> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/object-storage-stook/bucket-configuration/mfa-delete.md).

# MFA Delete

Require multi-factor authentication for permanent object version deletion and Versioning suspension in a Stook Bucket.

Configure MFA Delete to require an authenticator code for operations that can permanently remove object versions or suspend Versioning in a Stook Bucket.

MFA Delete adds an additional protection layer to versioned data. When enabled, permanently deleting an object version or suspending Versioning requires a six-digit code from the authenticator associated with the selected access key.

{% hint style="warning" %}
Versioning must be **On** before MFA Delete can be enabled. Versioning cannot be suspended while MFA Delete is enabled.
{% endhint %}

{% hint style="info" %}
For complete request parameters, response schemas, and error responses, see [Bucket Settings API](/api-documentation/object-storage-stook/buckets/settings.md).
{% endhint %}

## How MFA Delete Works

MFA Delete protects operations that can permanently remove versioned data or change the bucket's Versioning state.

An authenticator code is required to:

* Permanently delete an object version.
* Remove a delete marker.
* Suspend Versioning.
* Disable MFA Delete.

An authenticator code is not required for routine operations such as:

* Uploading objects.
* Downloading objects.
* Listing objects.
* Deleting an object without specifying a version ID.
* Accessing objects through FTP or a CDN Resource.

When an object is deleted without specifying a version ID, Stook adds a delete marker instead of permanently removing the stored versions. This operation does not require an authenticator code.

{% hint style="info" %}
The master key cannot permanently delete object versions while MFA Delete is enabled. Authenticator codes are associated with created access keys.
{% endhint %}

## Requirements

Before enabling MFA Delete:

* Set **Versioning** to **On** for the Stook Bucket.
* Configure an authenticator for an access key.
* Ensure the access key has access to the Stook Bucket.
* Ensure the access key has the **Put Bucket Versioning** permission.

{% hint style="info" %}
See [Manage Access Keys](/products/object-storage-stook/manage-access-keys.md) for access key and authenticator configuration.
{% endhint %}

## Configure MFA Delete

{% stepper %}
{% step %}

### **Enable Versioning**

On the **Bucket configuration** page, select **Versioning**, set it to **On**, and save the configuration.

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2FMkkAwwLWSa3Y8Hp8RQrn%2Fimage.png?alt=media&amp;token=1dea8305-4201-458f-8354-9a7a10c75a3e" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Open MFA Delete**

On the **Bucket configuration** page, select **MFA Delete**.
{% endstep %}

{% step %}

### **Enable MFA Delete**

Turn on **Enabled**.
{% endstep %}

{% step %}

### **Select an access key**

Select an access key that has an authenticator configured and permission to change Versioning for the Stook Bucket.
{% endstep %}

{% step %}

### **Enter the authenticator code**

Enter the current six-digit code from the authenticator associated with the selected access key.
{% endstep %}

{% step %}

### **Save the configuration**

Select **Save Changes**.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Disabling MFA Delete or suspending Versioning requires a valid authenticator code. If you lose access to the authenticator and do not have another applicable access key, contact Medianova Support.
{% endhint %}

## Permanently Delete an Object Version

When MFA Delete is enabled, include an authenticator code when permanently deleting an object version with the AWS CLI:

```bash
aws s3api --endpoint-url https://<ENDPOINT_URL> \
  delete-object \
  --bucket <BUCKET_NAME> \
  --key <OBJECT_KEY> \
  --version-id <VERSION_ID> \
  --mfa "<SERIAL> <CODE>"
```

This command permanently deletes the specified object version. The `--mfa` parameter supplies the authenticator serial and the current authentication code required for the protected operation.

The deleted version cannot be recovered.

## Authenticator Codes

Authenticator codes have the following behavior:

* A new code is generated every 30 seconds.
* A code is accepted for approximately one minute.
* Each code can be used only once.
* Authenticator codes depend on the time configured on the device.

If you perform two protected operations consecutively, wait for the next authenticator code before performing the second operation.

If a valid-looking code is rejected, verify that the device running the authenticator uses automatic time synchronization.

## Configure MFA Delete with the API

Use the bucket settings endpoint to enable MFA Delete:

```http
PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings
```

Send:

```json
{
  "mfa_delete": true,
  "mfa_credential_uuid": "<CREDENTIAL_UUID>",
  "mfa_code": "123456"
}
```

The request identifies the access key through `mfa_credential_uuid` and supplies the current authenticator code through `mfa_code`. These values are used to authorize the configuration change and are not stored.

To disable MFA Delete, send `mfa_delete` as `false` with the access key and a current authenticator code:

```json
{
  "mfa_delete": false,
  "mfa_credential_uuid": "<CREDENTIAL_UUID>",
  "mfa_code": "123456"
}
```

## Troubleshooting

### MFA Delete requires Versioning

Set **Versioning** to **On**, save the configuration, then enable MFA Delete.

### The selected access key has no authenticator

Configure an authenticator for the access key or select another access key that already has one.

### The access key cannot change Versioning

The selected access key must have the **Put Bucket Versioning** permission.

Add the required permission to the access key, then try again.

### The authenticator code is not accepted

The code may have expired or already been used.

Wait for the next code from the authenticator and try again. If codes continue to be rejected, verify that the device uses automatic time synchronization.

### Versioning cannot be suspended

Versioning cannot be suspended while MFA Delete is enabled.

Disable MFA Delete with a valid authenticator code before setting Versioning to **Suspended**.

### AWS CLI returns `argument of type 'NoneType' is not iterable`

The protected operation requires an authenticator code.

Add the following parameter to the command:

```
--mfa "<SERIAL> <CODE>"
```

### The authenticator device is unavailable

Contact [Medianova Support](mailto:support@medianova.com) if you no longer have access to the authenticator device.

## Related Topics

* [Bucket Configuration](/products/object-storage-stook/bucket-configuration.md)
* [Versioning](/products/object-storage-stook/bucket-configuration/versioning.md)
* [Object Lock](/products/object-storage-stook/bucket-configuration/object-lock.md)
* [Manage Access Keys](/products/object-storage-stook/manage-access-keys.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://clients.medianova.com/products/object-storage-stook/bucket-configuration/mfa-delete.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.