القائمة
Ensure hardware MFA is enabled for the 'root' user account
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-2-6يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | cis-aws-foundations-2.6 |
| description | Ensure hardware MFA is enabled for the 'root' user account |
| category | cis-iam |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","iam","root","mfa","hardware-mfa","authentication"] |
| cis_id | 2.6 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack |
| ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-2.4","cis-aws-foundations-2.5","cis-aws-foundations-2.7"] |
| prerequisites | [] |
| severity_boost | {} |
The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they are prompted for their username and password as well as an authentication code from their MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA device.
Where an AWS Organization is using centralized root access, root credentials can be removed from member accounts. In that case, it is neither possible nor necessary to configure root MFA in the member account.
A hardware MFA device has a smaller attack surface than a virtual MFA. For example, a hardware MFA device does not inherit the risks associated with mobile devices on which virtual MFA applications reside.
Note: Using hardware MFA for numerous AWS accounts may create logistical device management challenges. In such cases, consider applying this Level 2 recommendation selectively to the highest-security AWS accounts, while applying the Level 1 recommendation to others.
Without hardware MFA, root account protection may be more susceptible to compromise compared to hardware-based authentication, increasing the risk of unauthorized access.
aws iam get-account-summary | grep "AccountMFAEnabled"
aws iam get-account-summary | grep "AccountPasswordPresent"
Verify:
AccountMFAEnabled is set to 1 (MFA enabled)AccountPasswordPresent is set to 1 (console access exists) or 0 (console access removed)If AccountMFAEnabled is set to 1 (MFA enabled), determine whether the MFA device is hardware:
aws iam list-virtual-mfa-devices
"SerialNumber": "arn:aws:iam::<aws_account_number>:mfa/root-account-mfa-device"
then the MFA device is virtual, not hardware, and the account is not compliant with this recommendation.
MFA is enabled for the root account and the MFA device is hardware-based (not listed in list-virtual-mfa-devices output).
Security Credentials from the drop-down list.Multi-Factor Authentication (MFA), locate the root user.Assign MFA device (or Manage MFA, depending on UI version).Security key or hardware MFA device.Assign MFA.By default, the AWS root user does not have a hardware MFA device assigned. MFA must be explicitly configured, and if enabled by default it will be virtual (software-based), not hardware.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.5 Require MFA for Administrative Access | x | x | x |
| v7 | 4.5 Use Multifactor Authentication For All Administrative Access | x | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1078.004 | TA0004 | M1032 |
Level 2 | Manual