All checks
Low
S3 general purpose buckets should have MFA delete enabled
Checks that MFA delete is enabled on the S3 general purpose bucket, so permanently deleting an object version or changing versioning needs a code from the root user's MFA device. Buckets with a lifecycle configuration are not reported, since S3 does not support both. Only the root user can enable it, through the CLI or API; the console cannot.
- service
- S3
- severity
- Low
- scope
- evaluated once per account
How to fix it
- Affects another check: The call also clears S3.14 and brings the bucket into S3.10, and with MFA delete on it cannot take the lifecycle rule S3.10 and S3.13 ask for, so both keep failing.
- Can break clients: Permanently deleting an object version then needs the root user's MFA code, so automation that deletes versions stops working.
Settings
- VersioningConfiguration.
MFADelete - Enabled
- VersioningConfiguration.
Status - Enabled, in the same call: MFA delete works only on a versioned bucket
- MFA
- Serial number or ARN of the root user's MFA device, a space, then its current code
With the AWS CLI
aws s3api put-bucket-versioning --bucket <bucket-name> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa '<mfa-serial-number-or-arn> <current-mfa-code>'See which of your accounts this check is failing on.
Book a live scan