S3 MFA Delete

What is MFA Delete?

Amazon S3 MFA (Multi-Factor Authentication) Delete is a security feature for Amazon S3 buckets that adds an extra layer of security to things stored in the bucket. By requesting additional authentication from users in the form of a time-based one-time password (TOTP) when deleting objects from the bucket, it prevents the unintentional deletion of objects.

In circumstances where data loss could be disastrous, such as in a commercial environment, this function is especially helpful. Only objects contained in an Amazon S3 bucket may be deleted using Amazon S3 MFA Delete.

Other operations like uploading, copying, or moving items inside or between buckets are unaffected. One may fine-tune who is permitted to delete objects from the bucket with S3 MFA Delete, which is simple to set up and can be enabled using AWS CLI or Rest APIs.

Authentication Required for MFA Delete

The following must be accessed by the user to enable S3 MFA Delete:

1. AWS root user security credentials, i.e. access key, and secret access key.
2. Authenticated MFA device for the root user.

The MFA code will be used to enable the S3 MFA delete, whereas the AWS security credentials will be used to programmatically access the AWS account using either the AWS CLI or Rest API.

Users must provide additional authentication in the form of the concatenation of a valid serial number, a space, and the six-digit code displayed on an authorized authentication device to use Amazon S3 MFA Delete to delete objects or change the versioning configuration.

Enable MFA on S3 Bucket

AWS S3 MFA Delete can be only configured using the root account credentials on the versioning-enabled S3 bucket. We also need an MFA device serial number for the root account which can be accessed using the Security Credentials tab in the AWS console.

Using AWS CLI

To enable S3 MFA Delete using the AWS CLI, use the following command:

The –mfa flag adds the configuration of the MFA device, which is the serial number and MFA code separated by space.

Using REST API

Using AWS S3 Rest API’s PutBucketVersioning API the S3 MFA Delete can be enabled. We must include the x-amz-mfa request header, the Status, and the MfaDelete request elements in a request to enable S3 MFA Delete.

Disable MFA Delete on S3 Bucket

To enable S3 MFA Delete using the AWS CLI, use the following command:

The –mfa flag adds the configuration of the MFA device, which is the serial number and MFA code separated by space.