cis-aws-foundations-2.10

Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

Description

Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they are prompted for their username and password as well as an authentication code from their physical or virtual MFA device. It is recommended that MFA be enabled for all IAM users that have a console password.

Rationale

Enabling MFA increases security for console access by requiring the authenticating principal to possess a device that generates a time-sensitive authentication code, in addition to their credentials.

Impact

Without MFA, IAM user accounts with console access are more susceptible to credential compromise, potentially leading to unauthorized access to AWS resources.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam.
2. In the left pane, select Users.
3. If the MFA or Password age columns are not visible, click the gear icon in the upper right corner and enable them.
4. Ensure that for each user where the Password age column shows a value, the MFA column shows Virtual, U2F Security Key, or Hardware.

Using AWS CLI

1. Run the following command:

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8

2. The output of this command will produce a table similar to the following:

user,password_enabled,mfa_active
elise,false,false
brandon,true,true
rakesh,false,false
helene,false,false
paras,true,true
anitha,false,false

3. For any column having password_enabled set to true, ensure mfa_active is also set to true.

Expected Result

All IAM users with password_enabled set to true also have mfa_active set to true.

Remediation

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
2. In the left pane, select Users.
3. Select the IAM user.
4. Choose the Security credentials tab.
5. Under Multi-factor authentication (MFA), select Assign MFA device.
6. Select Virtual MFA device (or hardware/security key as applicable), then choose Continue.
7. Configure the MFA device by:
   • Scanning the QR code, or
   • Entering the secret key manually.
8. Enter two consecutive authentication codes.
9. Select Assign MFA.

Default Value

By default, IAM users with a console password do not have MFA enabled. MFA must be explicitly configured for each user account.

References

1. https://tools.ietf.org/html/rfc6238
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html
3. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#enable-mfa-for-privileged-users
4. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html
5. CCE-78901-6
6. https://blogs.aws.amazon.com/security/post/Tx2SJJYE082KBUK/How-to-Delegate-Management-of-Multi-Factor-Authentication-to-AWS-IAM-Users

Additional Information

Forced IAM User Self-Service Remediation

Amazon has published a pattern that requires users to set up MFA through self-service before they gain access to their complete set of permissions. Until they complete this step, they cannot access their full permissions. This pattern can be used for new AWS accounts. It can also be applied to existing accounts; it is recommended that users receive instructions and a grace period to complete MFA enrollment before active enforcement on existing AWS accounts.

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated