Skip to main content


Enable Multi-Factor Authentication (MFA) Delete on S3 buckets (Automated)

Profile Applicability

• Level 1


After enabling MFA Delete on your sensitive and classified S3 bucket the user must have two forms of authentication.


Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.


Perform the steps below to confirm MFA delete is configured on an S3 Bucket

From Console

  1. Login to the S3 console at

  2. Click the Check box next to the Bucket name you want to confirm

  3. In the window under Properties

  4. Confirm that Versioning is Enabled

  5. Confirm that MFA Delete is Enabled

From Command Line

  1. Run the get-bucket-versioning
aws s3api get-bucket-versioning --bucket my-bucket

Output example:

<VersioningConfiguration xmlns=""> 

If the Console or the CLI output does not show Versioning and MFA Delete enabled refer to the remediation below.


Perform the steps below to enable MFA delete on an S3 bucket.

  • You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.
  • You must use your 'root' account to enable MFA Delete on S3 buckets.

From Command line

  1. Run the s3api put-bucket-versioning command:
aws s3api put-bucket-versioning --profile root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode"

You can utilize Lacework's remediation template to resolve violations of this policy. See Remediation Templates.