Production S3 bucket has versioning disabled

What's the problem

Overwritten or deleted objects cannot be restored to a previous version

How 6WAF detects it

• Only resources tagged Environment=production or prod are evaluated. Untagged resources are reported as not evaluated, never as passing.
• Severity follows the matching AWS Security Hub control (shown under Reference standard); where no control exists it is labelled as a 6WAF classification.
• Scanning uses an IAM Role you deploy yourself via CloudFormation; AccessDenied or throttling is recorded as not checked and never produces a finding.