Allowing multiple MFA devices for S3 MFADelete?

Question

In looking [here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html) regarding enabling MFA deletion on an S3 bucket, and checking the [AWS CLI v2 docs](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/put-bucket-versioning.html) on the subject, it isn't clear to me how to configure a bucket to allow the use of **multiple** MFA devices for authentication. That is, allow any one of several registered MFA devices to authenticate requests for deletions.

The idea here is to allow a small **group** of employees, each with their own MFA devices, to have access to programmatically delete objects from an S3 bucket that's configured to require MFA. With only a single device configured per-bucket, we're in a "hit by a bus" situation.

Is there a way to do this? Or are we better off pursuing a shared MFA solution (KeepassXC, Dashlane, etc.). An online password management tool that allows shared (controlled) access to an MFA token would work, but if possible I'd prefer to devise a solution that stays within AWS IAM.

Thanks!

Nithin T M · Answer

Hii ...,
S3 MFA delete is huge management overhead for the Cloud Administrator. 
Its actually not recomended to share the MFA of root user with others or having Multiple MFA devices because its a** **security concern.****
S3 MFA is enabled for a critical data where a root account holder is only allowed to authorize to delete.

Allowing multiple MFA devices for S3 MFADelete?

Relevant content