---
title: S3 buckets should have 'MFA Delete' enabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 buckets should have 'MFA Delete'
  enabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# S3 buckets should have 'MFA Delete' enabled
 
## Description{% #description %}

AWS S3 buckets should have both Versioning and `MFA Delete` enabled, so that changing the versioning state or permanently deleting an object version requires two forms of authentication. This protects against unauthorized or accidental deletions. Apply Versioning and MFA Delete based on data sensitivity and bucket purpose, because versioning retains every prior object version and can add storage cost for high-churn or logging buckets.

## Remediation{% #remediation %}

1. Sign in with the AWS account root user. MFA Delete cannot be enabled from the AWS Management Console; use the AWS CLI or API as described in [Configuring MFA Delete](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html).
1. Run the [put-bucket-versioning](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html) command: `aws s3api put-bucket-versioning --bucket <BUCKET_NAME> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "arn:aws:iam::<account-id>:mfa/root-account-mfa-device <MFA-code>"`.

## References{% #references %}

- [Using versioning in S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html)
- [AWS CLI put-bucket-versioning](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-versioning.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)