3.3.4. Versioning: S3 Object Versioning and FSx
💡 First Principle: Versioning is the simplest form of point-in-time recovery for file and object data. Every write creates a new version; every delete is a "delete marker" that hides the object without destroying it. This means no accidental deletion is truly permanent — you can always restore a previous version.
S3 Versioning:
Once enabled on a bucket, S3 preserves every version of every object. Key behaviors:
- PUT creates a new version with a unique version ID
- DELETE adds a delete marker (the object appears deleted but isn't gone)
- Restore: delete the delete marker to restore the previous version
- Permanently delete: specify the version ID
S3 Versioning cannot be disabled once enabled — only suspended. Suspension prevents new versions from being created but preserves existing versions.
S3 Replication (Cross-Region or Same-Region) requires versioning on both the source and destination buckets and an IAM role that S3 assumes to read source objects and replicate them. Only new objects are replicated; use S3 Batch Replication for objects that already exist.
S3 MFA Delete: Adds a second factor requirement for:
- Changing versioning state of a bucket
- Permanently deleting a specific object version
MFA Delete requires the root account's MFA device and the MFA token. Only the bucket owner's root user can enable or disable it, and only through the AWS CLI, SDKs or REST API, not the S3 console. This protects against accidental or malicious permanent deletion by compromised IAM credentials.
S3 Object Lock: WORM protection at the object level (works only with versioning enabled):
| Mode | Can Overwrites Be Prevented? | Who Can Unlock? |
|---|---|---|
| Governance | ✅ Yes (requires special permission to override) | Users with s3:BypassGovernanceRetention permission |
| Compliance | ✅ Yes (cannot be overridden — not even root) | Nobody during retention period |
| Legal Hold | ✅ Yes | Any user with s3:PutObjectLegalHold permission |
Use compliance mode for regulatory requirements (SEC, FINRA, HIPAA). Use governance mode when you need override capability for legitimate business purposes.
FSx Backup and Versioning:
- FSx for Windows: Automatic daily backups, manual backups, shadow copies (Windows VSS-based point-in-time snapshots accessible from within the OS)
- FSx for Lustre: Backups can be taken manually or automatically; data can be linked to S3 so files are lazily loaded from S3 and writes can be exported back to S3
⚠️ Exam Trap: S3 Versioning significantly increases storage costs — every version of every object is billed. A 1GB object modified 10 times becomes 10GB billed. Use S3 Lifecycle policies to transition or expire old versions. A common pattern: keep current version in S3 Standard, move versions older than 30 days to S3 Glacier, delete versions older than 1 year. Lifecycle Expiration permanently deletes objects in a non-versioned bucket, but in a versioned bucket it only adds delete markers to current versions; space is reclaimed by NoncurrentVersionExpiration (optionally keeping a set number of versions), and a separate setting removes expired object delete markers.
Reflection Question: A compliance regulation requires that financial records stored in S3 cannot be modified or deleted for 7 years. What combination of S3 features do you enable, and what governance mode choice do you make?
