S3 general purpose buckets with versioning enabled should have Lifecycle configurations

How to fix it

• Can't be undone: Expiring noncurrent versions deletes them permanently, including versions already stored, so settle the period before you create the rule.
• Affects another check: A rule also clears S3.13, and S3.20 no longer reports the bucket; if MFA delete is on, turn it off first, since S3 does not support lifecycle rules alongside it.
• Overwrites existing settings: The CLI and Terraform routes replace the bucket's whole lifecycle configuration, so include the rules it already has, disabled ones too, or they are deleted.

In the console

S3 → the bucket → Management → Create lifecycle rule

Lifecycle rule actions

Permanently delete noncurrent versions of objects

Days after objects become noncurrent

A retention period you can defend, such as 90

With the AWS CLI

aws s3api put-bucket-lifecycle-configuration --bucket <bucket-name> --lifecycle-configuration file://lifecycle.json

With Terraform

resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = var.bucket_name

  rule {
    id     = "expire-noncurrent-versions"
    status = "Enabled"

    noncurrent_version_expiration {
      noncurrent_days = 90
    }
  }
}