IAM Root User MFA Should Be Enabled Rule
This rule specifies that MFA should be enabled for the IAM root user.
| Rule | IAM root user MFA should be enabled |
| Framework | HIPAA |
| Severity | ✔ Medium |
Rule Description
The IAM root user MFA (Multi-Factor Authentication) should be enabled to comply with the HIPAA (Health Insurance Portability and Accountability Act) security requirements. Enabling MFA adds an additional layer of security to protect the root user's credentials, reducing the risk of unauthorized access and potential data breaches.
Troubleshooting Steps
If MFA is not enabled for the IAM root user, follow these troubleshooting steps:
- 1.
Verify if the IAM root user is currently using MFA. You can do this by logging into the AWS Management Console with the root user credentials and checking the MFA status in the IAM section.
- 2.
If MFA is not enabled, proceed to enable it by following the remediation steps mentioned below.
Necessary Code
No code required for this rule.
Remediation Steps
To enable MFA for the IAM root user, follow these steps:
- 1.
Log in to the AWS Management Console using the root user credentials.
- 2.
Open the IAM service by searching for "IAM" in the AWS Management Console's search bar and selecting the IAM option.
- 3.
In the left navigation panel, click on "Users" to view the list of IAM users.
- 4.
Locate and select the IAM root user from the user list.
- 5.
In the "Security credentials" tab, click on the "Manage" button for "Assigned MFA device."
- 6.
In the "Manage MFA device" wizard, select the appropriate MFA device option. You can choose between a virtual MFA device (e.g., Google Authenticator) or a hardware MFA device. Follow the instructions provided based on the chosen MFA device.
- 7.
Once the MFA device is set up and associated with the root user, click on the "Next Step" button.
- 8.
The next screen will prompt you to enter the current MFA code generated by the device. Enter the code and click on the "Activate MFA" button.
- 9.
You have now successfully enabled MFA for the IAM root user.
Verification
To verify if MFA is enabled for the IAM root user, follow these steps:
- 1.
Log in to the AWS Management Console using the root user credentials.
- 2.
Open the IAM service by searching for "IAM" in the AWS Management Console's search bar and selecting the IAM option.
- 3.
In the left navigation panel, click on "Users" to view the list of IAM users.
- 4.
Locate and select the IAM root user from the user list.
- 5.
In the "Security credentials" tab, check the MFA status for the root user. It should display "Enabled."
By following these steps, you have successfully enabled MFA for the IAM root user to comply with the HIPAA security requirements.