Identifying Non-Versioned S3 Buckets with Storage Lens

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

B Use Amazon S3 Storage Lens to identify all S3 buckets that are not versioning-enabled across Regions.

Question

A global company runs its workloads on AWS. The company's application uses Amazon S3 buckets across AWS Regions for sensitive data storage and analysis. The company stores millions of objects in multiple S3 buckets daily. The company wants to identify all S3 buckets that are not versioning-enabled. Which solution will meet these requirements?
  1. Set up an AWS CloudTrail event that has a rule to identify all S3 buckets that are not versioning-enabled across Regions.
  2. Use Amazon S3 Storage Lens to identify all S3 buckets that are not versioning-enabled across Regions. Correct Answer
  3. Enable IAM Access Analyzer for S3 to identify all S3 buckets that are not versioning-enabled across Regions.
  4. Create an S3 Multi-Region Access Point to identify all S3 buckets that are not versioning-enabled across Regions.

Key Takeaways

This question tests the ability to use native AWS monitoring tools for security best practices rather than custom logging or access control features.

Amazon S3 Storage Lens provides comprehensive metrics and recommendations, including identifying buckets that are not versioning-enabled across regions.

Common mistake: Candidates often choose CloudTrail (A) because it logs API calls, but CloudTrail does not natively aggregate bucket configuration states like versioning status into a single dashboard view.

Expert Analysis

Why the Answer Is Correct

Amazon S3 Storage Lens is an AWS service that collects usage metrics and activity data for Amazon S3 buckets. It provides actionable insights and recommendations to optimize storage costs and improve data protection. Specifically, Storage Lens includes metrics such as "Versioning-enabled bucket count" and can identify buckets that aren't following data-protection best practices, such as using S3 Versioning or replication. This makes it the ideal tool for the company's requirement to identify non-versioned buckets across multiple regions.

Why the Other Options Are Wrong

Option A is incorrect because while AWS CloudTrail logs API activity, it does not provide a built-in metric or dashboard feature to specifically identify buckets based on their versioning configuration status. Option C is incorrect because IAM Access Analyzer for S3 focuses on identifying public access or cross-account access risks, not bucket configuration compliance like versioning. Option D is incorrect because S3 Multi-Region Access Points are designed to create a single access point for buckets in different regions, facilitating global data access, not for auditing or identifying bucket configurations.

Community Comment Notes

The community consensus strongly supports option B. As user Scheldon noted, "AnswerB S3 Sorage Lens 'can also identify buckets that aren't following data-protection best practices, such as using S3 Replication or S3 Versioning.'" Another user, sandordini, confirmed that you can use the "Versioning-enabled bucket count metric" to see which buckets use S3 Versioning and take action accordingly. The comments highlight that Storage Lens is the standard solution for this specific operational visibility task.

Official Reference

https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens_basics_metrics_recommendations.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about identifying bucket configurations or best practice compliance across multiple accounts or regions, prioritize S3 Storage Lens over custom CloudWatch alarms or CloudTrail queries due to its pre-built metrics and recommendation engine.

Frequently Asked Questions

Why not use CloudTrail to find non-versioned buckets?

CloudTrail logs API calls but doesn't natively aggregate bucket configuration states like versioning status into a dashboard for easy identification.

Does Storage Lens cover all AWS regions?

Yes, S3 Storage Lens can collect metrics across multiple AWS regions and accounts if configured to do so, making it suitable for global companies.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Scheldon 👍 3 Answered B
    AnswerB S3 Sorage Lens "can also identify buckets that aren't following data-protection best practices, such as using S3 Replication or S3 Versioning. " https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens_basics_metrics_recommendations.html
  2. sandordini 👍 2 Answered B
    You can use the Versioning-enabled bucket count metric to see which buckets use S3 Versioning. Then, you can take action in the S3 console to enable S3 Versioning for other buckets.
  3. mk168898 👍 1
    sotrage lens used to identify non versioning

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide