cis-aws-euc-2-2

name	cis-aws-euc-2.2
description	Ensure MFA is enabled for WorkSpaces users
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","mfa","authentication","radius"]
cis_id	2.2
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-euc-2.1"]
prerequisites	[]
severity_boost	{}

Ensure MFA is enabled for WorkSpaces users (Manual)

Profile Applicability

• Level 2

Description

Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional username and password. With MFA enabled, when a user signs in to Amazon WorkSpaces, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that utilize WorkSpaces.

Rationale

Enabling MFA provides increased security to a username and password as it requires the user to have a virtual or physical hardware solution that displays a time-sensitive code.

Impact

To enable MFA for Amazon WorkSpaces you require a RADIUS server or a plugin to a RADIUS server already in use in your environment.

Multi-factor authentication is not available for Simple AD.

Audit Procedure

Using AWS Console

For AWS Managed AD Authenticated Amazon Workspaces Environments:

1. Identify the IP address of your RADIUS MFA server and your AWS Managed Microsoft AD directory
2. In the AWS Directory Service console navigation pane, select Directories
3. Choose the directory ID link for your AWS Managed Microsoft AD directory
4. On the Directories page, scroll to the Multi-factor authentication section
5. In the Multi-factor authentication section, confirm that it is enabled and that Radius Status is completed

For Self-Managed AD (with AD Connector) Amazon Workspaces Environments:

1. Identify the IP address and port of your RADIUS MFA server and your AWS Managed Microsoft AD Connector Identifier
2. In the AWS Workspaces console navigation pane, select Directories
3. Choose the directory ID link for your AWS Managed Microsoft AD connector
4. On the Directories page, select the Actions > Update Details
5. In the Multi-factor authentication section, confirm that it is enabled and that Radius Status is completed, Enable Multi-Factor Authentication is checked and the IP Address of your Radius MFA server matches that of the RADIUS server IP address(es) field

If it is not enabled or the Radius status is in another state refer to the remediation steps below.