---
title: "MFA Delete With the Wasabi S3 API"
slug: "mfa-delete-with-wasabi-s3-api"
updated: 2025-08-14T18:02:06Z
published: 2025-08-14T18:02:06Z
canonical: "docs.wasabi.com/mfa-delete-with-wasabi-s3-api"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wasabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MFA Delete With the Wasabi S3 API

MFA (Multi-Factor Authentication) Delete

Wasabi supports the “x-amz-mfa” header while:

- configuring versioning on a bucket, or
- deleting objects with delete object requests compatible with AWS S3.

Wasabi does not require the “x-amz-mfa” header if the user's access credentials signing the request were authenticated with MFA. Wasabi only supports virtual MFA devices.

(Refer also to [Workflow for Lifecycle Rule Implementation](https://docs.wasabi.com/docs/lifecycle#workflow-for-lifecycle-rule-implementation).)

### Checking MFA-Delete Status for an S3 Bucket

To determine whether MFA-Delete is enabled for your S3 bucket, use the get-bucket-versioning command in the AWS CLI:

```plaintext
aws s3api get-bucket-versioning --bucket BUCKETNAME --profile WASABIPROFILE --endpoint-url=https://s3.BUCKETREGION.wasabisys.com
```

The output will indicate the versioning status and whether MFA-Delete is enabled. For example:

```plaintext
{ 
    "Status": "Enabled", 
    "MFADelete": "Enabled" 
}
```

Status: Enabled indicates that versioning is active.

MFADelete: Enabled confirms that MFA-Delete is enabled for the bucket

### Managing MFA-Delete Using the AWS CLI

The following are prerequisites for managing MFA-Delete using the AWS CLI:

- Versioning is enabled on the bucket.
- Root account credentials are configured with MFA.
- AWS CLI v2 is installed.

Use this command to enable MFA-Delete:

```plaintext
aws s3api put-bucket-versioning --bucket BUCKETNAME --versioning-configuration MFADelete=Enabled,Status=Enabled --mfa "arn:aws:iam::ACCOUNTID:mfa/root-account-mfa-device MFACODE” --endpoint-url=https://s3.BUCKETREGION.wasabisys.com –profile WASABIPROFILE
```

Use this command to disable MFA-Delete:

```plaintext
aws s3api put-bucket-versioning --bucket BUCKETNAME --versioning-configuration MFADelete=Disabled,Status=Enabled --mfa "arn:aws:iam::ACCOUNTID:mfa/root-account-mfa-device MFACODE” --endpoint-url=https://s3.BUCKETREGION.wasabisys.com –profile WASABIPROFILE
```