AWS AmazonS3 documentation change
Summary
Clarified MFA device requirements and added examples for both physical/virtual MFA devices. Updated CLI command syntax and added reference to AWS rePost article.
Security assessment
The changes improve documentation for configuring MFA delete, a security feature. However, there is no evidence this addresses a specific vulnerability. The updates clarify syntax (e.g., changing 'SERIAL' to 'SerialNumber') and add virtual MFA examples, which helps users implement security controls correctly but does not indicate a security flaw was fixed.
Diff
diff --git a/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.md b/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.md index e60184c33..02bbb1a7b 100644 --- a//AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.md +++ b//AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.md @@ -61 +61 @@ For more information about how to purchase and activate an authentication device -The serial number is the number that uniquely identifies the MFA device. For physical MFA devices, this is the unique serial number that's provided with the device. For virtual MFA devices, the serial number is the device ARN. +The serial number is the number that uniquely identifies the MFA device. For physical MFA devices, this is the unique serial number that's provided with the device. For virtual MFA devices, the serial number is the device ARN. To use the following commands, replace the `user input placeholders` with your own information. @@ -63 +63 @@ The serial number is the number that uniquely identifies the MFA device. For phy -The following example enables S3 Versioning and multi-factor authentication (MFA) delete on a bucket. +The following example enables S3 Versioning and multi-factor authentication (MFA) delete on a bucket for a physical MFA device. For physical MFA devices, in the `--mfa` parameter, pass a concatenation of the MFA device serial number, a space character, and the value that is displayed on your authentication device. @@ -66 +66 @@ The following example enables S3 Versioning and multi-factor authentication (MFA - aws s3api put-bucket-versioning --bucket amzn-s3-demo-bucket1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "SERIAL 123456" + aws s3api put-bucket-versioning --bucket amzn-s3-demo-bucket1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "SerialNumber 123456" @@ -67,0 +68,6 @@ The following example enables S3 Versioning and multi-factor authentication (MFA +The following example enables S3 Versioning and multi-factor authentication (MFA) delete on a bucket for a virtual MFA device. For virtual MFA devices, in the `--mfa` parameter, pass a concatenation of the MFA device ARN, a space character, and the value that is displayed on your authentication device. + + + aws s3api put-bucket-versioning --bucket amzn-s3-demo-bucket1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "arn:aws:iam::account-id:mfa/root-account-mfa-device 123789" + +For more information, see the AWS rePost article [How do I turn on MFA delete for my Amazon S3 bucket?](https://repost.aws/knowledge-center/s3-bucket-mfa-delete).