When you delete objects in buckets with versioning enabled you set a delete marker on that object, then you can go in and permanently delete that file. What if you want to prevent people from deleting these files? Well there’s a simple solution and it’s MFA delete. When MFA delete is enabled the only way to delete objects is with root account with MFA enabled via AWS CLI or by disabling MFA delete via CLI prior to deleting the objects. You enable MFA delete via CLI as well, there is currently no way to enable MFA delete from the AWS management console.