Your company has a set of sensitive documents in an S3 bucket. They want to ensure that only privileged IAM users can access the contents of the bucket using their MFA devices. How can you ensure that this sort of access is provided for the bucket? Choose 2 answers from the options given below.

Answer options:

A.Enable versioning on the bucket.
B.Enable MFA delete on the bucket.
C.Ensure MFA is enabled for the privileged IAM users.
D.Ensure a bucket policy is in place to only allow access if users are MFA authenticated.

Correct Answers: C and D
The AWS Documentation mentions the following.
Amazon S3 supports MFA-protected API access, a feature that can enforce multi-factor authentication (MFA) to access your Amazon S3 resources. Multi-factor authentication provides an extra level of security you can apply to your AWS environment. It is a security feature that requires users to prove physical possession of an MFA device by providing a valid MFA code.
You can enforce the MFA authentication requirement using the aws:MultiFactorAuthAge key in a bucket policy. IAM users can access Amazon S3 resources by using temporary credentials issued by the AWS Security Token Service (STS). You provide the MFA code at the time of the STS request.
Options A and B are incorrect since these are used to ensure users don’t accidentally delete objects. But here, we want to ensure that users use MFA to access the contents in the bucket.
For more information on example bucket policies, please visit the below URL-
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html