Skip to main content

Versioning & Encryption

Aurora’s S3-compatible storage supports bucket versioning and server-side encryption to protect data at rest and simplify recovery from accidental changes or malicious deletions.

Versioning​

  • When versioning is enabled on a bucket, every write produces an immutable version.
  • Overwriting a key creates a new version; the previous versions remain retrievable.
  • Deleting without a version ID creates a delete marker instead of removing prior versions.
  • Combining versioning with Object Lock provides strong immutability guarantees.

Enable versioning​

Versioning can only be enabled during bucket creation in the Dashboard UI. It cannot be enabled later via CLI or API.

Select S3 Endpoint
Choose preferred region.
# View versioning state
aws --profile aurora --endpoint-url https:// s3api get-bucket-versioning \
--bucket my-bucket

Work with object versions​

# Upload creates the first version
aws --profile aurora --endpoint-url https:// s3 cp file.txt s3://my-bucket/file.txt

# List versions
aws --profile aurora --endpoint-url https:// s3api list-object-versions \
--bucket my-bucket \
--prefix file.txt

# Download a specific version
aws --profile aurora --endpoint-url https:// s3api get-object \
--bucket my-bucket \
--key file.txt \
--version-id <VERSION_ID> ./file.txt

# Delete a specific version (irreversible)
aws --profile aurora --endpoint-url https:// s3api delete-object \
--bucket my-bucket \
--key file.txt \
--version-id <VERSION_ID>

Server-side encryption (SSE)​

  • Encryption at rest is enabled by default when creating a bucket in the Dashboard UI.
  • Encryption is chosen at bucket creation and cannot be changed afterwards.
  • Disabling encryption requires a per-bucket confirmation in the Dashboard UI that the bucket will not contain personal data or confidential or regulated data.
  • It cannot be configured or changed via CLI or API.

Notes​

  • If encryption is disabled, bucket contents are publicly retrievable from the Filecoin network.
  • For customer-managed keys (KMS integration), contact Aurora support.
  • Object Lock retention applies to encrypted and non-encrypted objects alike.