Enable S3 MFA delete using AWS CLI - A SIMPLE GUIDE
Tags: aws, s3, beginners, tutorial
Published: 2023-09-26 23:48:29

**S3 MFA delete adds another layer of security as you can't delete files unless you have the MFA device authentication code.**

first you need to register MFA device with your account, check the following link to do so:
[https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html](url)


In your S3 bucket properties, bucket versioning click edit

![bucket properties](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nceaof6s4z1t5k459xfn.jpg)

![bucket versioning](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1z9bcio2y9wx62p5xkh7.jpg)

**Note that you cant enable MFA delete, it can only be enabled using AWS CLI, AWS SDk or S3 REST API.**

![cant enable MFA delete](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/klb91o2p4colspfhtsj5.jpg)

_if you need to install AWS CLI check the following link :
[https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html](url)_

to use AWS CLI you need to create an access key, click on your account name in the top right and then security credentials

![account security credentials](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fcs1on09geghdp9ob48g.jpg)*copy the MFA device identifier as we will use it later.

in Access Keys click Create access key.
![Create access key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nigdwkkk5oitm0dtpr2o.jpg)

mark " I understand that creating a root access key is not a best practice " and click Create access key
![Create access key 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k72bsx78jwrakg2kn8y5.jpg)

download the csv file that contains the access key and secret access key, if you don't you will have to create another access key as you can't retrieve the secret access key later. 
![download the csv file](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wg80nobe5l62qkfblpbq.jpg)

open the cli and configure AWS cli using the "aws configure" command. Enter the access key, secret access key, default region and default output format.
![aws configure](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kb6isk6nllz2571b001g.jpg)

check if AWS cli is working, use command "aws s3 ls" to show your S3 buckets.
![aws s3 ls](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jeiomxf4m7mg3gobtnbj.jpg)

enable MFA delete using the following command:
aws s3api put-bucket-versioning --bucket <u>bucket-name</u> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "<u>MFA-device-identifier</u> <u>mfa-code</u>".
Replace the underlined text with its appropriate value.
![MFA command](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j6r72dnlof58r8144icf.jpg)

check your S3 bucket properties to confirm MFA delete is enabled.
![MFA delete is enabled](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ahlhxu0h6qg90hjeq705.jpg)

If you delete an object without showing versions a delete marker will be added to this object, but it will not be permanently deleted. you have to show versions and choose the version you want to delete.
![delete marker](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qq3kt6keh0f2yn9jbn27.jpg)

If you try to permanently delete an object version, you will get an error.
![error](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hf1u4wjwrbscut4329o1.jpg)

Trying from cli have the same result
![cli delete error](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ho1t8p4ff61wc2ha6eva.jpg)

To delete a file you need to add the MFA device ID and code, if you delete an object with a delete marker it will be shown in the result.

Deleting object with delete marker.
![Deleting object with delete marker](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/19imn2svimp21rdx6ogi.jpg)

Deleting object with no delete marker.
![Deleting object with no delete marker](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/itz7urckbp9d2ro7hgm4.jpg)

**To disable MFA delete use the same command as enabling it and replace " MFADelete=Enabled " with " MFADelete=Disabled " .**

_After disabling MFA delete don't forget to delete your access key._
you have to deactivate the access key first then delete it.

![delete the access key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5bocm2kimcwhfcamp4rn.jpg)

![deactivate the access key ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rzy605oiwafjawukmhsd.jpg)

![delete the access key 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8za0f031xubkehor2j43.jpg)

![confirm](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gyhvl6k1khieu93dhogx.jpg)

![access key deleted](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gcfnlmqjfjdwa94selum.jpg)