Check ID: s3_bucket_no_mfa_delete
Provider: AWS
Service: s3
Severity: MEDIUM
Categories: identity-access
Resource type: AwsS3Bucket

​
What this check verifies

Amazon S3 buckets are assessed for MFA Delete status. MFA Delete requires a second factor to permanently delete object versions or change Versioning configuration. The finding highlights buckets where this protection is not enabled.

​
Risk

Without MFA Delete, a compromised or over-privileged identity can irrevocably purge object history or change versioning. This erases recovery points, degrading data availability, weakening integrity, and increasing the blast radius of account compromise or ransomware.

​
Recommendation

Enable MFA Delete on sensitive, versioned buckets so permanent deletions and Versioning changes require a second factor. Apply least privilege to restrict version purge actions, enforce change control, and combine with Object Lock or immutable backups for defense in depth.

​
Remediation

aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "<MFA_SERIAL_OR_ARN> <MFA_CODE>"

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_no_mfa_delete. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks