Object storage is one of the most popular services in the cloud — often the first thing organizations migrate when moving to the cloud. With data stored in the cloud, security is paramount. Preventing accidental deletion and protecting data is a critical capability. In Amazon S3, you can enable MFA Delete on a bucket to help prevent accidental deletion of bucket contents or the bucket itself.

Overview

MFA (Multi-Factor Authentication) adds an extra layer of protection on top of username and password. AWS supports virtual MFA devices (software apps running on a phone or mobile device that generate a 6-digit time-based one-time password), enhancing account security.

The bucket owner, the AWS account that created the bucket (root account), and all authorized IAM users can enable versioning. However, only the bucket owner (root account) can enable MFA Delete. Note: this feature is not available for root-less accounts in the China region.

Create a Bucket

View Current Bucket Properties

Both versioning and MFA Delete are currently disabled. MFA Delete cannot be configured through the AWS Console — it must be enabled via the CLI or REST API.

Install the AWS CLI

Refer to the installation guide: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html

Enable MFA Delete via CLI

aws s3api put-bucket-versioning --bucket bucketname \
  --versioning-configuration Status=Enabled,MFADelete=Enabled \
  --mfa "arn:aws:iam::xxxxxxxxxxxx:mfa/root-account-mfa-device 123456"

This enables both versioning and MFA Delete protection.

Verify Deletion Protection

To delete a bucket, all objects must be deleted first.

With versioning enabled, deleting an object only adds a delete marker.

Attempting to delete an object version will return an error.

S3 bucket MFA Delete protection is now configured.

Deleting Objects with MFA

To delete an object version, use the CLI with your MFA token:

aws s3api delete-object --bucket my-bucket-name \
  --key my-file-name.jpg \
  --version-id myfileVeRsioNiU8u4DTsqUg9NR_Z_SA \
  --mfa "arn:aws:iam::xxxxxxxxxxxx:mfa/root-account-mfa-device 123456"

References:

• Amazon S3 MFA Delete Documentation
• Managing Versioning Examples

Back to Tech Blog