1. Log in to your AWS Management Console.
2. Navigate to the S3 service.
3. Click on the S3 bucket that you want to remediate.
4. Click on the “Properties” tab.
5. Scroll down to the “Delete” section and click on “Edit”.
6. Select the “Enable MFA delete” checkbox.
7. Click on “Save changes”.
8. A pop-up window will appear asking you to enter your MFA code. Enter the code and click on “Save changes”.
9. MFA Delete is now enabled for your S3 bucket.

​

1. Open your terminal and install AWS CLI if it is not already installed.
2. Run the following command to enable MFA delete for your S3 bucket:

aws s3api put-bucket-versioning --bucket your-bucket-name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "your-serial-number MFA-code"

3. Verify that MFA delete is enabled for your S3 bucket by running the following command:

aws s3api get-bucket-versioning --bucket your-bucket-name

4. Test that MFA delete is working by attempting to delete an object from your S3 bucket using the AWS Management Console or AWS CLI. You should be prompted to enter an MFA code to confirm the deletion.

1. Install the boto3 library if not already installed using the command !pip install boto3
2. Import the necessary libraries and create an S3 client object:

import boto3
s3 = boto3.client('s3')

3. Get the bucket’s current versioning configuration using the get_bucket_versioning method:

bucket_name = 'your-bucket-name'
versioning = s3.get_bucket_versioning(Bucket=bucket_name)

4. If the versioning is not enabled, enable it using the put_bucket_versioning method:

if versioning['Status'] != 'Enabled':
    s3.put_bucket_versioning(
        Bucket=bucket_name,
        VersioningConfiguration={
            'Status': 'Enabled'
        }
    )

5. Get the bucket’s current MFA delete configuration using the get_bucket_mfa_delete method:

mfa_delete = s3.get_bucket_mfa_delete(Bucket=bucket_name)

6. If the MFA delete is not enabled, enable it using the put_bucket_mfa_delete method:

if not mfa_delete['MFADelete']:
    s3.put_bucket_mfa_delete(
        Bucket=bucket_name,
        MFADelete='Enabled'
    )

7. To enable MFA delete, you need to provide the serial number of the MFA device and the current token code. You can prompt the user to input this information or retrieve it from a secure location.

mfa_serial = 'your-mfa-serial-number'
mfa_token = 'your-mfa-token-code'
s3.put_bucket_mfa_delete(
    Bucket=bucket_name,
    MFADelete='Enabled',
    MFA='arn:aws:iam::YOUR_ACCOUNT_ID:mfa/{}'.format(mfa_serial),
    VersioningConfiguration={
        'Status': 'Enabled'
    },
    RequestPayer='requester',
    MultiFactorAuthentication={
        'SerialNumber': 'arn:aws:iam::YOUR_ACCOUNT_ID:mfa/{}'.format(mfa_serial),
        'TokenCode': mfa_token
    }
)

8. Once the above steps are completed, the S3 bucket should have MFA delete enabled.