How to enable versioning for an S3 bucket using CloudFormation?

Hi Kazi,

You can enable S3 versioning on a bucket through CloudFormation by using the VersioningConfiguration property with value Enabled on your S3 Bucket resource:

VersioningConfiguration:
  Status: Enabled

After updating your template you can create a CloudFormation changeset to update an existing (deployed) Stack. There are multiple ways to do this, one way is to select your CloudFormations stack from the Console, and in the Stack actions drop down click Create changeset for this current stack. You can then select your updated template, create and then execute your changeset. This will modify existing resources with the new template.

For your IAM policy question, there are number of versioned actions that work both on the Object and Bucket level that I have identified through the IAM console by creating a policy and searching for "Version" in the Actions step. They are:

• s3:DeleteObjectVersion
• s3:GetObjectVersionTagging
• s3:ListBucketVersions
• s3:PutObjectVersionTagging
• s3:DeleteObjectVersionTagging
• s3:GetBucketVersioning
• s3:GetObjectVersionAttributes
• s3:GetObjectVersionTorrent
• s3:PutObjectVersionAcl
• s3:GetObjectVersionAcl
• s3:GetObjectVersionForReplication
• s3:PutBucketVersioning
• s3:GetObjectVersion

It is best practice to only include the actions you need, you can review what each one does from the documentation. To address your error on the other answer, some of these actions apply on an S3 Object, and others on the Bucket level. You can add both to your IAM policy as follows, replace {BUCKET_NAME} with your bucket name:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersionTagging",
                "s3:ListBucketVersions",
                "s3:PutObjectVersionTagging",
                "s3:DeleteObjectVersionTagging",
                "s3:GetBucketVersioning",
                "s3:GetObjectVersionAttributes",
                "s3:GetObjectVersionTorrent",
                "s3:PutObjectVersionAcl",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionForReplication",
                "s3:PutBucketVersioning",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::{BUCKET_NAME}/*",
                "arn:aws:s3:::{BUCKET_NAME}"
            ]
        }
    ]
}

I hope this helps.