Project: KICS (Provisioning / Security & Compliance)
File: c5b31ab9-0f26-4a49-b8aa-4cc064392f4d.md

title: S3 Bucket Without Enabled MFA Delete hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c5b31ab9-0f26-4a49-b8aa-4cc064392f4d Query name: S3 Bucket Without Enabled MFA Delete Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: S3 bucket without MFA Delete Enabled. MFA delete cannot be enabled through Terraform, it can be done by adding a MFA device (https://docs.aws.amazon.com/IAM/latest/UserGuide/idcredentialsmfaenable.html) and enabling versioning and MFA delete by using AWS CLI: 'aws s3api put-bucket-versioning --versioning-configuration=Status=Enabled,MFADelete=Enabled --bucket=<BUCKETNAME> --mfa=<MFASERIALNUMBER>'. Please, also notice that MFA delete can not be used with lifecycle configurations<br> ```tf title="Positive test num. 1 - tf file" hl_lines="14" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive1" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="27" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "bbb" { bucket = "my-tf-test-bucket" tags = { Name = "My bucket" Environment = "Dev" } } resource "awss3bucket_versioning" "example" { bucket = awss3bucket.bbb.id versioning_configuration { status = "Disabled" mfa_delete = "Enabled" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="23" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive2" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = true } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="25" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive3" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = true mfa_delete = false } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="24 23" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "positive3" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = false } } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="1" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" } ``` </details> <details><summary>Positive test

7 - tf file</summary> ```tf hl_lines="8" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning { enabled = true } } ``` </details> <details><summary>Positive test num. 8 - tf file</summary> ```tf hl_lines="10" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning { enabled = true mfa_delete = false } } ``` </details> <details><summary>Positive test num. 9 - tf file</summary> ```tf hl_lines="8 9" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning { enabled = false } } ``` </details> <details><summary>Positive test num. 10 - tf file</summary> ```tf hl_lines="28" terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "b0" { bucket = "my-tf-test-bucket" tags = { Name = "My bucket" Environment = "Dev" } } resource "awss3bucket_versioning" "example2" { bucket = awss3bucket.b0.id versioning_configuration { status = "Enabled" mfa_delete = "Disabled" } } ``` </details> ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "negative1" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } versioning { enabled = true mfa_delete = true } } ``` ```tf title="Negative test num. 2 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" versioning { enabled = true mfa_delete = true } } ``` ```tf title="Negative test num. 3 - tf file" module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" version = "3.7.0" bucket = "my-s3-bucket" acl = "private" lifecycle_rule { id = "tmp" prefix = "tmp/" enabled = true expiration { date = "2016-01-12" } } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf provider "aws" { region = "us-east-1" } terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } } resource "awss3bucket" "negative4" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } lifecycle_rule { id = "tmp" prefix = "tmp/" enabled = true expiration { date = "2016-01-12" } } } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf terraform { required_providers { aws = { source = "hashicorp/aws" version = "4.2.0" } } } provider "aws" { } resource "awss3bucket" "bb" { bucket = "my-tf-test-bucket" tags = { Name = "My bucket" Environment = "Dev" } } resource "awss3bucket_versioning" "example" { bucket = awss3bucket.bb.id versioning_configuration { status = "Enabled" mfa_delete = "Enabled" } } ``` </details>