The service always allows a user to delete an object from a bucket given the object key.
Delete Stored Objects
CCC.ObjStor.CP07
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.TH05 | Deleted or Overwritten Object Versions Remain Readable | When versioning is enabled, deleting an object records a delete marker and replacing an object creates a new version, while every prior version remains stored. Data that users consider removed is still retrievable by any identity permitted to read object versions, and continues to incur storage cost. This results in a loss of confidentiality for data that was expected to be purged. |
| CCC.ObjStor.TH08 | Object Immutability is Bypassed or Expires Prematurely | An immutability lock may be applied in a mode that privileged identities can shorten or remove, with a retention period shorter than the record requires, or not applied to objects that require it. Objects intended to be write-once can then be overwritten or deleted. This results in a loss of integrity and availability of records that depend on the lock. |
| CCC.ObjStor.TH09 | Irrevocable Retention Prevents Required Deletion | An irrevocable immutability lock may be applied with an excessive retention period, or to a bucket holding data that is subject to deletion obligations. Neither users nor lifecycle rules can remove the objects until the period expires, and storage cost accrues for the full period. This results in retention of data that should no longer exist, impacting confidentiality and regulatory compliance. |
| CCC.ObjStor.TH10 | Deleted Bucket Names are Reclaimed by Other Tenants | Bucket names are unique across all tenants of the provider (on Azure this applies to the storage account name rather than the container), so when a bucket is deleted its name may be registered by any other tenant. Configuration, code, replication rules, or links that still reference the name then resolve to a bucket under another tenant's control, and data is written to or read from it. This results in a loss of confidentiality, integrity, and availability of the data routed through the reclaimed name. |