Amazon S3 buckets are assessed for MFA Delete status. MFA Delete requires a second factor to permanently delete object versions or change Versioning configuration. The finding highlights buckets where this protection is not enabled.
Risk
Without MFA Delete, a compromised or over-privileged identity can irrevocably purge object history or change versioning.
This erases recovery points, degrading data availability, weakening integrity, and increasing the blast radius of account compromise or ransomware.
prowler aws --checks s3_bucket_no_mfa_delete
Recommendation
Enable MFA Delete on sensitive, versioned buckets so permanent deletions and Versioning changes require a second factor. Apply least privilege to restrict version purge actions, enforce change control, and combine with Object Lock or immutable backups for defense in depth.
Remediation
aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "<MFA_SERIAL_OR_ARN> <MFA_CODE>"
- Sign in to the AWS Management Console as the root user
- Open the account menu > Security credentials > Multi-factor authentication (MFA) and assign an MFA device; copy its ARN/serial
- From a machine configured to use the root user credentials, run:
aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "<MFA_SERIAL_OR_ARN> <MFA_CODE>"
Source Code
Resource Type
AwsS3Bucket