How to enable MFA Delete on S3 bucket

Introduction

Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.

Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication. check-bucket-versioning-status account to enable MFA Delete on S3 buckets.

Steps to enable MFA delete on S3 bucket using CLI

List the AWS S3 buckets of the account
```
aws s3 ls
```
Run the get-bucket-versioning. If no versioning is enabled, then it will return nothing.
```
aws s3api get-bucket-versioning --bucket <bucket_name>
```

Run the s3api put-bucket-versioning command as to enable versioning with MFA delete feature on bucket. You can’t enable MFA delete feature on a bucket which isn’t versioned.

aws s3api put-bucket-versioning --profile <profile_name> --bucket <bucket_name> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa “arn:aws:iam::<aws_account_id>:mfa/<root_account_mfa_device> <passcode>”

put bucket versioning

Run the get-bucket-versioning to check if mfa is enabled or not
```
aws s3api get-bucket-versioning --bucket <bucket_name>
```

Riyaz Walikar

Founder & Chief of R&D

Riyaz is the founder and Chief of R&D at Kloudle, where he hunts for cloud misconfigurations so developers don’t have to. With over 15 years of experience breaking into systems, he’s led offensive security at PwC and product security across APAC for Citrix. Riyaz created the Kubernetes security testing methodology at Appsecco, blending frameworks like MITRE ATT&CK, OWASP, and PTES. He’s passionate about teaching people how to hack—and how to stay secure.

•• See all posts

Riyaz Walikar

Founder & Chief of R&D

•• See all posts

← Back to Academy