MFAdelete

MFAdelete, also known as MFA Delete, is a security feature for Amazon S3 buckets that have versioning enabled. When MFA Delete is enabled, certain deletion operations require additional authentication in the form of a valid multi-factor authentication (MFA) token. The intent is to provide an extra safeguard against accidental or malicious data loss by requiring both standard credentials and an MFA code for specific destructive actions.

Enabling and configuring MFA Delete can only be performed by the AWS account root user. The feature is configured at the bucket level and is not available to enable or disable by individual IAM users or roles. Requests that enable or suspend versioning, or that permanently delete a version or a delete marker, must include MFA authentication, typically specified by the MFA device’s serial number and a current MFA code.

With MFA Delete active, ordinary delete operations that create delete markers still occur, but permanently deleting a specific object version or a delete marker requires providing MFA. This does not prevent reading data or deleting non-versioned objects in non-versioned buckets, and it applies only to versioned buckets.

Limitations and considerations include operational impact and reliance on the root account for enabling or disabling the feature. If the MFA device is unavailable, permanently deleting data may be blocked. MFA Delete is one layer of protection within a broader data security strategy, which can also include versioning policies, bucket access controls, and data lifecycle controls.