2.1.2 Ensure MFA Delete is enabled on S3 buckets

Information

Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.

Rationale:

Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.

Impact:

Enabling MFA delete on an S3 bucket could required additional administrator oversight. Enabling MFA delete may impact other services that automate the creation and/or deletion of S3 buckets.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Perform the steps below to enable MFA delete on an S3 bucket.
Note:
-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.
-You must use your 'root' account to enable MFA Delete on S3 buckets.
From Command line:

Run the s3api put-bucket-versioning command

aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa 'arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode'

See Also

https://workbench.cisecurity.org/benchmarks/14207

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|IA-2(1), 800-53|MP-2, CSCv7|14.6

Plugin: amazon_aws

Control ID: b8c120794de62c658c8147b698fdadd04a1d686d62717fe51c22a1a139f9ac89