---
title: S3 bucket is vulnerable to ransomware or deletion via internal access
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 bucket is vulnerable to ransomware
  or deletion via internal access
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# S3 bucket is vulnerable to ransomware or deletion via internal access

## Description{% #description %}

An S3 bucket lacks protective configurations against ransomware or data destruction attacks through internal access. The bucket does not have versioning enabled, Object Lock default retention is not configured, and MFA Delete is not enabled, meaning an attacker who compromises internal IAM credentials with delete permissions can permanently destroy or encrypt bucket contents without the ability to recover previous versions. This attack path enables ransomware-style attacks where data is deleted or overwritten with encrypted versions and held for ransom.

## Remediation{% #remediation %}

1. Enable [S3 versioning](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html) to maintain previous versions of objects, allowing recovery from accidental or malicious deletions.
1. Enable [S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) with default retention to automatically protect new objects from being deleted or overwritten.
1. Enable [MFA Delete](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html) to require multi-factor authentication for permanent deletion of object versions.