A company enables S3 Versioning and wants an extra safeguard so that permanently deleting an object version, or turning versioning off, requires more than just valid IAM credentials. Which S3 feature adds this requirement, and how must it be enabled?
- S3 Object Lock in Governance mode, enabled through the AWS Management Console
- S3 Access Points, enabled through an IAM policy
- S3 Storage Lens, enabled automatically for every bucket
- MFA Delete, which can only be enabled by the bucket owner's root account using the AWS CLI or API, not the console
Why D? And why not the others?
Correct answer: D. MFA Delete, which can only be enabled by the bucket owner's root account using the AWS CLI or API, not the console
MFA Delete is the S3 feature that requires an additional authentication factor, the concatenation of a valid MFA device serial number and its current code, alongside normal security credentials, before Amazon S3 will permanently delete an object version or change a bucket's versioning state. Critically, only the bucket owner's root account can enable MFA Delete, and it cannot be turned on through the AWS Management Console at all; it must be configured through the AWS CLI or the REST API by including the MFA parameter alongside the versioning configuration request. Object Lock in Governance mode is a different protection mechanism entirely, based on a retention period rather than a second authentication factor, and it can be configured through the console. Access Points manage where and how requests reach a bucket, not what authentication is required to delete a version. Storage Lens only reports on usage and activity; it does not enforce any deletion protection and is not automatically enabled with extra deletion controls.
Source: AWS S3 docs: Configuring MFA delete