Description:

Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. Amazon S3 provides management features so that you can optimize, organize, and configure access to your data to meet your specific business, organizational, and compliance requirements.

Rationale:

Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.

Impact:

Enables authenticated security to the S3 bucket.

Default value:

MFA delete is disabled by default

Pre-Requisite:

S3 bucket

Remediation:

Test Plan:

  • AWS Console Process

  1. Login to the S3 console at https://console.aws.amazon.com/s3/ 

  2. Click the Check box next to the Bucket name you want to confirm. 

  3. In the window under Properties.  

  4. Check that Versioning and MFA Delete is Enabled. 



Using AWS CLI


The following command retrieves the versioning configuration for a bucket named my-bucket: 

aws s3api get-bucket-versioning --bucket my-bucket

Implementation Plan:

  • AWS Console Process

You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API. -You must use your 'root' account to enable MFA Delete on S3 buckets.

  • Using AWS CLI

Run the s3api put-bucket-versioning command

aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode"

 

Backout Plan:

  • AWS Console Process

You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API. -You must use your 'root' account to disable MFA Delete on S3 buckets.

  • Using AWS CLI

Run the s3api put-bucket-versioning command

aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Diaabled,MFADelete=Disabled --mfa "arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode"

Reference:

What is Amazon S3? - Amazon Simple Storage Service

s3api — AWS CLI 1.27.32 Command Reference (amazon.com)