Find S3 Buckets Without Versioning Enabled

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBuckets",
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    },
    {
      "Sid": "ReadVersioningState",
      "Effect": "Allow",
      "Action": "s3:GetBucketVersioning",
      "Resource": "arn:aws:s3:::*"
    }
  ]
}

// s3-versioning-report.ts
// Lists every S3 bucket in the account and reports its versioning status:
// "Never enabled", "Suspended" or "Enabled" (plus MFA Delete).
// Read-only. Usage: npx tsx s3-versioning-report.ts [--json]
import {
  S3Client,
  paginateListBuckets,
  GetBucketVersioningCommand,
  type Bucket,
} from "@aws-sdk/client-s3";

type Row = {
  bucket: string;
  region: string;
  versioning: "Never enabled" | "Suspended" | "Enabled" | "Error";
  mfaDelete: string;
  created: string;
  note: string;
};

const clients = new Map<string, S3Client>();
function s3For(region: string): S3Client {
  let client = clients.get(region);
  if (!client) {
    client = new S3Client({ region, followRegionRedirects: true });
    clients.set(region, client);
  }
  return client;
}

async function checkBucket(b: Bucket): Promise<Row> {
  const bucket = b.Name ?? "";
  const region = b.BucketRegion ?? "us-east-1";
  const base = { bucket, region, created: b.CreationDate?.toISOString().slice(0, 10) ?? "" };
  try {
    const res = await s3For(region).send(new GetBucketVersioningCommand({ Bucket: bucket }));
    // Status is absent for buckets that have never had versioning turned on.
    const versioning = res.Status === "Enabled" ? "Enabled" : res.Status === "Suspended" ? "Suspended" : "Never enabled";
    return { ...base, versioning, mfaDelete: res.MFADelete ?? "Disabled", note: "" };
  } catch (err) {
    const name = err instanceof Error ? err.name : String(err);
    return { ...base, versioning: "Error", mfaDelete: "", note: name };
  }
}

async function main(): Promise<void> {
  const asJson = process.argv.includes("--json");
  const listClient = s3For(process.env.AWS_REGION ?? "us-east-1");

  const buckets: Bucket[] = [];
  for await (const page of paginateListBuckets({ client: listClient }, {})) {
    buckets.push(...(page.Buckets ?? []));
  }

  // Check a few buckets at a time to stay well under S3 request rates.
  const rows: Row[] = [];
  for (let i = 0; i < buckets.length; i += 10) {
    rows.push(...(await Promise.all(buckets.slice(i, i + 10).map(checkBucket))));
  }

  const order = { "Never enabled": 0, Suspended: 1, Error: 2, Enabled: 3 } as const;
  rows.sort((a, b) => order[a.versioning] - order[b.versioning] || a.bucket.localeCompare(b.bucket));

  if (asJson) {
    console.log(JSON.stringify(rows, null, 2));
    return;
  }
  console.table(
    rows.map((r) => ({
      Bucket: r.bucket,
      Region: r.region,
      Versioning: r.versioning,
      "MFA Delete": r.mfaDelete,
      Created: r.created,
      Note: r.note,
    })),
  );
  const count = (v: Row["versioning"]) => rows.filter((r) => r.versioning === v).length;
  console.log(
    `${rows.length} buckets: ${count("Never enabled")} never versioned, ${count("Suspended")} suspended, ` +
      `${count("Enabled")} enabled, ${count("Error")} could not be read`,
  );
}

main().catch((err: unknown) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-s3
npm install --save-dev tsx typescript

# Table view
AWS_PROFILE=readonly npx tsx s3-versioning-report.ts

# JSON, filtered to buckets that were never versioned
AWS_PROFILE=readonly npx tsx s3-versioning-report.ts --json \
  | jq -r '.[] | select(.versioning == "Never enabled") | .bucket'

┌─────────┬─────────────────────────┬─────────────┬─────────────────┬────────────┬──────────────┬────────────────┐
│ (index) │ Bucket                  │ Region      │ Versioning      │ MFA Delete │ Created      │ Note           │
├─────────┼─────────────────────────┼─────────────┼─────────────────┼────────────┼──────────────┼────────────────┤
│ 0       │ 'acme-build-artifacts'  │ 'us-east-1' │ 'Never enabled' │ 'Disabled' │ '2023-04-11' │ ''             │
│ 1       │ 'acme-customer-uploads' │ 'eu-west-1' │ 'Never enabled' │ 'Disabled' │ '2024-01-29' │ ''             │
│ 2       │ 'acme-web-logs'         │ 'us-east-1' │ 'Suspended'     │ 'Disabled' │ '2022-08-03' │ ''             │
│ 3       │ 'acme-payroll-exports'  │ 'us-east-1' │ 'Error'         │ ''         │ '2025-06-17' │ 'AccessDenied' │
│ 4       │ 'acme-terraform-state'  │ 'us-east-1' │ 'Enabled'       │ 'Disabled' │ '2022-02-14' │ ''             │
│ 5       │ 'acme-backups-eu'       │ 'eu-west-1' │ 'Enabled'       │ 'Enabled'  │ '2023-11-02' │ ''             │
└─────────┴─────────────────────────┴─────────────┴─────────────────┴────────────┴──────────────┴────────────────┘
6 buckets: 2 never versioned, 1 suspended, 2 enabled, 1 could not be read