cis-aws-euc-4-2

name	cis-aws-euc-4.2
description	Ensure MFA is enabled for WorkDoc users
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workdocs","mfa","authentication"]
cis_id	4.2
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	["CWE-308"]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure MFA is enabled for WorkDoc users (Manual)

Profile Applicability

• Level 2

Description

Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional username and password. With MFA enabled, when a user signs in to Amazon WorkDocs, they will be prompted for their user name and password as well as for an authentication code from their MFA token.

Rationale

Enabling MFA provides increased security to a user name and password as it requires the user to possess a solution that displays a time-sensitive authentication code.

Impact

To enable MFA for Amazon WorkDocs you require a RADIUS server or a plugin to a RADIUS server already implemented in your environment.

Multi-factor authentication is not available for Simple AD.

You can enable multi-factor authentication for AD Connector if you have Active Directory running on-premises or in EC2 instances.

Audit Procedure

Perform the steps below to confirm MFA setup and configuration.

Using AWS Console

1. Log in to the Directory Service console at https://console.aws.amazon.com/directoryservicev2
2. Select Directories
3. Choose the directory ID link for your AWS Managed Microsoft AD directory
4. On the Directory details page, select the Networking & security tab
5. In the Multi-factor authentication section, Confirm Radius status is set to Enabled
6. Open the WorkDocs console at https://console.aws.amazon.com/zocalo/
7. In the Manage Your WorkDocs Sites page, select the desired site and choose Actions and Manage MFA
8. Confirm the values are set correctly

Multi-factor authentication is available when the RADIUS Status reads Enabled.

Using AWS CLI

1. Run describe-directories command to list the identifiers of all the Active Directory (AD) Connector directories, available in the selected AWS region:

aws ds describe-directories \
  --region us-east-1 \
  --output table \
  --query 'DirectoryDescriptions[*].DirectoryId'

2. The command output should return a table with the requested resource IDs:

--------------------
|DescribeDirectories|
+------------------+
|  d-12345abcde    |
|  d-abcd012345    |
|  d-aabbcc1234    |
+------------------+

3. Run describe-directories command using the ID of the AD Connector directory to get the status of the RADIUS MFA server connection: