All checks
Low
S3 general purpose buckets should have MFA delete enabled
Verifies that MFA delete is enabled for S3 general purpose buckets, requiring multi-factor authentication for object deletion.
- service
- S3
- severity
- Low
- scope
- evaluated once per account
How to fix it
Enable MFA delete on the bucket. There is no console control for it: it takes a CLI or API call made by the account root user with an MFA device to hand, in the same call that enables versioning. It is also mutually exclusive with lifecycle rules, so a bucket cannot satisfy this and S3.13 or S3.10 at once.
With the AWS CLI
aws s3api put-bucket-versioning --bucket <bucket-name> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa '<mfa-serial-number-or-arn> <current-mfa-code>'See which of your accounts this check is failing on.
Book a demo