Enable S3 MFA delete using AWS CLI - A SIMPLE GUIDE

S3 MFA delete adds another layer of security as you can't delete files unless you have the MFA device authentication code.

first you need to register MFA device with your account, check the following link to do so:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html

In your S3 bucket properties, bucket versioning click edit

Note that you cant enable MFA delete, it can only be enabled using AWS CLI, AWS SDk or S3 REST API.

if you need to install AWS CLI check the following link :
https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html

to use AWS CLI you need to create an access key, click on your account name in the top right and then security credentials

*copy the MFA device identifier as we will use it later.

in Access Keys click Create access key.

mark " I understand that creating a root access key is not a best practice " and click Create access key

download the csv file that contains the access key and secret access key, if you don't you will have to create another access key as you can't retrieve the secret access key later.

open the cli and configure AWS cli using the "aws configure" command. Enter the access key, secret access key, default region and default output format.

check if AWS cli is working, use command "aws s3 ls" to show your S3 buckets.

enable MFA delete using the following command:
aws s3api put-bucket-versioning --bucket bucket-name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "MFA-device-identifier mfa-code".
Replace the underlined text with its appropriate value.

check your S3 bucket properties to confirm MFA delete is enabled.

If you delete an object without showing versions a delete marker will be added to this object, but it will not be permanently deleted. you have to show versions and choose the version you want to delete.

If you try to permanently delete an object version, you will get an error.

Trying from cli have the same result

To delete a file you need to add the MFA device ID and code, if you delete an object with a delete marker it will be shown in the result.

Deleting object with delete marker.

Deleting object with no delete marker.

To disable MFA delete use the same command as enabling it and replace " MFADelete=Enabled " with " MFADelete=Disabled " .

After disabling MFA delete don't forget to delete your access key.
you have to deactivate the access key first then delete it.

Comments

[Waleed Elginady]

Good Job

[Ahmed Attia]

Thank you for sharing your expertise

[疏影]

MFA delete is a good belt-and-suspenders control for buckets where accidental deletes are expensive. The Windows-side gap that often gets missed: once MFA delete is on, 'how do my non-engineer users actually click files in Explorer without bypassing that control?' Two patterns that keep the security story intact:

• Mount the bucket as a drive letter on Windows — but only after the IAM policy + bucket policy are scoped down to the mount client's IAM role. ScsDriver handles S3-compatible alongside SMB / SFTP / WebDAV so the same mount table also carries any other backend the company standardized on. Auto-reconnect across sleep / VPN / 网卡切换 means the per-user drive letter sticks across a normal workday without the user having to reauthenticate every time.
• Pair MFA delete with bucket versioning (the other control that makes deletes recoverable). The mount client sees the current version; admins can still walk back to a previous version via the S3 console if something goes wrong.

Operational notes for MFA delete on small-team buckets:

• Versioning is required to enable MFA delete — make sure that change is the first step in your runbook.
• For SMB targets, mind the 'multiple connections to server' default on Windows; using distinct service accounts per destination side-steps it.
• For long-term cold data, archive tier is great; restore SLA should be picked before cost is — archive tier restore hours are the most common surprise. Good walkthrough.