AWS AmazonS3 documentation change

Service: AmazonS3 · 2025-08-25 · Documentation low

File: AmazonS3/latest/userguide/manage-versioning-examples.md

Summary

Added separate examples for physical/virtual MFA devices in MFA delete configuration. Updated CLI command syntax to match MFA parameter requirements.

Security assessment

These changes provide clearer guidance on implementing MFA delete (a security feature) but do not indicate remediation of a security vulnerability. The updates prevent misconfiguration risks by showing proper syntax for different MFA types, which improves security posture but is not tied to a specific disclosed issue.

Diff

diff --git a/AmazonS3/latest/userguide/manage-versioning-examples.md b/AmazonS3/latest/userguide/manage-versioning-examples.md
index 732dca68e..2f7e62f82 100644
--- a//AmazonS3/latest/userguide/manage-versioning-examples.md
+++ b//AmazonS3/latest/userguide/manage-versioning-examples.md
@@ -67 +67 @@ The following example enables versioning on an S3 general purpose bucket.
-The following example enables S3 Versioning and multi-factor authentication (MFA) delete on a bucket.
+The following example enables S3 Versioning and multi-factor authentication (MFA) delete on a bucket for a physical MFA device. For physical MFA devices, in the `--mfa` parameter, pass a concatenation of the MFA device serial number, a space character, and the value that is displayed on your authentication device.
@@ -70 +70 @@ The following example enables S3 Versioning and multi-factor authentication (MFA
-    aws s3api put-bucket-versioning --bucket amzn-s3-demo-bucket1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "SERIAL 123456"
+    aws s3api put-bucket-versioning --bucket amzn-s3-demo-bucket1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "SerialNumber 123456"
@@ -71,0 +72,4 @@ The following example enables S3 Versioning and multi-factor authentication (MFA
+The following example enables S3 Versioning and multi-factor authentication (MFA) delete on a bucket for a virtual MFA device. For virtual MFA devices, in the `--mfa` parameter, pass a concatenation of the MFA device ARN, a space character, and the value that is displayed on your authentication device.
+    
+    
+    aws s3api put-bucket-versioning --bucket amzn-s3-demo-bucket1 --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "arn:aws:iam::account-id:mfa/root-account-mfa-device 123789"