Ensure MFA Delete is enabled on S3 buckets

Perform the steps below to enable MFA delete on an S3 bucket.

Note:

-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.

-You must use your 'root' account to enable MFA Delete on S3 buckets.

From Command Line

1. Run the s3api put-bucket-versioning command

aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode"```

## Multiple Remediation Paths

### AWS
**SERVICE-WIDE (RECOMMENDED when many resources are affected):**
Deploy centralized guardrails and remediation using AWS Config Conformance Packs and (if applicable) AWS Organizations SCPs.

~~~bash
aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml
~~~

**ASSET-LEVEL:**
Apply the resource-specific remediation steps above to only the affected assets.

**PREVENTIVE:**
Add CI/CD policy checks (CloudFormation/Terraform validation) before deployment to prevent recurrence.

### References for Service-Wide Patterns
- AWS Config Conformance Packs: https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html
- AWS Organizations SCP examples: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html

## Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.

### 1. Contain at Service-Wide Scope First (Recommended)
- AWS: deploy/adjust organization conformance packs and policy guardrails.
~~~bash
aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml
~~~

### 2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.

### 3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.