Amazon S3 MFA Delete and MFA-Protected API Access – SAP-C02 Study Guide

Purpose of This Lesson

Amazon S3 supports MFA in two different security patterns:

• MFA Delete, which protects specific versioning and deletion operations on an S3 bucket.
• MFA-protected API access, which uses IAM policy conditions to require MFA for API or CLI requests.

These mechanisms are related but operate differently. The most important exam skill is distinguishing what each one protects, where MFA must be supplied, and which identity can configure it.

Key Concepts

What MFA adds

Multi-factor authentication requires an additional authentication factor beyond a username and password. The factor is commonly a time-based one-time password generated by a hardware token or an authenticator application.

MFA can be used to reduce the risk of destructive S3 operations or to conditionally restrict API access across AWS services.

S3 MFA Delete

MFA Delete adds an MFA requirement to two specific categories of bucket operations:

1. Changing the versioning state of a bucket
2. Permanently deleting an object version

MFA Delete is especially useful when protecting versioned data against accidental or unauthorized permanent deletion. A delete request that creates a delete marker is not the same as permanently deleting a specific object version; MFA Delete is concerned with permanent version deletion.

When MFA Delete is required, the request must include the x-amz-mfa header containing the MFA device serial number and the current authentication code.

Important configuration rules:

• Versioning must be enabled before MFA Delete can be enabled.
• The bucket owner is required to enable or disable MFA Delete.
• MFA Delete is configured through supported S3 API or CLI operations rather than as a normal bucket-level IAM permission that any authorized administrator can toggle.
• Versioning and MFA Delete are separate settings. An authorized IAM user may be able to manage versioning, but MFA Delete configuration is restricted to the bucket owner.

MFA-protected API access

MFA-protected API access is an IAM policy technique. It can require MFA for requests made through AWS APIs or the AWS CLI, and the technique is not limited to S3.

A policy can deny access unless the request contains evidence that the caller authenticated with MFA. A common condition uses aws:MultiFactorAuthAge, often with a Null test:

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ],
  "Condition": {
    "Null": {
      "aws:MultiFactorAuthAge": "true"
    }
  }
}

The condition evaluates whether MFA context is absent from the request. If it is absent, the explicit deny applies. The same pattern can be adapted to other actions, resources, and AWS services.

Console MFA is not automatically API MFA

Signing in to the AWS Management Console with MFA does not automatically cause subsequent CLI or API requests to contain MFA authentication context.

For API or CLI access, the caller must obtain temporary security credentials by supplying an MFA token to the credential-generation process. Those temporary credentials include the relevant session information, allowing the IAM policy condition to recognize MFA-authenticated requests.

In practice, the workflow is:

1. Provide IAM credentials and an MFA device code to obtain temporary session credentials.
2. Configure the CLI or application to use the temporary access key, secret key, and session token.
3. Make the S3 or other AWS API request using those temporary credentials.

Exam-Relevant Takeaways

• MFA Delete protects only two key operations: changing bucket versioning state and permanently deleting an object version.
• MFA Delete requires S3 Versioning.
• Only the bucket owner can enable or disable MFA Delete.
• MFA Delete uses the x-amz-mfa request header.
• MFA-protected API access is an IAM policy control, commonly implemented with aws:MultiFactorAuthAge.
• MFA used during console sign-in does not automatically satisfy an MFA condition on a later CLI or API request.
• CLI and API access must use temporary credentials obtained with an MFA token when a policy requires MFA context.
• MFA-protected API access can apply to services other than S3; MFA Delete is an S3-specific feature.

Architecture Decision Guide

Requirement	Appropriate control	Key implementation detail
Require MFA before permanently deleting an S3 object version	S3 MFA Delete	Requires Versioning and the x-amz-mfa header
Require MFA before changing bucket versioning state	S3 MFA Delete	Only the bucket owner can enable or disable MFA Delete
Require MFA for S3 CLI/API operations	IAM policy condition	Use MFA context such as aws:MultiFactorAuthAge
Require MFA for API access to multiple AWS services	IAM policy condition	Apply the condition to the relevant actions and resources
Protect against ordinary accidental deletes in a versioned bucket	Versioning and IAM controls	A delete marker is different from permanent version deletion
Require MFA for a user who logged into the console	Console IAM sign-in policy	This does not automatically add MFA context to CLI/API requests

Common Exam Traps

• Confusing MFA Delete with MFA-protected API access: MFA Delete is an S3 versioning/deletion feature; an IAM MFA condition is a general API authorization mechanism.
• Assuming MFA Delete protects every S3 delete: It specifically applies to permanently deleting object versions and changing versioning state.
• Forgetting the Versioning prerequisite: MFA Delete cannot be enabled on a bucket without versioning.
• Assuming any administrator can enable MFA Delete: The bucket owner has the required authority to configure it.
• Treating a console MFA login as sufficient for CLI/API access: The API request must carry MFA-derived session context.
• Confusing a delete marker with permanent deletion: In a versioned bucket, a normal delete can add a delete marker while previous object versions remain recoverable.
• Using only long-term access keys for an MFA-required API request: The request needs temporary credentials generated using an MFA token.

Real-World Engineer Notes

• Use MFA Delete as a targeted safeguard for high-value versioned buckets where permanent deletion is particularly sensitive.
• Combine MFA-related controls with least-privilege IAM, explicit denies for destructive actions, CloudTrail logging, and operational approval processes.
• Test policy behavior using the exact access path used by automation. A console test does not prove that an MFA-required CLI workflow works.
• Be precise about the resource scope in bucket policies. Object actions generally require both the bucket ARN and the object ARN pattern where applicable.
• MFA is not a replacement for backup, replication, or immutability. For stronger ransomware and insider-threat protection, evaluate S3 Object Lock, replication, backup strategies, and separate security accounts as appropriate.

Quick Reference Summary

• MFA Delete: S3 feature for versioning-state changes and permanent object-version deletion.
• Prerequisite: S3 Versioning enabled.
• Configuration authority: Bucket owner.
• Request mechanism: x-amz-mfa header.
• MFA-protected API access: IAM policy-based control using request MFA context.
• Common condition key: aws:MultiFactorAuthAge.
• Console MFA: Does not automatically satisfy CLI/API MFA requirements.
• API/CLI solution: Obtain and use temporary session credentials authenticated with an MFA token.

Flashcards

1. Q: What two S3 operations can MFA Delete protect?

A: Changing the bucket’s versioning state and permanently deleting an object version.

1. Q: What S3 feature must be enabled before MFA Delete can be enabled?

A: S3 Versioning.

1. Q: Who can enable or disable S3 MFA Delete?

A: The bucket owner.

1. Q: Which request header carries MFA information for an MFA Delete operation?

A: x-amz-mfa.

1. Q: Is MFA Delete an IAM policy condition that works across AWS services?

A: No. MFA Delete is an S3-specific feature; IAM MFA conditions can be used across services.

1. Q: What IAM context is commonly used to require MFA for API requests?

A: aws:MultiFactorAuthAge.

1. Q: Does signing in to the AWS console with MFA automatically satisfy an MFA condition on a CLI request?

A: No.

1. Q: What credentials should a CLI user use when an IAM policy requires MFA context?

A: Temporary security credentials obtained using an MFA token.

1. Q: Is creating a delete marker the same as permanently deleting an object version?

A: No. A delete marker can hide the current object while prior versions remain available.

1. Q: What is the purpose of an explicit deny using a null MFA-context condition?

A: To deny requests that do not contain evidence of MFA authentication.

Practice Questions

Question 1

A security team requires protection against permanent deletion of object versions in a versioned S3 bucket. Which solution directly addresses this requirement?

A. Add an S3 bucket policy requiring HTTPS
B. Enable S3 MFA Delete
C. Enable default encryption with SSE-KMS
D. Require MFA only when users sign in to the console

Correct answer: B

Explanation: S3 MFA Delete is designed to require an MFA code when permanently deleting object versions. It requires Versioning and must be configured by the bucket owner.

Question 2

An IAM policy denies s3:* when aws:MultiFactorAuthAge is null. A user signs in to the AWS console using MFA and then runs an S3 CLI command using long-term access keys. What is the likely result?

A. The request succeeds because the user authenticated with MFA earlier
B. The request succeeds only for read operations
C. The request is denied because the CLI request lacks MFA session context
D. The request succeeds because S3 MFA Delete is enabled

Correct answer: C

Explanation: Console authentication and API authentication context are separate. The CLI must use temporary credentials obtained with an MFA token for the policy to recognize MFA-authenticated API access.

Question 3

An engineer wants to enable MFA Delete on an S3 bucket, but Versioning is currently suspended. What must happen first?

A. Enable default bucket encryption
B. Enable Versioning
C. Add an aws:MultiFactorAuthAge condition to the bucket policy
D. Create an S3 Access Point

Correct answer: B

Explanation: MFA Delete requires Versioning to be enabled. The IAM condition is a separate method for protecting API access and is not a prerequisite for MFA Delete.

Question 4

A company wants to require MFA for API operations against several AWS services, including S3, EC2, and IAM. Which approach is most appropriate?

A. Enable S3 MFA Delete on every S3 bucket
B. Require console MFA and assume it applies to all API requests
C. Use IAM policies with MFA-related condition keys on the relevant actions and resources
D. Add the x-amz-mfa header to every AWS API request

Correct answer: C

Explanation: IAM policy conditions provide a service-independent way to require MFA context for API or CLI requests. S3’s x-amz-mfa header is associated with S3 MFA Delete operations, not a universal AWS API mechanism.

Question 5

A versioned bucket receives a standard delete request without an MFA code. Which statement is most accurate regarding MFA Delete?

A. It always blocks the request because all deletes require MFA
B. It may allow creation of a delete marker; permanent version deletion is the protected operation
C. It permanently deletes every version but records the action in CloudTrail
D. It disables versioning automatically

Correct answer: B

Explanation: In a versioned bucket, a normal delete can create a delete marker. MFA Delete specifically protects permanent deletion of an object version and changes to the bucket’s versioning state; it is not a blanket requirement for every delete-marker operation.