When versioning is enabled, deleting an object records a delete marker and replacing an object creates a new version, while every prior version remains stored. Data that users consider removed is still retrievable by any identity permitted to read object versions, and continues to incur storage cost. This results in a loss of confidentiality for data that was expected to be purged.
Deleted or Overwritten Object Versions Remain Readable
CCC.ObjStor.TH05
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.CP06 | Replace Stored Objects | The service always allows a user to replace an object in a bucket by writing a new object to the same key, overwriting the previous content unless versioning retains it. |
| CCC.ObjStor.CP07 | Delete Stored Objects | The service always allows a user to delete an object from a bucket given the object key. |
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.CN11 | Expire Noncurrent Object Versions | Ensure that superseded and deleted object versions are permanently removed after a bounded period, so that data users consider removed does not remain readable indefinitely. |