14. Amazon S3: Buckets, Objects, Policies and Presigned URLs
14.5 Versioning and Lifecycle Rules
Versioning on kela ki pratyek overwrite aani delete nantar juna version surakshit rahto. Chukun delete zala tari file parat milte – aani ransomware ne overwrite kela tari.
aws s3api put-bucket-versioning --bucket ravindra-demo-files-pune \
--versioning-configuration Status=Enabled
echo "v1" > note.txt && aws s3 cp note.txt s3://ravindra-demo-files-pune/note.txt
echo "v2" > note.txt && aws s3 cp note.txt s3://ravindra-demo-files-pune/note.txt
aws s3api list-object-versions --bucket ravindra-demo-files-pune --prefix note.txt
aws s3 rm s3://ravindra-demo-files-pune/note.txt # adds a "delete marker" only
# restore: delete the delete marker (use the VersionId shown by list-object-versions)
aws s3api delete-object --bucket ravindra-demo-files-pune --key note.txt --version-id <MarkerVersionId>
| Action with versioning ON | Result |
|---|---|
| Upload same key again | New version; old version kept |
| Delete without version ID | A delete marker hides the object; data still there |
| Delete a specific version ID | That version is gone permanently |
| Suspend versioning | New uploads get no version; old versions remain |
Old versions cost storage, so add a lifecycle rule: for example, move objects under logs/ to Standard-IA after 30 days, and permanently delete non-current versions after 60 days (console: Management → Create lifecycle rule).
{ "Rules": [ {
"ID": "clean-old-versions", "Status": "Enabled", "Filter": { "Prefix": "" },
"NoncurrentVersionExpiration": { "NoncurrentDays": 60 },
"AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
} ] }
aws s3api put-bucket-lifecycle-configuration --bucket ravindra-demo-files-pune \
--lifecycle-configuration file://lifecycle.json
Why this matters for security
Versioning protects integrity (अखंडता) and availability (उपलब्धता): an attacker or a buggy script that overwrites or deletes files cannot destroy the older versions without also having s3:DeleteObjectVersion. For critical backups, companies add MFA Delete or S3 Object Lock so even an administrator cannot erase them quickly.
Ravindra Bagale's Tip
Versioning on kelyavar students aws s3 rm karun vicharat "file tar geli, versioning kaam karat nahi" – pan ti fakt delete marker ne lapleli aste. list-object-versions chalva, tithe sagle versions distil. Aani lifecycle rule visaru naka – nahitar juni versions shanti ne storage vadhavat rahtat.
Practice task
Enable versioning, upload three versions of note.txt, delete it, then restore it by removing the delete marker. Add a lifecycle rule that expires non-current versions after 30 days.