11 - Amazon S3 Security

S3 MFA Delete

awss3mfamfa-deleteversioningsecurityroot-accountsaa-c03

Overview

MFA Delete is an extra layer of protection against accidental or malicious permanent deletion of S3 objects. It forces users to provide a multi-factor authentication (MFA) code — generated by a physical hardware device or a virtual MFA app like Google Authenticator — before performing destructive operations on versioned S3 objects.

Think of it as a safety lock on a nuclear button — you can still press the button, but you need a second key to actually trigger the action. This prevents scenarios where a compromised IAM credential could permanently destroy your data.

When is MFA Required?

MFA Delete draws a clear line between dangerous operations (that need MFA) and safe operations (that don't):

Operation MFA Required? Danger Level Explanation
Permanently delete an object version ✅ Yes 🔴 High Removes data forever — no recovery possible
Suspend versioning on the bucket ✅ Yes 🔴 High Stops version protection — future deletes become permanent
Enable versioning ❌ No 🟢 Safe Adds protection — not destructive
List deleted versions ❌ No 🟢 Safe Read-only operation — no data changes
Upload new objects ❌ No 🟢 Safe Creates data — not destructive
Add a delete marker (soft delete) ❌ No 🟡 Low Object versions still exist and can be restored
Delete Marker vs Permanent Delete

This distinction is critical for the exam:

  • A delete marker is a soft delete — it hides the object but all versions still exist underneath. You can restore the object by removing the delete marker.
  • A permanent delete targets a specific version ID and removes it forever. This is what MFA Delete protects against.

What MFA Delete protects

MFA code required Permanently delete an object version (version ID specified) Suspend versioning on the bucket No MFA needed Enable versioning List deleted versions Upload new objects Add a delete marker (soft delete) Only the root account can toggle MFA Delete, via the CLI.
Only destructive operations need the MFA code.

Who Can Enable/Disable MFA Delete?

This is one of the most restrictive settings in S3:

Only the bucket owner (root account) can enable or disable MFA Delete.

  • ❌ IAM admin users cannot toggle MFA Delete
  • ❌ IAM users with s3:* permissions cannot toggle MFA Delete
  • ❌ The AWS Console cannot toggle MFA Delete
  • ✅ Only the root account via the AWS CLI can enable or disable it

This is by design — MFA Delete is meant to be a last line of defense that even compromised admin accounts can't bypass.

┌──────────────────────────────────────────────────────────────┐
│                    MFA DELETE ACCESS CONTROL                   │
│                                                               │
│  Who can ENABLE/DISABLE MFA Delete?                          │
│  ┌────────────────────────────────────────────────────┐      │
│  │  ✅ Root Account (via CLI only)                    │      │
│  │  ❌ IAM Admin Users                                │      │
│  │  ❌ IAM Users with s3:* permissions                │      │
│  │  ❌ AWS Console (no UI option)                     │      │
│  └────────────────────────────────────────────────────┘      │
│                                                               │
│  Who needs MFA to permanently delete?                        │
│  ┌────────────────────────────────────────────────────┐      │
│  │  Everyone — including root, admins, and all users  │      │
│  │  Must provide: MFA device ARN + current MFA code   │      │
│  └────────────────────────────────────────────────────┘      │
└──────────────────────────────────────────────────────────────┘
Root Account Security

Enabling MFA Delete requires creating temporary root account access keys. This is one of the very few legitimate reasons to use root access keys. After enabling MFA Delete, you must immediately deactivate and delete the root access keys. Leaving root access keys active is one of the most dangerous security misconfigurations in AWS.

Prerequisites

Before you can enable MFA Delete, you need:

  1. Versioning must be enabled on the bucket — MFA Delete is a versioning feature
  2. An MFA device configured on the root account — either a virtual MFA (Google Authenticator, Authy) or a hardware MFA device
  3. Root account access keys — created temporarily for this operation, deleted immediately after

Hands-On Walkthrough

Step 1: Create a Bucket with Versioning

  1. Go to S3 Console → Create Bucket
  2. Name it (e.g., demo-mfa-delete-bucket)
  3. Enable Bucket Versioning
  4. Click Create Bucket

Step 2: Verify MFA Delete Status in Console

  1. Go to the bucket → Properties → Bucket Versioning → Edit
  2. You'll see: Multi-Factor Authentication (MFA) Delete: Disabled
  3. Notice: you cannot change this setting from the console — the toggle is grayed out
Console Limitation

The AWS Console shows the MFA Delete status but does not allow you to change it. This is a deliberate design choice — MFA Delete can only be managed via the CLI to add an extra layer of protection.

