Project: KICS (Provisioning / Security & Compliance)
File: a227ec01-f97a-4084-91a4-47b350c1db54.md

title: S3 Bucket Without Versioning hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a227ec01-f97a-4084-91a4-47b350c1db54 Query name: S3 Bucket Without Versioning Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Backup URL: S3 bucket should have versioning enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" Resources: RecordServiceS3Bucket: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: ReplicationConfiguration: Role: 'Fn::GetAtt': WorkItemBucketBackupRole Arn Rules: Destination: Bucket: 'Fn::Join': '' - 'arn:aws:s3:::' 'Fn::Join': '-' - Ref: 'AWS::Region' Ref: 'AWS::StackName' replicationbucket StorageClass: STANDARD Id: Backup Prefix: '' Status: Enabled ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="27" Resources: RecordServiceS3Bucket2: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: ReplicationConfiguration: Role: 'Fn::GetAtt': WorkItemBucketBackupRole Arn Rules: Destination: Bucket: 'Fn::Join': '' - 'arn:aws:s3:::' 'Fn::Join': '-' - Ref: 'AWS::Region' Ref: 'AWS::StackName' replicationbucket StorageClass: STANDARD Id: Backup Prefix: '' Status: Enabled VersioningConfiguration: Status: Suspended ``` ```json title="Positive test num. 3 - json file" hl_lines="4" { "Resources": { "RecordServiceS3Bucket": { "Properties": { "ReplicationConfiguration": { "Role": { "Fn::GetAtt": [ "WorkItemBucketBackupRole", "Arn" ] }, "Rules": [ { "Id": "Backup", "Prefix": "", "Status": "Enabled", "Destination": { "Bucket": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::Join": [ "-", [ { "Ref": "AWS::Region" }, { "Ref": "AWS::StackName" }, "replicationbucket" ] ] } ] ] }, "StorageClass": "STANDARD" } } ] } }, "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain" } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="48" { "Resources": { "RecordServiceS3Bucket2": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "ReplicationConfiguration": { "Rules": [ { "Destination": { "Bucket": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::Join": [ "-", [ { "Ref": "AWS::Region" }, { "Ref": "AWS::StackName" }, "replicationbucket" ] ] } ] ] }, "StorageClass": "STANDARD" }, "Id": "Backup", "Prefix": "", "Status": "Enabled" } ], "Role": { "Fn::GetAtt": [ "WorkItemBucketBackupRole", "Arn" ] } }, "VersioningConfiguration": { "Status": "Suspended" } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: RecordServiceS3Bucket: Type: 'AWS::S3::Bucket' DeletionPolicy: Retain Properties: ReplicationConfiguration: Role: 'Fn::GetAtt': WorkItemBucketBackupRole Arn Rules: Destination: Bucket: 'Fn::Join': '' - 'arn:aws:s3:::' 'Fn::Join': '-' - Ref: 'AWS::Region' Ref: 'AWS::StackName' replicationbucket StorageClass: STANDARD Id: Backup Prefix: '' Status: Enabled VersioningConfiguration: Status: Enabled ``` ```json title="Negative test num. 2 - json file" { "Resources": { "RecordServiceS3Bucket": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "ReplicationConfiguration": { "Rules": [ { "Id": "Backup", "Prefix": "", "Status": "Enabled", "Destination": { "Bucket": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::Join": [ "-", [ { "Ref": "AWS::Region" }, { "Ref": "AWS::StackName" }, "replicationbucket" ] ] } ] ] }, "StorageClass": "STANDARD" } } ], "Role": { "Fn::GetAtt": [ "WorkItemBucketBackupRole", "Arn" ] } }, "VersioningConfiguration": { "Status": "Enabled" } } } } } ```