Description

Ensure that every IAM user who is a member of an IAM group with the AWS managed AdministratorAccess policy attached has an active multi-factor authentication (MFA) device. These users have full control of the AWS account, so their sign-in must require a second factor in addition to the password.

Rationale

An administrator user without MFA can be fully compromised with a single stolen, leaked or guessed password. An attacker who signs in as that user gains full control of the account and can escalate privileges, change policies, exfiltrate data and delete resources. Requiring MFA for all administrator identities, preferably with hardware or FIDO2 security keys, greatly reduces this risk. Where possible, administrative access should be provided through roles or IAM Identity Center rather than IAM users.

Impact

  • Protects administrator users against password theft and credential stuffing

  • Users must enter an MFA code or use a security key when signing in to the console

  • Command line or API access by these users is not affected unless policies also require MFA for API calls

  • Removing a user from the administrator group instead removes all administrator permissions for that user

Default Value

New IAM users have no MFA device assigned. MFA must be enabled for each user individually.

Pre-Requisites

  • IAM permissions: iam:ListEntitiesForPolicy, iam:GetGroup, iam:ListMFADevices, iam:CreateVirtualMFADevice, iam:EnableMFADevice, iam:RemoveUserFromGroup and iam:DetachGroupPolicy

  • Access to each administrator user, or their cooperation, to register an authenticator app or security key

  • Agreement with the administrators on the type of MFA device to use

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Policies in the left menu.

  3. Search for AdministratorAccess, open the AWS managed policy and select the Entities attached tab.

  4. Note each Group listed, then open each group from User groups and note its users.

  5. For each user, open Users, select the user and check on the Security credentials tab that at least one device is listed under Multi-factor authentication (MFA).

  6. If any of these users has no MFA device, follow the implementation steps.

CLI:

List the groups that have the AdministratorAccess policy attached:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --entity-filter Group --query "PolicyGroups[].GroupName"

List the users in each of these groups:

aws iam get-group --group-name <GROUP_NAME> --query "Users[].UserName"

Show the MFA devices of each user:

aws iam list-mfa-devices --user-name <USER_NAME> --query "MFADevices[].SerialNumber"

A group fails if it has the AdministratorAccess managed policy attached and any of its users returns an empty MFA device list. Groups without users are not evaluated as failures, and administrator access granted directly to users or through other policies is not covered.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Users in the left menu.

  3. Select a user found in the Test Plan and open the Security credentials tab.

  4. Under Multi-factor authentication (MFA), choose Assign MFA device.

  5. Enter a device name, select the device type (Passkey or security key, Authenticator app or Hardware TOTP token) and follow the prompts to register it.

  6. If the user no longer needs administrator access, remove the user from the group instead.

  7. Repeat for each administrator user without MFA.

CLI:

Create a virtual MFA device and save its QR code to scan with an authenticator app:

aws iam create-virtual-mfa-device --virtual-mfa-device-name <USER_NAME> --outfile qrcode.png --bootstrap-method QRCodePNG

Enable the device for the user with two consecutive codes from the app:

aws iam enable-mfa-device --user-name <USER_NAME> --serial-number arn:aws:iam::<ACCOUNT_ID>:mfa/<USER_NAME> --authentication-code1 <CODE_1> --authentication-code2 <CODE_2>

If the user does not need administrator access, remove the user from the group:

aws iam remove-user-from-group --group-name <GROUP_NAME> --user-name <USER_NAME>

Alternatively, detach the policy from the group. This removes administrator access from all users in the group:

aws iam detach-group-policy --group-name <GROUP_NAME> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Users and select the user.

  3. On the Security credentials tab, select the MFA device and choose Remove.

  4. If the user was removed from the group, open User groups, select the group and add the user again.

  5. If the policy was detached, open the group's Permissions tab and attach AdministratorAccess again.

CLI:

aws iam deactivate-mfa-device --user-name <USER_NAME> --serial-number arn:aws:iam::<ACCOUNT_ID>:mfa/<USER_NAME>
aws iam add-user-to-group --group-name <GROUP_NAME> --user-name <USER_NAME>
aws iam attach-group-policy --group-name <GROUP_NAME> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Note: removing MFA from an administrator user makes the account vulnerable to single-factor compromise again.

Reference