Versioned S3 bucket should enable MFA delete

What it checks

S3 bucket: enabled versioning configuration does not establish MFA delete as Enabled.

Where it applies

Terraform: aws_s3_bucket_versioning

CloudFormation: AWS::S3::Bucket

How to fix it

1. Review versioning_configuration.mfa_delete and the deployed MFA-delete state. Enabling MFA delete requires the bucket owner (root) to run an authenticated CLI/API call with an MFA token — it cannot be toggled by an IAM user.

Frameworks

• AWS FSBP S3.20
• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules