Ravi Sir's Cards › AWS
MFA Delete protection
This revision card explains MFA Delete protection. It starts from the need that version deletes and versioning state changes need an MFA code when MFA Delete is on. On the card, the building blocks include aws — MultiFactorAuthPresent for privileged statements; keep day-to-day Deny delete. The how-to section notes delete without MFA , then deny; with MFA session , then allowed if policy says so. An example on the card is sofia Alvarez cannot purge versions until she MFA-authenticates.
Read card text
What this card says
Why do we need it?
Version deletes and versioning state changes need an MFA code when MFA Delete is on.
MFA Delete
What is it?
aws:MultiFactorAuthPresent for privileged statements; keep day-to-day Deny delete.
How to do it
Delete without MFA → deny; with MFA session → allowed if policy says so.
Example
Sofia Alvarez cannot purge versions until she MFA-authenticates.