14. Amazon S3: Buckets, Objects, Policies and Presigned URLs
14.5 Versioning and Lifecycle Rules
Versioning on kela ki pratyek overwrite aani delete nantar juna version surakshit rahto. Chukun delete zala tari file parat milte – aani ransomware ne overwrite kela tari.
aws s3api put-bucket-versioning --bucket ravindra-demo-files-pune \
--versioning-configuration Status=Enabled
echo "v1" > note.txt && aws s3 cp note.txt s3://ravindra-demo-files-pune/note.txt
echo "v2" > note.txt && aws s3 cp note.txt s3://ravindra-demo-files-pune/note.txt
aws s3api list-object-versions --bucket ravindra-demo-files-pune --prefix note.txt
aws s3 rm s3://ravindra-demo-files-pune/note.txt # adds a "delete marker" only
# restore: delete the delete marker (use the VersionId shown by list-object-versions)
aws s3api delete-object --bucket ravindra-demo-files-pune --key note.txt --version-id <MarkerVersionId>
| Action with versioning ON | Result |
|---|---|
| Upload same key again | New version; old version kept |
| Delete without version ID | A delete marker hides the object; data still there |
| Delete a specific version ID | That version is gone permanently |
| Suspend versioning | New uploads get no version; old versions remain |
Old versions cost storage, so add a lifecycle rule: for example, move objects under logs/ to Standard-IA after 30 days, and permanently delete non-current versions after 60 days (console: Management → Create lifecycle rule).
{ "Rules": [ {
"ID": "clean-old-versions", "Status": "Enabled", "Filter": { "Prefix": "" },
"NoncurrentVersionExpiration": { "NoncurrentDays": 60 },
"AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
} ] }
aws s3api put-bucket-lifecycle-configuration --bucket ravindra-demo-files-pune \
--lifecycle-configuration file://lifecycle.json
Why this matters for security
Versioning protects integrity (अखंडता) and availability (उपलब्धता): an attacker or a buggy script that overwrites or deletes files cannot destroy the older versions without also having s3:DeleteObjectVersion. For critical backups, companies add MFA Delete or S3 Object Lock so even an administrator cannot erase them quickly.
Ravindra Bagale's Tip
After turning versioning on, students run aws s3 rm and then ask "the file is gone, so versioning doesn't work?" – but it's only hidden by a delete marker. Run list-object-versions and you'll see all the versions there. And don't forget a lifecycle rule – otherwise old versions quietly keep increasing your storage.
Ravindra Bagale's Tip – मराठी
Versioning on केल्यावर students aws s3 rm करून विचारतात "file तर गेली, versioning काम करत नाही" – पण ती फक्त delete marker ने लपलेली असते. list-object-versions चालवा, तिथे सगळे versions दिसतील. आणि lifecycle rule विसरू नका – नाहीतर जुनी versions शांतपणे storage वाढवत राहतात.
Ravindra Bagale's Tip – हिंदी
Versioning on करने के बाद students aws s3 rm करके पूछते हैं "file तो चली गई, versioning काम नहीं करता" – पर वह सिर्फ़ delete marker से छिपी होती है. list-object-versions चलाओ, वहाँ सारे versions दिखेंगे. और lifecycle rule मत भूलना – वरना पुराने versions चुपचाप storage बढ़ाते रहते हैं.
Practice task
Enable versioning, upload three versions of note.txt, delete it, then restore it by removing the delete marker. Add a lifecycle rule that expires non-current versions after 30 days.