kodekloud-engineer/terraform/task-28.md

Assignment

Data protection and recovery are fundamental aspects of data management. It's essential to have systems in place to ensure that data can be recovered in case of accidental deletion or corruption. The DevOps team has received a requirement for implementing such measures for one of the S3 buckets they are managing.

The S3 bucket name is xfusion-s3-1124, enable versioning for this bucket using Terraform.

The Terraform working directory is /home/bob/terraform. Update the main.tf file (do not create a different .tf file) to accomplish this task.

Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

Solution

Enable S3 Versioning — xfusion-s3-1124

The bucket (aws_s3_bucket.s3_ran_bucket) already exists in this main.tf. Enabling versioning in modern AWS provider versions is done with a separate aws_s3_bucket_versioning resource, not an inline versioning {} block.

main.tf (append this block; leave the existing bucket unchanged)

resource "aws_s3_bucket" "s3_ran_bucket" {
  bucket = "xfusion-s3-1124"
  acl    = "private"

  tags = {
    Name = "xfusion-s3-1124"
  }
}

# Enable versioning on the bucket
resource "aws_s3_bucket_versioning" "s3_ran_bucket" {
  bucket = aws_s3_bucket.s3_ran_bucket.id

  versioning_configuration {
    status = "Enabled"
  }
}

How to run

cd /home/bob/terraform
terraform plan     # should show only the new aws_s3_bucket_versioning to add
terraform apply -auto-approve

How it works

aws_s3_bucket_versioning

Since AWS provider v4, S3 sub-configurations (versioning, ACL, logging, lifecycle, encryption, etc.) were split out of the aws_s3_bucket resource into dedicated resources. Versioning is now its own resource:

• bucket = aws_s3_bucket.s3_ran_bucket.id — targets the existing bucket by reference. Using the attribute (not the hardcoded name) creates an implicit dependency, so Terraform manages the bucket first, then the versioning config, and the plan shows only the new resource being added.
• versioning_configuration { status = "Enabled" } — turns on versioning. Valid states are Enabled, Suspended, and Disabled (only meaningful on create). Enabled means every overwrite or delete keeps prior object versions, which is exactly the accidental-deletion/corruption protection the task calls for.

Note on the existing inline acl

The existing bucket block sets acl = "private" inline. That inline argument is deprecated in current provider versions (the modern equivalent is a separate aws_s3_bucket_acl resource), but it still functions and — importantly — it's a different concern from versioning. Adding aws_s3_bucket_versioning does not conflict with the inline acl. Conflicts only arise if you configure the same concern two ways (e.g. an inline versioning {} block and a standalone aws_s3_bucket_versioning resource on the same bucket). Leave the acl line as-is — the task only asks for versioning.

How versioning behaves once enabled

• New writes to existing keys create new versions; the old bytes are retained under a prior version ID.
• Deletes place a delete marker rather than removing data, so objects can be recovered.
• Versioning, once enabled, can only be suspended, never fully turned off — that's by design in S3.

Verify

aws s3api get-bucket-versioning --bucket xfusion-s3-1124 \
  --query 'Status'

Expected — "Enabled".