Step 3: Set Up Root Account CLI Access (Temporary)

  1. Log in as the root account (not an IAM user)
  2. Go to Security Credentials (click your account name → Security Credentials)
  3. Verify that an MFA device is configured — note the MFA device ARN (e.g., arn:aws:iam::123456789012:mfa/root-account-mfa-device)
  4. Create Access Keys for the root account (you'll delete these shortly)
  5. Configure a CLI profile:
aws configure --profile root-mfa-delete-demo
# Enter the root access key ID
# Enter the root secret access key
# Enter your default region (e.g., eu-west-1)
  1. Verify the profile works:
aws s3 ls --profile root-mfa-delete-demo
# Should list your buckets

Step 4: Enable MFA Delete

aws s3api put-bucket-versioning \
  --bucket demo-mfa-delete-bucket \
  --versioning-configuration Status=Enabled,MFADelete=Enabled \
  --mfa "arn:aws:iam::123456789012:mfa/root-account-mfa-device 123456" \
  --profile root-mfa-delete-demo
MFA Code Format

The --mfa parameter takes two values separated by a space:

  1. The MFA device ARN
  2. The current 6-digit MFA code from your authenticator app

The code changes every 30 seconds, so if it fails, wait for a new code and try again.

Toggle MFA Delete with the CLI

aws s3api put-bucket-versioning --bucket demo-mfa-delete-bucket \
  --versioning-configuration Status=Enabled,MFADelete=Enabled \
  --mfa "<mfa-device-arn> <6-digit-code>" --profile root-mfa-delete-demo

--mfa takes the device ARN and the current code separated by a space.

Step 5: Verify in Console

  1. Go back to the bucket → Properties → Bucket Versioning
  2. You should now see: MFA Delete: Enabled ✅

Step 6: Test MFA Delete Protection

Test Result
Upload a new object ✅ Works — no MFA needed
Delete an object (adds delete marker) ✅ Works — soft delete, no MFA needed
Permanently delete a specific version ID ❌ Blocked — "Cannot delete object because MFA Delete is enabled"

Step 7: Disable MFA Delete (When Done)

aws s3api put-bucket-versioning \
  --bucket demo-mfa-delete-bucket \
  --versioning-configuration Status=Enabled,MFADelete=Disabled \
  --mfa "arn:aws:iam::123456789012:mfa/root-account-mfa-device 654321" \
  --profile root-mfa-delete-demo

Step 8: Delete Root Access Keys (Critical!)

  1. Go to Security Credentials in the console
  2. Find the root access keys you created
  3. Deactivate them first, then Delete them
  4. Never leave root access keys active
Delete Root Access Keys Immediately

Root access keys provide unrestricted, unlimited access to your entire AWS account — every service, every resource, every region. A leaked root access key is a catastrophic security incident. Always delete them immediately after use.

Questions & Answers

Q1: What is MFA Delete?

Answer:

An S3 security feature that requires a multi-factor authentication code before performing destructive operations like permanently deleting an object version or suspending versioning on a bucket. It adds a second factor of authentication beyond just IAM credentials.

Q2: What operations require MFA when MFA Delete is enabled?

Answer:

Two operations:

  1. Permanently deleting an object version (specifying a version ID)
  2. Suspending versioning on the bucket

Enabling versioning, listing deleted versions, uploading objects, and adding delete markers do not require MFA.

Q3: Who can enable or disable MFA Delete?

Answer:

Only the root account (bucket owner) via the AWS CLI. IAM users — even those with full S3 admin permissions — cannot enable or disable MFA Delete. The AWS Console also cannot be used for this operation.

Q4: Can you enable MFA Delete from the AWS Console?

Answer:

No. The console shows the MFA Delete status (enabled/disabled) but does not allow changes. You must use the AWS CLI with root account credentials and provide an MFA code.

Q5: What is the prerequisite for enabling MFA Delete?

Answer:

Versioning must be enabled on the bucket. MFA Delete is a versioning-related feature that protects specific object versions from permanent deletion. Without versioning, there are no version IDs to protect.

Q6: Does MFA Delete prevent adding delete markers?

Answer:

No. Adding a delete marker is a soft delete — the object versions still exist underneath and can be restored by removing the delete marker. MFA Delete only protects against permanent deletion of specific object versions (where you specify a version ID).

Q7: Why should you delete root access keys after enabling MFA Delete?

Answer:

Root access keys provide unrestricted access to your entire AWS account — every service, every resource, every region. A compromised root access key is the worst-case security scenario. They should only be created temporarily for operations that require root (like MFA Delete), then immediately deactivated and deleted.

Q8: What happens if a user tries to permanently delete an object version without MFA?

Answer:

The request is denied with an error: "You cannot delete object because Multi-Factor Authentication (MFA) Delete is enabled for this bucket." The user must use the CLI and provide both the MFA device ARN and a current MFA code.

Q9: Can MFA Delete be used with unversioned buckets?

Answer:

No. MFA Delete requires versioning to be enabled. It protects specific object versions from permanent deletion — a concept that only exists in versioned buckets. You must enable versioning first, then enable MFA Delete.

Q10: What is the difference between a delete marker and a permanent delete?

Answer:

A delete marker is a soft delete — it hides the current version of the object but all previous versions still exist. You can "undelete" by removing the delete marker. A permanent delete targets a specific version ID and removes that version forever with no recovery. MFA Delete only protects against permanent deletes, not delete markers.

Check yourself

Quiz

Flashcards

Click the card (or focus it), then use ← → to move and Space to flip.