How do I retrieve an Amazon S3 object that I deleted in a versioning-enabled general purpose bucket?

Short description

Note: S3 Versioning is available only for general purpose buckets. Directory and table buckets don't support S3 Versioning. 

When you delete an object from a versioning-enabled bucket, Amazon S3 creates a delete marker for the object. The delete marker becomes the current version of the object, and the object becomes the previous version. With a delete marker, Amazon S3 responds to requests for the object as though you deleted the object. For example, if you send a GET request for the object, then Amazon S3 returns an error.

To retrieve an object that you deleted from a version-enabled bucket, take one of the following actions:

• Download the previous version of the object. You must have s3:GetObjectVersion permission.
• Use an AWS account that has the s3:DeleteObjectVersion permission to remove a delete marker. The most recent non-deleted version then becomes the current version of the object so that you can access the previously deleted object in a versioned bucket.
• Note: If you configured multi-factor authentication (MFA) delete on the bucket, then you must use MFA delete to remove the delete marker.

Resolution

Important: You can't recover data that you permanently delete from a bucket.

Use the Amazon S3 console to download the previous version of the object

Complete the following steps:

1. Open the Amazon S3 console.
2. In the navigation pane, choose Buckets, and then select the bucket of the deleted object.
3. To view a list of the object's versions, turn on Show versions.
4. Select the version of your deleted object that you want to retrieve.
5. Choose Actions, and then choose Download.

Use the AWS CLI to download the previous version of the object

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version. In the following commands, replace DOC-EXAMPLE-BUCKET with the name of your bucket.

Complete the following steps:

1. Run the list-object-versions command to list the object versions:

   aws s3api list-object-versions --bucket DOC-EXAMPLE-BUCKET --prefix examplefolder/

   Note: The preceding command includes the --prefix option to filter the results to the specified key name prefix. Use this option to reduce the number of results when your bucket contains many object versions.

2. From the command's output, note the version ID of the object's previous version.

3. Run the get-object command to retrieve the version:

   aws s3api get-object --bucket DOC-EXAMPLE-BUCKET --key example.txt --version-id example.d6tjAKF1iObKbEnNQkIMPjj filename.txt

Use the Amazon S3 console to remove the delete marker

Complete the following steps:

1. From the account that owns the bucket of the deleted object, open the Amazon S3 console.
2. In the navigation pane, choose Buckets, and then select the bucket of the deleted object.
3. To view a list of the object's versions, turn on Show versions.
4. Select the Delete marker of the object.
   Important: Make sure that you select the delete marker and not the object itself. Otherwise, you can't retrieve the object.
5. On the Delete objects page, for Permanently delete objects?, enter permanently delete.
6. Choose Delete.
   Important: You can't use the Amazon S3 console to undelete folders. Instead, you must use the AWS CLI or the AWS SDK.

Use the AWS CLI to remove the delete marker

You can use the AWS CLI to remove the delete marker on several objects, thousands of objects, or millions of objects.

Remove the delete marker on several objects

Complete the following steps:

1. Run the following list-object-versions command with the --query parameter:

   aws s3api list-object-versions --bucket DOC-EXAMPLE-BUCKET --prefix examplefolder/ --query 'DeleteMarkers[*].{Key: Key, VersionId: VersionId}'

   Note: The preceding command includes the --prefix option to filter the results to the specified key name prefix.

2. From the command's output, note the version ID of the delete marker.
   Important: Make sure that you note the version ID of the delete marker. If you delete an object version, then you can't retrieve the object.

3. Run the delete-object command to remove the delete marker:

   aws s3api delete-object --bucket DOC-EXAMPLE-BUCKET --key example.txt --version-id 'example.d6tjAKF1iObKbEnNQkIMPjj'

4. To verify that the delete marker was removed, run the ls command:

   aws s3 ls s3://DOC-EXAMPLE-BUCKET

Remove the delete marker on thousands of objects

Warning: It's a best practice to back up your data before you run the following list-object-versions command. The command uses the s3api delete-object API action to delete the identified delete marker objects. Deletion of objects is a permanent action. Modifications to this command structure can cause unexpected data loss.

Complete the following steps:

1. Open the AWS CloudShell console.
2. Run the list-object-versions command:

   aws s3api list-object-versions --bucket DOC-EXAMPLE-BUCKET --prefix examplefolder/ --output json --query 'DeleteMarkers[?IsLatest==`true`].[Key, VersionId]' | jq -r '.[] | "--key " + "'\\\"'" + .[0] + "'\\\"'" + " --version-id " + .[1]' | xargs -L1 -t aws s3api delete-object --bucket DOC-EXAMPLE-BUCKET

   Note: The preceding command uses the jq tool to parse the ListObjectVersions response for current version DeleteMarkers. By default, jq is installed on AWS CloudShell. If you don't interact with the shell environment, then your shell session ends. For more information about the jq tool, see ./jq on the jq website.

Remove the delete marker on millions of objects

To remove the delete marker on millions of objects in a bucket, use a custom script with the AWS SDK. For more information, expand the Using the AWS SDKs tab.

Note: When you run list-object-versions on a bucket that has millions of objects you might get a timeout.