| name | cis-aws-foundations-2.10 |
| description | Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password |
| category | cis-iam |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","iam","mfa","console-password","authentication","users"] |
| cis_id | 2.10 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-2.5","cis-aws-foundations-2.6"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
Description
Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they are prompted for their username and password as well as an authentication code from their physical or virtual MFA device. It is recommended that MFA be enabled for all IAM users that have a console password.
Rationale
Enabling MFA increases security for console access by requiring the authenticating principal to possess a device that generates a time-sensitive authentication code, in addition to their credentials.
Impact
Without MFA, IAM user accounts with console access are more susceptible to credential compromise, potentially leading to unauthorized access to AWS resources.
Audit Procedure
Using AWS Console
- Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam.
- In the left pane, select
Users.
- If the
MFA or Password age columns are not visible, click the gear icon in the upper right corner and enable them.
- Ensure that for each user where the
Password age column shows a value, the MFA column shows Virtual, U2F Security Key, or Hardware.
Using AWS CLI
- Run the following command:
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8
- The output of this command will produce a table similar to the following:
user,password_enabled,mfa_active
elise,false,false
brandon,true,true
rakesh,false,false
helene,false,false
paras,true,true
anitha,false,false
- For any column having
password_enabled set to true, ensure mfa_active is also set to true.
Expected Result
All IAM users with password_enabled set to true also have mfa_active set to true.
