MFA on Delete For S3 Buckets

ACM.205 Requiring AWS principals to have MFA enabled to delete objects and versions

This is a continuation of my series of posts on Automating Cybersecurity Metrics, MFA, Passwords and S3 Buckets. The Code.

Free Content on Jobs in Cybersecurity | Sign up for the Email List

In the last post I wrote about how to enable Cost Management for an organization.

In this post, I’m going to jump back to a topic I meant to cover while writing about S3 buckets.

You may have noticed there were no permissions to delete objects or restrictions on deleting objects. One of the things we might want to enforce on all buckets is MFA delete on object versions.

There are a couple of ways we can enforce MFA delete on buckets. One is a setting on the bucket version configuration.

Why didn’t we configure this in our CloudFormation template? Because it’s not listed as an option in the CloudFormation documentation. According to the documentation we can enable this setting with the following command via the CLI.

aws s3api put-bucket-versioning --bucket DOC-EXAMPLE-BUCKET1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "SERIAL 123456"

The values for MFADelete are Enabled or Disabled.

In the command above it includes an mfa option. It appears in the documentation that this is optional.

The big caveat with MFA delete, however, is the following:

You cannot use MFA delete with lifecycle configurations. For more information about lifecycle configurations and how they interact with other configurations, see Lifecycle and other bucket configurations.

Since we added a lifecycle policy to our bucket, we cannot use MFA delete.

Bucket policies that enforce MFA

There is another way we can enforce MFA for deletion on bucket policies but only for specified users, or essentially we can whatever manages the lifecycle policy.

Per the documentation:

To enforce the MFA requirement, use the aws:MultiFactorAuthAge condition key in a bucket policy. 

Here’s the AWS sample code.

We can alter that to disallow getting or deleting the files without MFA.

{
    "Version": "2012-10-17",
    "Id": "123",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Deny",
        "Principal": "*",
        "Action": [s3:delete,
                   s3:get]
        "Resource": "[bucket/*]",
        "Condition": { "Null": { "aws:MultiFactorAuthAge": true }}
      }
    ]
 }

Why does this example not just use the multi-factor is present condition instead of MultiFactorAuthAge? I don’t know.

IAM policies that enforce MFA

We can also enforce MFA on IAM policies, to ensure the principal taking actions is using MFA.

Caveats

We need to make sure the principal types that will require MFA for actions can use MFA, as I explained in prior posts.

For example, a role does not use MFA, but it requires MFA to assume a role.

If logged in from Okta currently the way I have it configured, MFA Is not required. We’ll revisit that later.

Due to all the caveats, I’m not going to enforce MFA delete in the bucket policy for now. I have something else to test related to Okta first. However, we can require MFA to assume a role and we can make sure that only the appropriate roles have permission to delete files or versions in buckets containing sensitive data.

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab