Description:

This check verifies that all AWS IAM users with console access have Multi-Factor Authentication (MFA) enabled. MFA adds an additional layer of security by requiring users to provide a second authentication factor in addition to their username and password when signing in to the AWS Management Console.


Rationale:

Passwords alone may be compromised through phishing, credential reuse, brute-force attacks, or accidental exposure. Enabling MFA significantly reduces the risk of unauthorized access by requiring possession of a physical or virtual MFA device. AWS security best practices recommend enabling MFA for all IAM users with console access, especially privileged users.


Impact:

  • Reduces the risk of unauthorized console access.

  • Protects AWS resources from compromised credentials.

  • Enhances compliance with security frameworks and regulatory requirements.

  • Minimizes the impact of phishing and credential theft attacks.

  • Strengthens overall AWS account security posture.


Default Value:

By default, IAM users are not required to use MFA. MFA must be explicitly configured and enabled for each IAM user.


Remediation:

Test Plan:

Using AWS Console:

Verify Individual Users

  1. Sign in to the AWS Management Console.

  2. Navigate to IAM.

  3. Select Users from the left navigation pane.

  4. Review the MFA column for each IAM user.

  5. Identify users that:

    • Have console access enabled.

    • Show MFA = No.

Verify Console Access

  1. Select the IAM user.

  2. Open the Security credentials tab.

  3. Confirm that:

    • Console access is enabled.

    • MFA is assigned and active.


Implementation steps:

Using AWS Console:

Enable MFA for an IAM User

  1. Sign in to the AWS Management Console.

  2. Navigate to IAM → Users.

  3. Select the affected user.

  4. Open the Security credentials tab.

  5. Under Multi-factor authentication (MFA), click Assign MFA device.

  6. Select one of the following:

    • Authenticator App (recommended)

    • Hardware Security Key (FIDO)

    • Hardware TOTP Token

  7. Complete device registration.

  8. Verify MFA status changes to Enabled.


Backout Plan:

Using AWS Console:


  1. Navigate to IAM → Users.

  2. Select the affected user.

  3. Open the Security credentials tab.

  4. Under Multi-factor authentication (MFA), select the MFA device.

  5. Click Remove or Deactivate.

  6. Confirm the action.

  7. Verify the user can sign in using username and password only.

Note: MFA removal should only be performed during troubleshooting or approved exceptions.


References: