{
  "Provider": "aws",
  "CheckID": "s3_bucket_no_mfa_delete",
  "CheckTitle": "Check if S3 bucket MFA Delete is not enabled.",
  "CheckType": [
    "Logging and Monitoring"
  ],
  "ServiceName": "s3",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:s3:::bucket_name",
  "Severity": "medium",
  "ResourceType": "AwsS3Bucket",
  "Description": "Check if S3 bucket MFA Delete is not enabled.",
  "Risk": "Your security credentials are compromised or unauthorized access is granted.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "aws s3api put-bucket-versioning --profile my-root-profile --bucket my-bucket-name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa 'arn:aws:iam::00000000:mfa/root-account-mfa-device 123456'",
      "NativeIaC": "",
      "Other": "",
      "Terraform": "https://docs.bridgecrew.io/docs/bc_aws_s3_24#terraform"
    },
    "Recommendation": {
      "Text": "Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.",
      "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html"
    }
  },
  "Categories": [],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
