...

• BUCKET_NAME is the name (not ARN) of the bucket for which you wish to enable MFA delete. E.g., "my-important-bucket".
• The argument to the "mfa" parameter is a string made up of the ARN of the MFA device, followed by a space, followed by the 6-digit code from the MFA device.
• This command also enables versioning for the bucket; versioning is a prerequisite for enabling MFA delete.

References

• Cornell documentation
  • Standard AWS Account Configurations
• AWS documentation
  • Configuring MFA delete
  • Creating access keys for the root user

...