Require Mfa Delete

Buckets should have MFA deletion protection enabled.

Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete an object version, adding another layer of security in the event your security credentials are compromised or unauthorized access is obtained.

Impact

Lessened protection against accidental/malicious deletion of data

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

resource "aws_s3_bucket" "example" {
	bucket = "bucket"
}

resource "aws_s3_bucket_versioning" "good_example" {
 	bucket = aws_s3_bucket.example.id
   
	versioning_configuration {
		status = "Enabled"
		mfa_delete = "Enabled"
	}
}
 

Links

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html