Configure bucket versioning and tags

Versioning keeps multiple versions of the same key. Bucket tags are key-value pairs attached to the container; they are not automatically inherited by its objects.

Availability and permissions#

Open File > Accounts…, select the account, click Edit…, then open Capabilities > Data protection. Enable Object versions only if the service supports versioning. Read bucket versioning lets you read the bucket’s state; Change bucket versioning separately lets you change it. Read bucket Object Lock, Enable Object Lock on existing buckets, and Change default retention depend on versioning. The API selected under Capabilities > Bucket tags must suit the service: S3 bucket tagging API, S3 Control resource tagging or Unavailable.

These settings grant no permissions to your credentials. On Amazon S3, reading and changing versioning requires s3:GetBucketVersioning and s3:PutBucketVersioning. Object Lock requires s3:GetBucketObjectLockConfiguration and s3:PutBucketObjectLockConfiguration, plus s3:PutBucketVersioning if versioning must be enabled.

With S3 bucket tagging API, reading requires s3:GetBucketTagging; writing and deleting the complete tag set require s3:PutBucketTagging. With S3 Control resource tagging, the permissions are s3:ListTagsForResource, s3:TagResource and s3:UntagResource for general purpose buckets; directory buckets use the same actions with the s3express: prefix.

Versioning / Object Lock applies to one general purpose bucket that has not been added as an external bucket. Tags also requires a single bucket. The S3 tagging API applies to general purpose buckets; S3 Control may also apply to directory buckets, with the appropriate route and resource identity configured.

On Amazon S3, a general purpose bucket with ABAC enabled requires S3 Control resource tagging to change its tags: PutBucketTagging and DeleteBucketTagging can no longer be used. See AWS documentation on ABAC.

See versions and deletion to inspect version history, and Object Lock to protect a version or manage its protection.

Enable or suspend versioning#

Without versioning, overwriting a key replaces its data. With versioning enabled, a write creates a new current version and retains the previous one. Deleting a key generally creates a delete marker, leaving earlier versions stored.

Suspending versioning does not delete existing versions. Subsequent writes use the null version and may replace it. A bucket that has been versioned returns to the suspended state, rather than the never-enabled state.

1. In the S3 pane, select the bucket.
2. Open Properties > Versioning / Object Lock and wait for the settings to load.
3. Select Enable versioning to enable it, or clear the checkbox to suspend it.
4. Click OK.
5. After the operation finishes, reopen the tab to check the state.

With Change bucket versioning enabled but Read bucket versioning disabled, the tab displays Current versioning state: unknown. These account capabilities do not allow reading it. A list replaces the checkbox: Keep unchanged, selected initially, requests no change; Enable versioning requests activation; Suspend versioning requests suspension. Choose an action, then click OK. Without the read capability, this setting does not let you check the resulting state.

When Object Lock is enabled or you are preparing to enable it, Enable versioning remains selected and cannot be cleared; the list used without read support is also disabled. If S3Client cannot verify Object Lock, only suspension is blocked; enabling versioning remains possible. Restore permission to read Object Lock, then reopen the properties to prepare a suspension.

Enable Object Lock and default retention#

Enable Object Lock is permanent: once saved, it cannot be disabled. It also enables versioning and prevents suspension. Default retention applies only to versions created after the setting is saved; it does not protect existing versions retroactively.

Enabling Object Lock on the service also enables versioning. It requires Read bucket Object Lock and Enable Object Lock on existing buckets, but does not require the local Read bucket versioning or Change bucket versioning capabilities. S3Client rereads Object Lock before writing and does not send a separate request to enable versioning. Change default retention is required to set or remove the default rule.

1. In Properties > Versioning / Object Lock, select Enable Object Lock.
2. If needed, select Apply a default retention period to new object versions.
3. Choose Default mode:. Governance can be bypassed with explicit permission; Compliance cannot be shortened or removed before the retention date, even by the account owner.
4. Enter a positive integer in Default duration:, then choose days or years.
5. Click OK and confirm permanent activation if it is new.
6. Reopen the properties to check the configuration.

Without an existing rule, default retention is unchecked and the proposed values are Governance, 1 and days. The mode and duration fields become available when both enabling checkboxes are selected. Default duration: accepts values from 1 to 2,147,483,647; the service may impose a lower limit. This rule does not configure a legal hold.

You can later change or remove default retention without disabling Object Lock. This does not remove protection from existing versions. The configuration is reread before writing. Object Lock configuration changed offers Yes to replace the remote configuration with your values, or No to reload the remote configuration and discard those changes.

Edit bucket tags#

Each key must be nonempty and unique. Keys are case-sensitive: Project and project are different keys. S3Client accepts up to 50 tags; a key can contain up to 128 characters and a value up to 256 characters. Values may be empty. The fields accept Unicode letters and numbers, Unicode separators including spaces, and the characters _ . : / = + - @. The aws: prefix is rejected regardless of case. A diagnostic disables OK in the Tag dialog while the input is invalid.

With S3 Control resource tagging, configure a 12-digit Account ID under File > Accounts… > Edit… > Account, the control route for the bucket’s Region and type under Regions > Edit, and a matching resource ARN. A missing ARN is reconstructed only when Capabilities > General > Standard S3 resource identifiers (ARNs) is enabled. See account connections. A diagnostic in the tab identifies missing information. External buckets cannot be edited through this API. After changing account settings, close and reopen the properties before saving.

With S3 Control resource tagging, an update may require several phases. A completed phase is not rolled back if a later phase fails. The bucket tag update was only partially applied. reports that partial result: inspect the completed and failed phases in the error details, then reread the bucket tags before trying again.

1. In the S3 pane, select a bucket and open Properties > Tags.
2. Wait for the tags to load.
3. Click Add, enter Key and Value, then accept the dialog.
4. Select a tag and click Edit to change it, or Remove to delete it.
5. Click OK. If you removed every tag, confirm complete tag deletion.
6. Reopen Tags to check the result.

Tags are reread before writing. Bucket tags changed means another client changed them: Yes replaces the remote set with your list; No reloads the remote tags. Editing remains blocked if reading fails or the data cannot be rewritten safely.

Read the state without changing it#

Under File > Accounts… > Edit… > Capabilities > Data protection, Read bucket versioning enables state display in bucket properties. Change bucket versioning independently permits changes. Without it, Enable versioning displays the retrieved state but cannot be changed. Object versions enables browsing and working with versions independently of these settings.

A service may enable versioning when it creates a bucket. A checked box does not mean S3Client enabled the feature. The local Object Lock capabilities are sufficient to enable Object Lock, even when that activation must also enable bucket versioning. Your credentials still need the permissions required by the service, including s3:PutBucketVersioning on Amazon S3.