MFA Delete

Require multi-factor authentication for permanent object version deletion and Versioning suspension in a Stook Bucket.

Configure MFA Delete to require an authenticator code for operations that can permanently remove object versions or suspend Versioning in a Stook Bucket.

MFA Delete adds an additional protection layer to versioned data. When enabled, permanently deleting an object version or suspending Versioning requires a six-digit code from the authenticator associated with the selected access key.

Versioning must be On before MFA Delete can be enabled. Versioning cannot be suspended while MFA Delete is enabled.

For complete request parameters, response schemas, and error responses, see Bucket Settings API.

How MFA Delete Works

MFA Delete protects operations that can permanently remove versioned data or change the bucket's Versioning state.

An authenticator code is required to:

• Permanently delete an object version.

• Remove a delete marker.

• Suspend Versioning.

• Disable MFA Delete.

An authenticator code is not required for routine operations such as:

• Uploading objects.

• Downloading objects.

• Listing objects.

• Deleting an object without specifying a version ID.

• Accessing objects through FTP or a CDN Resource.

When an object is deleted without specifying a version ID, Stook adds a delete marker instead of permanently removing the stored versions. This operation does not require an authenticator code.

The master key cannot permanently delete object versions while MFA Delete is enabled. Authenticator codes are associated with created access keys.

Requirements

Before enabling MFA Delete:

• Set Versioning to On for the Stook Bucket.

• Configure an authenticator for an access key.

• Ensure the access key has access to the Stook Bucket.

• Ensure the access key has the Put Bucket Versioning permission.

See Manage Access Keys for access key and authenticator configuration.

Configure MFA Delete

1

Enable Versioning

On the Bucket configuration page, select Versioning, set it to On, and save the configuration.

2

Open MFA Delete

On the Bucket configuration page, select MFA Delete.

3

Enable MFA Delete

Turn on Enabled.

4

Select an access key

Select an access key that has an authenticator configured and permission to change Versioning for the Stook Bucket.

5

Enter the authenticator code

Enter the current six-digit code from the authenticator associated with the selected access key.

6

Save the configuration

Select Save Changes.

Disabling MFA Delete or suspending Versioning requires a valid authenticator code. If you lose access to the authenticator and do not have another applicable access key, contact Medianova Support.

Permanently Delete an Object Version

When MFA Delete is enabled, include an authenticator code when permanently deleting an object version with the AWS CLI:

aws s3api --endpoint-url https://<ENDPOINT_URL> \
  delete-object \
  --bucket <BUCKET_NAME> \
  --key <OBJECT_KEY> \
  --version-id <VERSION_ID> \
  --mfa "<SERIAL> <CODE>"

This command permanently deletes the specified object version. The --mfa parameter supplies the authenticator serial and the current authentication code required for the protected operation.

The deleted version cannot be recovered.

Authenticator Codes

Authenticator codes have the following behavior:

• A new code is generated every 30 seconds.

• A code is accepted for approximately one minute.

• Each code can be used only once.

• Authenticator codes depend on the time configured on the device.

If you perform two protected operations consecutively, wait for the next authenticator code before performing the second operation.

If a valid-looking code is rejected, verify that the device running the authenticator uses automatic time synchronization.

Configure MFA Delete with the API

Use the bucket settings endpoint to enable MFA Delete:

PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings

Send:

{
  "mfa_delete": true,
  "mfa_credential_uuid": "<CREDENTIAL_UUID>",
  "mfa_code": "123456"
}

The request identifies the access key through mfa_credential_uuid and supplies the current authenticator code through mfa_code. These values are used to authorize the configuration change and are not stored.

To disable MFA Delete, send mfa_delete as false with the access key and a current authenticator code:

{
  "mfa_delete": false,
  "mfa_credential_uuid": "<CREDENTIAL_UUID>",
  "mfa_code": "123456"
}

Troubleshooting

MFA Delete requires Versioning

Set Versioning to On, save the configuration, then enable MFA Delete.

The selected access key has no authenticator

Configure an authenticator for the access key or select another access key that already has one.

The access key cannot change Versioning

The selected access key must have the Put Bucket Versioning permission.

Add the required permission to the access key, then try again.

The authenticator code is not accepted

The code may have expired or already been used.

Wait for the next code from the authenticator and try again. If codes continue to be rejected, verify that the device uses automatic time synchronization.

Versioning cannot be suspended

Versioning cannot be suspended while MFA Delete is enabled.

Disable MFA Delete with a valid authenticator code before setting Versioning to Suspended.

AWS CLI returns argument of type 'NoneType' is not iterable

The protected operation requires an authenticator code.

Add the following parameter to the command:

--mfa "<SERIAL> <CODE>"

The authenticator device is unavailable

Contact Medianova Support if you no longer have access to the authenticator device.

Related Topics

• Bucket Configuration

• Versioning

• Object Lock

• Manage Access Keys