DevPay and Mfa are mutually exclusive authorization methods

user_4049536 0
Viewed 2988

I'm trying to add MFA-deletion to my S3 bucket with the AWS-cli with the following command: 

aws s3api put-bucket-versioning --bucket <my-bucket-name> --versioning-configuration '{"MFADelete":"Enabled","Status":"Enabled"}' --mfa 'arn:aws:iam::<code-found-at-iam-page>:mfa/root-account-mfa-device <my-google-authenticator-code>'

but the response I get is this:

An error occurred (InvalidRequest) when calling the PutBucketVersioning operation: DevPay and Mfa are mutually exclusive authorization methods.

which makes no sense as I have never used DevPay. My security group for the instance has S3FullAccess enabled so that shouldn't be a problem either.

Any suggestions on what the problem might be would be appreciated.

amazon-web-services amazon-s3
3 Answers

I submitted a case to AWS and they answer with this:

That error response typically gets returned when the API cannot perform the MFA Delete task due to the request being made with non-root credentials. The only way to turn on MFA Delete is to use the credentials from the root user of the account

Simple solution!

user_89545290

I just got the same error when attempting to perform this using the AWS CloudShell, although I was using the root user (and confirmed I was root using the CloudShell). The same command worked when run from the local CLI.

user_53168820
user_104695460
Related