# Versioning & Encryption

Aurora’s S3-compatible storage supports bucket versioning and server-side encryption to protect data at rest and simplify recovery from accidental changes or malicious deletions.

## Versioning

- When versioning is enabled on a bucket, every write produces an immutable version.
- Overwriting a key creates a new version; the previous versions remain retrievable.
- Deleting without a version ID creates a delete marker instead of removing prior versions.
- Combining versioning with Object Lock provides strong immutability guarantees.

### Enable versioning

Versioning can only be enabled during bucket creation in the Dashboard UI. It cannot be enabled later via CLI or API.

> Available S3 endpoint: `a-s3.aur.lu` (France, Albi).

```bash
# View versioning state
aws --profile aurora --endpoint-url https://a-s3.aur.lu s3api get-bucket-versioning \
  --bucket my-bucket
```

### Work with object versions

```bash
# Upload creates the first version
aws --profile aurora --endpoint-url https://a-s3.aur.lu s3 cp file.txt s3://my-bucket/file.txt

# List versions
aws --profile aurora --endpoint-url https://a-s3.aur.lu s3api list-object-versions \
  --bucket my-bucket \
  --prefix file.txt

# Download a specific version
aws --profile aurora --endpoint-url https://a-s3.aur.lu s3api get-object \
  --bucket my-bucket \
  --key file.txt \
  --version-id <VERSION_ID> ./file.txt

# Delete a specific version (irreversible)
aws --profile aurora --endpoint-url https://a-s3.aur.lu s3api delete-object \
  --bucket my-bucket \
  --key file.txt \
  --version-id <VERSION_ID>
```

## Server-side encryption (SSE)

- Encryption at rest is enabled by default when creating a bucket in the Dashboard UI.
- Encryption is chosen at bucket creation and cannot be changed afterwards.
- Disabling encryption requires a per-bucket confirmation in the Dashboard UI that the bucket will not contain personal data or confidential or regulated data.
- It cannot be configured or changed via CLI or API.

### Notes

- If encryption is disabled, bucket contents are publicly retrievable from the Filecoin network.
- For customer-managed keys (KMS integration), contact Aurora support.
- Object Lock retention applies to encrypted and non-encrypted objects alike.