Cloud Storage buckets used for exporting logs should have object versioning enabled
Checks whether Cloud Storage buckets have `Object Versioning` turned on. Per Prowler, buckets with `Object Versioning` keep prior object generations. Per Trivy, versioning protects against accidental or malicious deletions of stored objects.
Without Object Versioning, deleted or overwritten objects can't be restored, reducing availability and integrity. Compromised credentials or faulty processes can irreversibly delete or corrupt data, enabling ransomware-style destruction, accidental loss, and weakening forensic reconstruction.
What this control checks
Checks whether versioning is turned on for Cloud Storage buckets that receive exported logs
Common pitfalls
Missing versioning block fails the check
KICS flags a google_storage_bucket with versioning enabled = false. A google_storage_bucket with no versioning block is also flagged.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudstorage_bucket_versioning_enabled (prowler gcp --checks cloudstorage_bucket_versioning_enabled); PowerPipe control gcp_compliance.control.storage_bucket_log_object_versioning_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_78; KICS query "Cloud Storage Bucket Versioning Disabled" (e7e961ac-d17e-4413-84bc-8a1fbe242944); Trivy check GCP-0078.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-07 (The risks posed by a supplier, their products and services, and other third parties are understood, recorded...), ID.AM-07 (Inventories of data and corresponding metadata for designated data types are maintained.), PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.) and 6 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained.
- PR.DS-01
- PR.DS-11: Backups of data are created, protected, maintained, and tested.
- PR.IR-02
4 more clauses
- PR.IR-03
- PR.IR-04
- PR.PS-04
- RC.RP-02
- 164.308(a)(7)(ii)(A) Data backup plan
- 164.308(a)(7)(ii)(B) Disaster recovery plan
- 164.312(c)(1) Integrity
- 164.312(e)(2)(i) Integrity controls
- Interview system administrators and examine system configurations and permissions to verify that audit trails are secured so that they cannot be altered
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_bucket_log_object_versioning_enabled - Checkov Check:
CKV_GCP_78 - Powerpipe Control:
gcp_compliance.control.storage_bucket_log_object_versioning_enabled - Prowler Check:
cloudstorage_bucket_versioning_enabled - KICS Query:
e7e961ac-d17e-4413-84bc-8a1fbe242944 - Trivy Check:
GCP-0078
Last reviewed: 2026-10-10