Instructor: Okay, so let's demonstrate MFA delete.
So I'm going to create a bucket,
and I'll call it demo stephane MFA delete 2020 in eu-west-1.
And I'm going to enable bucket versioning,
and click on create buckets.
Okay, good.
Now, if we go to this bucket,
the MFA bucket,
and go to properties and bucket versioning
and click on edit.
As you can see, Multi-Factor authentication (MFA) delete
is currently disabled,
and you cannot change this
through the UI of Amazon console, for some reason.
So maybe someday they will allow us to enable it.
But for now,
what you have to do is to enable it
directly using the AWS CLI.
So a prerequisite of this hands-on is to make sure that,
under IAM,
you have already set up an MFA device
for your root accounts.
So I'm using my root account right now,
as you can see, it's, I'm logged in as roots.
And what I need to do is click on it and click on my
security credentials.
This is taking me to the security credentials I have in IAM.
And under a Multi-Factor authentication MFS,
you can see I've set up already a virtual device for my MFA,
and the ARN is right here.
Okay, so this is good.
Next, we have to go ahead and actually configure the ADA CLA
to use this root account.
Now, this is something I don't recommend on doing,
except for enabling MFA delete on your S3 bucket.
So what I'm going to do is to create new access keys,
and I will download the key file and then show the access
keys as well.
I will remove them, so don't worry about seeing mine,
but you should never share your root access key with anyone
as well as your secret access key.
And so what I need you to do now is to set up the CLA with
these two little settings.
So I'm going to configure my command line.
So AWS configure and then I'm going to create a profile
and I've called this profile, roots-MFA-delete-demo.
And this file, you can find under,
s3advanced.mfadelete.sh.
So we're using the comments from there.
So I'm going to set up this profile and then after you enter
my access key Id, which is right here.
So let's go ahead and paste this, my secret access key,
which is all the way here, paste it.
Default region name, eu-west-1, and we're good to go.
Now, if I do AWS S3 LS, does it work?
and do it with my profile that I've just created,
which is called by the way, root-MFA-delete-demo.
Yes this gives me my three buckets that I have.
So my profile is correctly set up.
Next, what I have to do is to enable the MFA delete.
So for this, there is this full setting right here
that I'm going to copy and then edit, with you.
So I paste it and I need to first change the bucket names.
So the bucket for now is called, MFA-demo-stephane
but I'm going to change it by demo-stephane-MFA-delete-2020,
which is good.
Versioning configuration status enabled.
MFA delete equals enabled.
So we are good to go here and then we need to specify the
ARN of the MFA device and this I can find.
So let's find it's right here.
This is the ARN of the MFA device,
So I'm going to paste it.
And finally, the MFA code.
This is something that I'm going to get directly from my
application, that gives me my MFA code.
So seven one zero three four three, press enter.
And apparently this is not correct.
So let's wait another one.
(typing)
And we're good to go.
Okay, so this was set up.
So now, how do we know if it worked?
Well, if I go into my bucket versioning and refresh,
as we can see now, bucket versioning,
it says bucket versioning is enabled
as well as Multi-Factor authentication,
MFA delete is enabled.
And so, how do we know if it worked?
Well, let's say I'm going to my objects
and I'm going to upload objects.
So let me upload, for example,
a copy of the JPEG file,
I will upload it, so this is working
Now If I go back to my buckets,
take that objects and delete it.
Okay, we're going to delete it,
but we have enabled versioning,
so this is just going to add a delete marker.
This is working as well.
So all in all so far, so good.
And if I list my bucket versions now,
okay I have two versions for my file,
but now if I wanted to, for example,
delete this specific version ID.
Okay, so this one is called a permanent delete.
It says, you cannot delete object
because Multi-Factor authentication, MFA deletes
is enabled for this bucket.
And so to do so we need to use the CLI command to delete
this file or disabled MFA delete.
So we can just go ahead and disable MFA delete,
so for this, the command is right here.
So it's the same command that this time will do
MFA delete equals disabled.
So I'm going to take the command from before and I'm going
to edit it out, so here we go.
MFA delete equals disabled and obviously
the MFA code I need to change.
So let me wait for the next MFA code to appear on my screen.
Hopefully it will work.
Press enter.
And here we go, this works.
So now if I try another time to delete, for example, delete,
the delete marker.
Yes, it is working because I have disabled MFA delete.
So let's confirm it by typing in this texts.
And then finally going back to my buckets,
go into my properties and under bucket versioning,
yes, we can see that MFA delete is disabled.
So that's it for this lecture.
I hope you liked it.
And obviously at the end of the lecture, I almost forgot,
but no, I didn't forget.
Please delete your route access key.
This is really bad to you have them
so, I will deactivate them and we're good to go,
and then finally I can probably delete them at some point.
Okay, so that's it.
Thank you so much, and I will see you in the next lecture.