S3 Bucket Should Have MFA Delete Enabled

More Info:

AWS S3 buckets should use Multi-Factor Authentication (MFA) Delete feature in order to prevent the deletion of any versioned S3 objects (files).

Risk Level

Low

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS AWS
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the S3 Bucket misconfiguration of not having MFA Delete enabled in AWS:

1. Log in to your AWS Management Console.
2. Navigate to the S3 service.
3. Click on the S3 bucket that you want to remediate.
4. Click on the “Properties” tab.
5. Scroll down to the “Delete” section and click on “Edit”.
6. Select the “Enable MFA delete” checkbox.
7. Click on “Save changes”.
8. A pop-up window will appear asking you to enter your MFA code. Enter the code and click on “Save changes”.
9. MFA Delete is now enabled for your S3 bucket.

Note: MFA Delete requires the use of a virtual MFA device or a hardware MFA device. You will need to configure MFA for your AWS account before you can enable MFA Delete for your S3 bucket.

Using CLI

To remediate the misconfiguration “S3 Bucket Should Have MFA Delete Enabled” for AWS using AWS CLI, follow these steps:

1. Open your terminal and install AWS CLI if it is not already installed.
2. Run the following command to enable MFA delete for your S3 bucket:

aws s3api put-bucket-versioning --bucket your-bucket-name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "your-serial-number MFA-code"

Note: Replace “your-bucket-name” with the name of your S3 bucket, and “your-serial-number” and “MFA-code” with your MFA device’s serial number and code respectively.

3. Verify that MFA delete is enabled for your S3 bucket by running the following command:

aws s3api get-bucket-versioning --bucket your-bucket-name

This command should output the versioning configuration of your S3 bucket, which should include “MFADelete”: “Enabled”.

4. Test that MFA delete is working by attempting to delete an object from your S3 bucket using the AWS Management Console or AWS CLI. You should be prompted to enter an MFA code to confirm the deletion.

By following these steps, you should be able to remediate the misconfiguration “S3 Bucket Should Have MFA Delete Enabled” for AWS using AWS CLI.

Using Python

To remediate S3 bucket MFA delete enabled misconfiguration in AWS using Python, follow the below steps:

1. Install the boto3 library if not already installed using the command !pip install boto3

2. Import the necessary libraries and create an S3 client object:

import boto3
s3 = boto3.client('s3')

3. Get the bucket’s current versioning configuration using the get_bucket_versioning method:

bucket_name = 'your-bucket-name'
versioning = s3.get_bucket_versioning(Bucket=bucket_name)

4. If the versioning is not enabled, enable it using the put_bucket_versioning method:

if versioning['Status'] != 'Enabled':
    s3.put_bucket_versioning(
        Bucket=bucket_name,
        VersioningConfiguration={
            'Status': 'Enabled'
        }
    )

5. Get the bucket’s current MFA delete configuration using the get_bucket_mfa_delete method:

mfa_delete = s3.get_bucket_mfa_delete(Bucket=bucket_name)

6. If the MFA delete is not enabled, enable it using the put_bucket_mfa_delete method:

if not mfa_delete['MFADelete']:
    s3.put_bucket_mfa_delete(
        Bucket=bucket_name,
        MFADelete='Enabled'
    )

7. To enable MFA delete, you need to provide the serial number of the MFA device and the current token code. You can prompt the user to input this information or retrieve it from a secure location.

mfa_serial = 'your-mfa-serial-number'
mfa_token = 'your-mfa-token-code'
s3.put_bucket_mfa_delete(
    Bucket=bucket_name,
    MFADelete='Enabled',
    MFA='arn:aws:iam::YOUR_ACCOUNT_ID:mfa/{}'.format(mfa_serial),
    VersioningConfiguration={
        'Status': 'Enabled'
    },
    RequestPayer='requester',
    MultiFactorAuthentication={
        'SerialNumber': 'arn:aws:iam::YOUR_ACCOUNT_ID:mfa/{}'.format(mfa_serial),
        'TokenCode': mfa_token
    }
)

Note: Replace your-bucket-name, your-mfa-serial-number and your-mfa-token-code with the actual values.

8. Once the above steps are completed, the S3 bucket should have MFA delete enabled.

Note: Make sure you have the necessary permissions to perform these actions.

Using Terraform

Terraform currently cannot enable S3 MFA Delete at all, because AWS only allows this operation via the root account with MFA, and the AWS provider does not expose an argument or resource for it.

You must perform the remediation outside Terraform, using the AWS CLI (or Console) as in your verified fix:

aws s3api put-bucket-versioning \
  --bucket YOUR_BUCKET_NAME \
  --region YOUR_REGION_CODE \
  --versioning-configuration '{"MFADelete":"Enabled","Status":"Enabled"}' \
  --mfa 'ROOT_MFA_DEVICE_SERIAL_NUMBER MFA_TOKEN_CODE'

• Replace YOUR_BUCKET_NAME and YOUR_REGION_CODE appropriately.
• Replace ROOT_MFA_DEVICE_SERIAL_NUMBER and MFA_TOKEN_CODE with the root user’s MFA device serial and a current token.
• Note: This must be done as the AWS root user, and it enables versioning permanently (it can only be suspended, not disabled).

Because Terraform cannot model or manage this setting, terraform plan and terraform apply will not show or track this change.

Additional Reading:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html