In looking here regarding enabling MFA deletion on an S3 bucket, and checking the AWS CLI v2 docs on the subject, it isn't clear to me how to configure a bucket to allow the use of multiple MFA devices for authentication. That is, allow any one of several registered MFA devices to authenticate requests for deletions.
The idea here is to allow a small group of employees, each with their own MFA devices, to have access to programmatically delete objects from an S3 bucket that's configured to require MFA. With only a single device configured per-bucket, we're in a "hit by a bus" situation.
Is there a way to do this? Or are we better off pursuing a shared MFA solution (KeepassXC, Dashlane, etc.). An online password management tool that allows shared (controlled) access to an MFA token would work, but if possible I'd prefer to devise a solution that stays within AWS IAM.
Thanks!
