highAdvancedSymptom-first#cloud storage#versioning#object#recovery#generation

Cloud Storage object deleted/overwritten — recover via versioning

gsutil ls shows the object missing after an accidental delete

Likely source:data-loss

Focused incident mode — strips away everything but this runbook.

Symptoms

  • gsutil ls shows the object missing after an accidental delete
  • A production object was overwritten and the old content is gone
  • gsutil ls -a gs://<BUCKET>/<OBJECT> shows only one generation with no archived copies
  • No data-loss alert fired but an important object changed

Versioning, once enabled, makes recovery a generation-restore operation. If it was never enabled, the object is gone unless you have backups — so enable it before you need it.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Bucket versioning status

    gsutil versioning get gs://<BUCKET>

  • Object generations present

    gsutil ls -a gs://<BUCKET>/<OBJECT>

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • gsutil versioning get returns Suspended
  • Only one generation exists for the object
  • No archived copies are recoverable via the console

Confirm before fixing

gsutil versioning get gs://<BUCKET>
READ

Check the versioning flag

Expected: Suspended

Fix

gsutil versioning set on gs://<BUCKET>
CHANGE

Enable versioning going forward (does not recover the past)

Expected: Enabling versioning for gs://<BUCKET>/...

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
gsutil versioning get gs://<BUCKET>
READ

Check versioning first

2
gsutil ls -a gs://<BUCKET>/<OBJECT>
READ

Find the recoverable generation

3
gsutil cp gs://<BUCKET>/<OBJECT>#<GOOD_GENERATION> gs://<BUCKET>/<OBJECT>
CHANGE

Restore the good generation to the live object name

4
gsutil versioning set on gs://<BUCKET>
CHANGE

Ensure versioning is on for future protection

Prevention

  • Enable versioning on every bucket holding mutable, important data.
  • Add object lifecycle rules that preserve noncurrent versions for a retention window.
  • Use object locks for immutable compliance data.
  • Alert on storage.objects.delete for protected buckets.

Related runbooks

Same stack, same failure family — worth a skim.

Cloud Storage signed URL expired or invalidmedium

Downloads via signed URL fail with 'The given URL is not valid' or 403

Google CloudIntermediate3 causes
Open runbook
Cloud Storage 403 — permission denied on objects or buckethigh

gsutil cp/ls fails with AccessDeniedException: 403

Google CloudFoundation3 causes
Open runbook
GCE persistent disk stuck in DETACHING statehigh

gcloud compute instances describe shows a disk in state DETACHING

Google CloudAdvancedUSE3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.