Description

Ensure that every IAM user who has a console password also has an active multi-factor authentication (MFA) device. With MFA, signing in to the AWS Management Console requires both the password and a code or confirmation from the registered device. Users without a console password are not evaluated, and the root user is covered by a separate control.

Rationale

Without MFA, a stolen, guessed or reused password is enough to sign in to the console with all of the user's permissions. An attacker could then change policies or access keys, take data, create backdoor users or turn off logging. Requiring MFA for every user with console access, preferably with phishing-resistant security keys, and removing console passwords that are not needed, prevents most password-based account takeovers.

Impact

  • Protects console sign-in against stolen and guessed passwords

  • Each affected user must register an MFA device and use it at every console sign-in

  • Removing the console password instead stops the user from signing in to the console; their access keys, if any, are not affected

Default Value

A newly created IAM user has no MFA device. AWS does not require IAM users to use MFA unless a policy enforces it.

Pre-Requisites

  • IAM permissions: iam:GenerateCredentialReport, iam:GetCredentialReport, iam:ListMFADevices, iam:GetLoginProfile, iam:DeleteLoginProfile and iam:CreateLoginProfile, plus the MFA device permissions (iam:CreateVirtualMFADevice, iam:EnableMFADevice) for whoever registers the device

  • An MFA device for each affected user: a FIDO security key, a hardware TOTP token or an authenticator app

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Credential report in the left menu.

  3. Download the report and review the password_enabled and mfa_active columns for each user (the <root_account> row is not evaluated).

  4. If any user has password_enabled set to true and mfa_active set to false, follow the implementation steps.

CLI:

For a user, confirm that a console password exists (a NoSuchEntity error means the user has no console password):

aws iam get-login-profile --user-name <USER_NAME>

List the MFA devices of the user:

aws iam list-mfa-devices --user-name <USER_NAME> --query "MFADevices[].[SerialNumber,EnableDate]" --output table

A user fails if they have a console password and no MFA device is returned.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Users in the left menu.

  3. Select the affected user and open the Security credentials tab.

  4. If the user needs console access, in the Multi-factor authentication (MFA) section choose Assign MFA device:

    • enter a device name and select Passkey or security key, Authenticator app or Hardware TOTP token,

    • follow the prompts to register the device (for an authenticator app or TOTP token, enter two consecutive MFA codes),

    • choose Add MFA (or Assign MFA).

  5. If the user does not need console access, in the Console sign-in section choose Manage console access, select Disable and choose Apply.

  6. Repeat for each affected IAM user.

CLI:

For a user who does not need console access, remove the console password:

aws iam delete-login-profile --user-name <USER_NAME>

This command removes console access rather than enabling MFA. For users who need the console, register an MFA device with the console steps above.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Users in the left menu and select the user.

  3. To remove an MFA device, in the Multi-factor authentication (MFA) section select the device and choose Remove.

  4. To restore console access, in the Console sign-in section choose Manage console access, select Enable, set a new password and require a reset at next sign-in, then choose Apply.

CLI:

aws iam create-login-profile --user-name <USER_NAME> --password <TEMPORARY_PASSWORD> --password-reset-required

Note: a console user without MFA can be taken over with a stolen password. Use a rollback only as a temporary measure.

Reference