Skip to content
CloudAdhar — Building cloud futuresCloudAdharBUILDING CLOUD FUTURESAWS Console
All AWS labs
Storage / HANDS-ON LAB

Recover deleted files with S3 versioning

Build a private document store, reproduce an accidental deletion and restore the original file.

30 minutesBeginnerConsole + sample filesOwn AWS account
THE REAL-WORLD SCENARIO

A business problem worth solving

A small business keeps invoice exports in S3. An automation overwrites yesterday’s export, then a user deletes it. Your job is to demonstrate recovery without opening the bucket to the internet.

What you will build

A recovered invoice file, three retained data versions and an explanation of how delete markers work.

See the architecture before you build

AWS CLOUD Conceptual lab architecture
AWS IAM iconAuthorized operatorAuthenticated console session
Amazon S3 iconPrivate bucketBlock public access + SSE-S3
Amazon S3 iconVersion historyv1 → v2 → delete marker
An IAM-authorized console session uploads objects into one private S3 bucket. Each overwrite creates another version of the same key. A normal deletion adds a delete marker; older versions stay in the same bucket.
Where this fits in production

This is recovery from accidental overwrite or deletion, not an immutable backup. A principal with DeleteObjectVersion can permanently remove versions. For regulated retention evaluate S3 Object Lock; for a separate failure boundary evaluate replication and cross-account backup.

Know why each service belongs

Amazon S3 icon

Amazon S3

Durable object storage for files, application assets and data lakes.

Choose it when: Store objects independently of compute and retain multiple versions.

Consider the tradeoff: Use EBS for a block device or EFS for a shared file system.

AWS service documentation
AWS IAM icon

AWS IAM

Policies and roles control which identities can perform actions on AWS resources.

Choose it when: Grant a workload only the actions and resources it needs using temporary role credentials.

Consider the tradeoff: Use IAM Identity Center for workforce sign-in; avoid embedding long-lived credentials in code.

AWS service documentation

Before you begin

  • An AWS learning account with permission to create/delete buckets, configure versioning, and list/read/write/delete object versions.
  • A text editor and access to the S3 console. Use us-east-1 and a new disposable general purpose bucket.
Cost & account preparation

S3 bills storage and requests, including noncurrent versions. Use the tiny text files below, then empty all versions and delete the bucket. Versioning is not a free backup.

Use a non-production account, sign in through an IAM role rather than root, and review AWS pricing. Budget alerts notify you; they do not automatically cap spending.

Open your AWS Console
01

Create the private document store

  1. Open S3 → Create bucket → General purpose. Select us-east-1 and a unique name such as cloudadhar-recovery-YOUR-SUFFIX.
  2. Keep Object Ownership set to bucket owner enforced, Block all public access enabled, and default SSE-S3 encryption.
  3. Under Bucket Versioning, choose Enable. Create the bucket and verify Properties → Bucket Versioning says Enabled. Wait 15 minutes after initially enabling versioning before the first write.
Checkpoint

The new bucket has versioning enabled and no public access.

02

Write two versions of the same invoice

  1. Save the first sample below as invoice.txt and upload it at the bucket root.
  2. Edit that same local file so total=999, save, and upload to the same bucket root using the exact same filename.
  3. In the bucket Objects tab, turn on Show versions. Compare the version IDs. Download the older version using its version-specific action and inspect it.
Text · invoice.txt
invoice_id=INV-1001
total=149
currency=USD
Checkpoint

Two different version IDs exist for invoice.txt; the older version contains total=149.

03

Reproduce an accidental deletion

  1. Turn OFF Show versions. Select invoice.txt and choose Delete. Confirm deletion of the object (not a specific version).
  2. The default object list is now empty. Turn Show versions back on.
  3. Locate the new delete marker alongside both data versions. Do not permanently delete either data version.
Checkpoint

The key is hidden in the normal listing, but its two data versions and a delete marker still exist.

04

Restore visibility and recover the original content

  1. With Show versions on, select only the delete marker for invoice.txt and permanently delete that marker.
  2. Turn Show versions off and download invoice.txt. It should contain total=999 because removing the marker exposes the latest data version.
  3. Upload the original total=149 file again as invoice.txt. This makes the corrected content current while retaining previous versions. Download the current object to verify.
Checkpoint

The current object contains total=149. Explain why removing the delete marker alone did not restore the first version.

Something not working?

If the object is still absent, inspect its version history for another delete marker. If a specific data version was permanently deleted, versioning cannot recover that version.

05

Record evidence and clean up every version

  1. Record the current content and a screenshot of version history. Never include AWS credentials in your evidence.
  2. Return to the S3 bucket list, select only this disposable lab bucket and choose Empty. Confirm permanent deletion of all objects, versions and delete markers.
  3. Delete the now-empty bucket. Suspending versioning does not delete stored versions or stop their storage charges.
Checkpoint

The bucket is absent from S3 and all lab object versions have been removed.

GO TO THE SOURCE

Official AWS references

Use these service guides and architecture frameworks to go deeper. The diagram above is an original teaching design, not an AWS-certified production blueprint.

AWS: S3 VersioningAWS: Enabling versioningAWS: S3 Object LockAWS reference guidance: Reliability and data backup