# 2.1.2 Ensure MFA Delete is enabled on S3 buckets

- Source: https://support.icompaas.com/support/solutions/articles/62000233096-2-1-2-ensure-mfa-delete-is-enabled-on-s3-buckets
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 2](https://support.icompaas.com/support/solutions/folders/62000169193)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

Level 2

## Description:

Amazon S3 MFA Delete is a security feature that requires users to provide two forms of authentication when:

-   Deleting an object version from an S3 bucket
    
-   Changing the versioning state of a bucket
    

##  Rationale:

-   Protects against accidental or unauthorized deletions.
    
-   Provides an extra layer of security in case an AWS account or credentials are compromised.
    
-   Prevents attackers from deleting critical data even if they gain IAM user permissions.
    

## Impact:

-   Requires AWS root user credentials to enable.
    
-   Some automation scripts and AWS services may not work if MFA Delete is required.
    
-   Admin overhead: Requires MFA-enabled authentication for deletions.
    

## Default Value:

By default:

-   S3 Versioning is disabled.
    
-   MFA Delete is disabled.
    
-   Deleting objects does not require additional authentication.
    

##  Pre-Requisites:

1.  IAM permissions to modify bucket versioning
    
    -   s3:PutBucketVersioning, s3:GetBucketVersioning
        
2.  AWS CLI installed
    
3.  Root account with an MFA device enabled
    
4.  AWS account ID and root account MFA ARN
    

## Remediation:

### Test Plan:

## Using AWS Console

1.  Login to AWS Console → Open S3 Console.
    
2.  Click on Buckets and select the target bucket.
    

              ![](https://support.icompaas.com/assets/kb/8a8c26944247efec.png)

3.  Click on Properties.
    

            ![](https://support.icompaas.com/assets/kb/5176b744f81f6994.png)

4.  Check the Versioning section:
    
    -   Ensure Versioning is Enabled
        
    -   Ensure MFA Delete is Enabled
        

              ![](https://support.icompaas.com/assets/kb/fae73cc73ccb7fe2.png)

## Using AWS CLI

Step 1: Check Bucket Versioning and MFA Delete Status

aws s3api get-bucket-versioning --bucket <bucket\_name>

Example Output (MFA Delete Enabled)

<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <Status>Enabled</Status>
    <MfaDelete>Enabled</MfaDelete>
</VersioningConfiguration>

Example Output (MFA Delete NOT Enabled)

<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <Status>Enabled</Status>
</VersioningConfiguration>

Implementation Steps:

## Using AWS CLI

Note: MFA Delete cannot be enabled using the AWS Console.

Step 1: Obtain Root MFA ARN

Run the following command to get the MFA device ARN:

aws iam list-mfa-devices --user-name root

Example Output:

{
    "MFADevices": \[
        {
            "SerialNumber": "arn:aws:iam::123456789012:mfa/root-account-mfa-device"
        }
    \]
}

Step 2: Enable MFA Delete on an S3 Bucket

Run the following command as the root user with the MFA token:

aws s3api put-bucket-versioning \\
    --bucket <bucket\_name> \\
    --versioning-configuration Status=Enabled,MFADelete=Enabled \\
    --mfa "arn:aws:iam::123456789012:mfa/root-account-mfa-device <MFA\_Token>"

-   Replace <bucket\_name> with your S3 bucket name.
-   Replace <MFA\_Token> with the current MFA code from your MFA device.
-   Use the root MFA ARN obtained earlier.

## Backout Plan:

If MFA Delete causes operational issues, follow these steps:

Run the disable command:

aws s3api put-bucket-versioning \\
    --bucket <bucket\_name> \\
    --versioning-configuration Status=Enabled \\
    --mfa "arn:aws:iam::123456789012:mfa/root-account-mfa-device <MFA\_Token>"

Verify MFA Delete is disabled:

aws s3api get-bucket-versioning --bucket <bucket\_name>

1.  Output should NOT contain <MfaDelete>Enabled</MfaDelete>.
    
2.  Monitor the bucket for unauthorized deletions.
    

## References:

-   [AWS S3 MFA Delete Documentation](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html)
    
-   [IAM MFA Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)
    
-   [](https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/)[AWS Security Best Practices](https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.