Rule: IAM Root User MFA Should Be Enabled
This rule specifies that the IAM root user MFA must be enabled to enhance security measures.
| Rule | IAM root user MFA should be enabled |
| Framework | NIST 800-171 Revision 2 |
| Severity | ✔ Medium |
Rule Description
To comply with NIST 800-171 Revision 2 security guidelines, the IAM root user Multi-Factor Authentication (MFA) must be enabled. MFA adds an extra layer of security by requiring an additional form of authentication, in addition to the password, making unauthorized access more difficult.
How to Verify Compliance
- 1.
Open the AWS Management Console.
- 2.
Sign in to the AWS Management Console using the root user credentials.
- 3.
Go to the "Services" menu and select "IAM".
- 4.
In the IAM console, select "Dashboard" from the left navigation panel.
- 5.
Look for the "Security Status" section on the dashboard.
- 6.
Under the "Security Status" section, find the "Root User MFA" row.
- 7.
If the root user MFA status is "Not enabled", the compliance requirement is not fulfilled.
Troubleshooting Steps
If the root user MFA is not enabled, follow the steps below to troubleshoot and enable MFA:
- 1.
Make sure you are signed in as the root user in the AWS Management Console.
- 2.
From the IAM console, select "Dashboard" from the left navigation panel.
- 3.
Look for the "Security Status" section on the dashboard.
- 4.
Under the "Security Status" section, find the "Root User MFA" row.
- 5.
Click on the "Manage" link on the right side of the "Root User MFA" row.
- 6.
On the next page, click the "Activate MFA" button.
- 7.
Follow the on-screen instructions to set up MFA for the root user.
- 8.
Choose either a virtual MFA device or a hardware MFA device.
- 9.
If selecting a virtual MFA device, install an authenticator app on your mobile device and follow the instructions provided on the screen to configure it.
- 10.
If selecting a hardware MFA device, follow the instructions provided with the device to set it up.
- 11.
Once MFA is set up successfully, you will see the "Root User MFA" status as "Enabled" on the IAM dashboard.
Necessary Codes (if applicable)
No code is necessary to enable MFA for the root user. This configuration requires manual steps from the AWS Management Console.
Remediation Steps
To enable MFA for the root user, follow these step-by-step instructions:
- 1.
Sign in to the AWS Management Console using the root user credentials.
- 2.
Open the IAM console.
- 3.
Click on "Dashboard" in the left navigation panel.
- 4.
Locate the "Security Status" section on the dashboard.
- 5.
Under the "Security Status" section, find the "Root User MFA" row.
- 6.
Click on the "Manage" link on the right side of the "Root User MFA" row.
- 7.
On the next page, click the "Activate MFA" button.
- 8.
Follow the on-screen instructions to set up MFA for the root user.
- 9.
Choose either a virtual MFA device or a hardware MFA device.
- 10.
If selecting a virtual MFA device, install an authenticator app on your mobile device and follow the instructions provided on the screen to configure it.
- 11.
If selecting a hardware MFA device, follow the instructions provided with the device to set it up.
- 12.
Once MFA is set up successfully, you will see the "Root User MFA" status as "Enabled" on the IAM dashboard.
Conclusion
Enabling Multi-Factor Authentication (MFA) for the AWS IAM root user is crucial to comply with the NIST 800-171 Revision 2 security guidelines. By following the detailed steps outlined above, you can easily verify and enable MFA for the root user in the AWS Management Console. Enhancing the security of the root user account reduces the risk of unauthorized access and strengthens the overall security posture of your AWS account.