oci os bucket list \ --namespace-name my_namespace \ --compartment-id "$COMPARTMENT_ID" ``` From the output, note the `name` of each bucket you need to fix. *** ### 3. Check current versioning status for a bucket ```bash theme={null} BUCKET_NAME="my-bucket" oci os bucket get \ --namespace-name my_namespace \ --name "$BUCKET_NAME" \ --query 'data."versioning"' \ --raw-output ``` If it returns `Disabled` or empty, versioning is not enabled. *** ### 4. Enable versioning for a single bucket ```bash theme={null} oci os bucket update \ --namespace-name my_namespace \ --name "$BUCKET_NAME" \ --versioning Enabled ``` *** ### 5. Verify versioning is enabled ```bash theme={null} oci os bucket get \ --namespace-name my_namespace \ --name "$BUCKET_NAME" \ --query 'data."versioning"' \ --raw-output ``` It should now output: ```text theme={null} Enabled ``` *** ### 6. (Optional) Bulk‑enable versioning on all buckets in a compartment ```bash theme={null} COMPARTMENT_ID="ocid1.compartment.oc1..xxxx" NAMESPACE="my_namespace" for BUCKET in $(oci os bucket list \ --namespace-name "$NAMESPACE" \ --compartment-id "$COMPARTMENT_ID" \ --query 'data[].name' \ --raw-output); do echo "Enabling versioning on bucket: $BUCKET" oci os bucket update \ --namespace-name "$NAMESPACE" \ --name "$BUCKET" \ --versioning Enabled done ``` This will remediate the “OCI Storage Buckets Should Have Versioning Enabled” finding via OCI CLI. Below are step‑by‑step instructions and a Python example to detect and remediate OCI Object Storage buckets that do **not** have versioning enabled. *** ## 1. Prerequisites 1. **Install OCI Python SDK** ```bash theme={null} pip install oci ``` 2. **Configure OCI credentials** (one of): * `~/.oci/config` file with a profile (e.g., `DEFAULT`), **or** * Instance principal / resource principal in OCI (for running on OCI compute / functions). Example `~/.oci/config`: ```ini theme={null} [DEFAULT] user=ocid1.user.oc1..aaaa... fingerprint=aa:bb:cc:dd:... key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..aaaa... region=us-ashburn-1 ``` *** ## 2. Concept * **Versioning status** is set at the *bucket* level. * API: `ObjectStorageClient.update_bucket` with `UpdateBucketDetails.versioning` = `"Enabled"`. We’ll: 1. List all buckets in a compartment. 2. Check each bucket’s versioning status. 3. For those not `"Enabled"`, call `update_bucket` to enable it. 4. Wrap this in a script that can be used for periodic monitoring/remediation. *** ## 3. Python Script: Detect & Remediate Bucket Versioning ```python theme={null} import oci from oci.object_storage.models import UpdateBucketDetails # CONFIGURATION CONFIG_PROFILE = "DEFAULT" # profile name in ~/.oci/config COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxx" # compartment to scan NAMESPACE_OVERRIDE = None # set to string if you want to force a namespace def get_object_storage_client(): config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE) return oci.object_storage.ObjectStorageClient(config), config def list_buckets(client, namespace, compartment_id): buckets = [] resp = client.list_buckets(namespace_name=namespace, compartment_id=compartment_id) buckets.extend(resp.data) while resp.has_next_page: resp = client.list_buckets(namespace_name=namespace, compartment_id=compartment_id, page=resp.next_page) buckets.extend(resp.data) return buckets def get_namespace(client, config): if NAMESPACE_OVERRIDE: return NAMESPACE_OVERRIDE resp = client.get_namespace(compartment_id=config["tenancy"]) return resp.data def enable_versioning_for_bucket(client, namespace, bucket_name): update_details = UpdateBucketDetails(versioning="Enabled") client.update_bucket( namespace_name=namespace, bucket_name=bucket_name, update_bucket_details=update_details ) def main(): client, config = get_object_storage_client() namespace = get_namespace(client, config) print(f"Using namespace: {namespace}") print(f"Scanning compartment: {COMPARTMENT_OCID}") buckets = list_buckets(client, namespace, COMPARTMENT_OCID) print(f"Found {len(buckets)} buckets.") for b in buckets: name = b.name versioning = b.versioning # may be None, "Enabled" or "Suspended" print(f"Bucket: {name}, versioning: {versioning}") if versioning != "Enabled": print(f" -> Enabling versioning on bucket: {name}") enable_versioning_for_bucket(client, namespace, name) print(f" -> Versioning enabled on bucket: {name}") print("Completed versioning remediation.") if __name__ == "__main__": main() ``` *** ## 4. How to Use for Monitoring * Run this script on a **schedule** (e.g., cron, OCI Functions + OCI Events) to: * Log buckets and their versioning status (monitoring). * Automatically remediate any non‑compliant bucket (enable versioning). Example cron (every hour): ```bash theme={null} 0 * * * * /usr/bin/python3 /path/to/oci_bucket_versioning_remediation.py >> /var/log/oci_bucket_versioning.log 2>&1 ``` This setup continuously monitors and remediates the “versioning disabled” misconfiguration on OCI Object Storage buckets using Python. ```hcl theme={null} resource "oci_objectstorage_bucket" "MONITORED_BUCKET" { # Replace with your values compartment_id = OCI_COMPARTMENT_OCID namespace = OCI_OBJECTSTORAGE_NAMESPACE name = "BUCKET_NAME" storage_tier = "Standard" # Remediation: enable bucket versioning versioning = "Enabled" } ``` Enabling `versioning` on an existing `oci_objectstorage_bucket` is an in‑place update in OCI and does not force bucket replacement. After updating your configuration, `terraform plan` should show a single in‑place update (`~` on `oci_objectstorage_bucket.MONITORED_BUCKET`) changing `versioning` from `"Disabled"` (or `null`) to `"Enabled"`.