IAM user must have MFA enabled

Critical AWS General aws-iam-user-mfa

Applies to

AWS::IAM::User

What CGPulse checks

A resource passes this rule when mfaEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable MFA using virtual MFA, hardware TOTP, or FIDO2 security keys. In AWS Console: IAM > Users > Security credentials > Assign MFA device. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable.html

Terraform

# MFA is configured per-user in AWS Console or via aws_iam_virtual_mfa_device
# Enforce MFA via IAM policy condition: aws:MultiFactorAuthPresent

Compliance frameworks

Cloud Foundations Benchmark v3.01.5
Cloud Security: AWS Foundations
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.312(a)(1)
ISO 27001: Information SecurityA.9.4.2
NIST 800-53: Cloud Security ControlsIA-2
PCI DSS v4.08.3.1
SOC 2: Trust ServicesCC6.3

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan