S3 Bucket Versioning is kind of like a version control system such as Git or Subversion, allowing you to keep multiple version of objects in an S3 Bucket. For example, let's say you add foo.txt to your S3 Bucket. This will be version 1. Then you update foo.txt and re-add it to your S3 Bucket. This will be version 2.

By default, S3 Bucket Versioning is disabled.

And objects in the bucket will have something like this.

Let's enable S3 Bucket Versioning.

And objects in the bucket before you enabled will have null for the versioning.

After adding a new object (file) to the bucket, versioning should have something like this. Notice iDiTq7DSitz0gKIFgYoquloPHFPlcPdJ is the current version of the object (file).

Let's update the object (file) and upload it to the Bucket again. Now the object has a new version (y8FEbLKsj4z2Kk_1Ru.EfkdRiMdtdIMH in this example).

Let's say you then download the file from the bucket using the aws s3api get-object command. If the --version option is not used, the current version of the object will be downloaded. Notice in this example that the output has VersionId y8FEbLKsj4z2Kk_1Ru.EfkdRiMdtdIMH, which is the current version of the file.

~]# aws s3api get-object --bucket my-bucket-abc123 --key bar.txt bar.txt
{
    "AcceptRanges": "bytes",
    "LastModified": "2024-04-16T01:32:17+00:00",
    "ContentLength": 17,
    "ETag": "\"e65c918c98865ac528e2f2d0df0d8918\"",
    "VersionId": "y8FEbLKsj4z2Kk_1Ru.EfkdRiMdtdIMH",
    "ContentType": "text/plain",
    "ServerSideEncryption": "AES256",
    "Metadata": {}
}

Or, the --version-id option can be used to download a specific version of the object.

~]$ aws s3api get-object --bucket my-bucket-abc123 --key bar.txt bar.txt --version-id iDiTq7DSitz0gKIFgYoquloPHFPlcPdJ
{
    "AcceptRanges": "bytes",
    "LastModified": "2024-04-16T01:29:36+00:00",
    "ContentLength": 15,
    "ETag": "\"1f0f0df3b16f202e5b1c35132848d3e2\"",
    "VersionId": "iDiTq7DSitz0gKIFgYoquloPHFPlcPdJ",
    "ContentType": "text/plain",
    "ServerSideEncryption": "AES256",
    "Metadata": {}
}

By default, deleting specific versions of an object is allowed without Multi Factor Authentication (MFA). In this example, the aws s3api delete-object command successfully deleted the object without Multi Factor Authentication (MFA).

~]$ aws s3api delete-object --bucket my-bucket-abc123 --key bar.txt --version-id iDiTq7DSitz0gKIFgYoquloPHFPlcPdJ
{
    "VersionId": "iDiTq7DSitz0gKIFgYoquloPHFPlcPdJ"
}