# Ensure MFA is enabled for all IAM users with console access

- Source: https://support.icompaas.com/support/solutions/articles/a_179329221706247-ensure-mfa-is-enabled-for-all-iam-users-with-console-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every IAM user who has a console password also has an active multi-factor authentication (MFA) device. With MFA, signing in to the AWS Management Console requires both the password and a code or confirmation from the registered device. Users without a console password are not evaluated, and the root user is covered by a separate control.

**Rationale**

Without MFA, a stolen, guessed or reused password is enough to sign in to the console with all of the user's permissions. An attacker could then change policies or access keys, take data, create backdoor users or turn off logging. Requiring MFA for every user with console access, preferably with phishing-resistant security keys, and removing console passwords that are not needed, prevents most password-based account takeovers.

**Impact**

-   Protects console sign-in against stolen and guessed passwords
    
-   Each affected user must register an MFA device and use it at every console sign-in
    
-   Removing the console password instead stops the user from signing in to the console; their access keys, if any, are not affected
    

**Default Value**

A newly created IAM user has no MFA device. AWS does not require IAM users to use MFA unless a policy enforces it.

**Pre-Requisites**

-   IAM permissions: iam:GenerateCredentialReport, iam:GetCredentialReport, iam:ListMFADevices, iam:GetLoginProfile, iam:DeleteLoginProfile and iam:CreateLoginProfile, plus the MFA device permissions (iam:CreateVirtualMFADevice, iam:EnableMFADevice) for whoever registers the device
    
-   An MFA device for each affected user: a FIDO security key, a hardware TOTP token or an authenticator app
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Credential report** in the left menu.
    
3.  Download the report and review the password\_enabled and mfa\_active columns for each user (the <root\_account> row is not evaluated).
    
4.  If any user has password\_enabled set to true and mfa\_active set to false, follow the implementation steps.
    

**CLI:**

For a user, confirm that a console password exists (a NoSuchEntity error means the user has no console password):

aws iam get-login-profile --user-name <USER\_NAME>

List the MFA devices of the user:

aws iam list-mfa-devices --user-name <USER\_NAME> --query "MFADevices\[\].\[SerialNumber,EnableDate\]" --output table

A user fails if they have a console password and no MFA device is returned.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Users** in the left menu.
    
3.  Select the affected user and open the **Security credentials** tab.
    
4.  If the user needs console access, in the **Multi-factor authentication (MFA)** section choose **Assign MFA device**:
    
    -   enter a device name and select **Passkey or security key**, **Authenticator app** or **Hardware TOTP token**,
        
    -   follow the prompts to register the device (for an authenticator app or TOTP token, enter two consecutive MFA codes),
        
    -   choose **Add MFA** (or **Assign MFA**).
        
5.  If the user does not need console access, in the **Console sign-in** section choose **Manage console access**, select **Disable** and choose **Apply**.
    
6.  Repeat for each affected IAM user.
    

**CLI:**

For a user who does not need console access, remove the console password:

aws iam delete-login-profile --user-name <USER\_NAME>

This command removes console access rather than enabling MFA. For users who need the console, register an MFA device with the console steps above.

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console, select **Users** in the left menu and select the user.
    
3.  To remove an MFA device, in the **Multi-factor authentication (MFA)** section select the device and choose **Remove**.
    
4.  To restore console access, in the **Console sign-in** section choose **Manage console access**, select **Enable**, set a new password and require a reset at next sign-in, then choose **Apply**.
    

**CLI:**

aws iam create-login-profile --user-name <USER\_NAME> --password <TEMPORARY\_PASSWORD> --password-reset-required

Note: a console user without MFA can be taken over with a stolen password. Use a rollback only as a temporary measure.

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_mfa\_enable\_virtual.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_mfa.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_getting-report.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/delete-login-profile.html](https://docs.aws.amazon.com/cli/latest/reference/iam/delete-login-profile.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.