IAM Root User MFA Enabled Rule
This rule ensures the Multi-Factor Authentication (MFA) is enabled for the IAM root user.
| Rule | IAM root user MFA should be enabled |
| Framework | FedRAMP Moderate Revision 4 |
| Severity | ✔ Medium |
Rule Description:
MFA (Multi-Factor Authentication) should be enabled for the root user in the context of FedRAMP Moderate Revision 4 compliance. This rule ensures an additional layer of security to protect the root user account from unauthorized access and helps comply with the security requirements defined by FedRAMP.
Troubleshooting Steps:
If MFA is not enabled for the root user, follow these troubleshooting steps:
- 1.
Check if the root user has MFA enabled:
- Log in to the AWS Management Console using the root user credentials.
- Navigate to the IAM service.
- Click on "Users" in the left-hand menu.
- Look for the root user in the list and check if MFA is enabled.
- 2.
Enable MFA for the root user:
- Click on the root user in the list.
- Go to the "Security credentials" tab.
- Under "Multi-factor authentication (MFA)", click on "Manage MFA".
- Follow the instructions to set up MFA for the root user.
- 3.
Verify MFA setup:
- Log out of the AWS Management Console.
- Log back in using the root user credentials.
- You should be prompted to provide the MFA token after entering the password.
Necessary Codes:
There are no specific codes required for this rule. However, scripting or automation can be used to enforce this rule across multiple AWS accounts.
Remediation Steps:
To enable MFA for the root user, follow these steps:
- 1.
Log in to the AWS Management Console using root user credentials.
- 2.
Navigate to the IAM service.
- 3.
Click on "Users" in the left-hand menu.
- 4.
Look for the root user in the list and click on it.
- 5.
Go to the "Security credentials" tab.
- 6.
Under "Multi-factor authentication (MFA)", click on "Manage MFA".
- 7.
Choose the appropriate MFA device option (Hardware MFA device or Virtual MFA device).
- 8.
Follow the instructions provided to set up the MFA device.
- 9.
Once the MFA device is set up, log out of the AWS Management Console.
- 10.
Log back in using the root user credentials.
- 11.
Provide the MFA token when prompted.
- 12.
MFA should now be enabled for the root user.
CLI Command:
There is no specific CLI command required to enable MFA for the root user, as it needs to be done through the AWS Management Console.