Profile Applicability: Level 1


Description: Multi-Factor Authentication (MFA) adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. It is recommended that MFA be enabled for all accounts that have a console password.


Rationale: 

Enabling MFA provides increased security for console access as it requires the authenticating principal to possess a device that emits a time-sensitive key and have knowledge of a credential.


Audit:

Perform the following to determine if a MFA device is enabled for all IAM users having a console password:

Using Management Console 

1. Open the IAM console at https://console.aws.amazon.com/iam/ 

2. In the left pane, select Users

3. If the MFA Device or Password columns are not visible in the table, click the gear icon at the upper right corner of the table and ensure a checkmark is next to both, then click Close.

4. Ensure each user having a checkmark in the Password column also has a value in the MFA Device column.


Remediation: 

https://aws.amazon.com/blogs/security/how-to-delegate-management-of-multi-factor-authentication-to-aws-iam-users/


References: 

1. http://tools.ietf.org/html/rfc6238 

2. http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html 

3. CCE-78901-6 

4. CIS CSC v6.0 #5.6, #11.4, #12.6, #16.11 

5. https://aws.amazon.com/blogs/security/how-to-delegate-management-of-multi-factor-authentication-to-aws-iam-users/


CIS Controls: 

4.5 Use Multifactor Authentication For All Administrative Access 

Use multi-factor authentication and encrypted channels for all administrative account access.