IAM Users with Console Access Should Have MFA Enabled Rule
This rule states that IAM users with console access must have multi-factor authentication enabled to enhance security.
| Rule | IAM users with console access should have MFA enabled |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ High |
Rule Description:
This rule enforces that IAM users with console access must have Multi-Factor Authentication (MFA) enabled. The goal is to enhance the security of the AWS environment and adhere to the guidelines specified in NIST 800-53 Revision 5.
Troubleshooting Steps:
- 1.
Verify IAM User Policies: Ensure that the IAM user policies for console access specify the requirement for MFA.
- 2.
Check MFA Status: Verify if MFA is already enabled for the IAM users in question.
- 3.
Review MFA Configuration: Ensure that the MFA devices are properly configured and associated with the IAM users.
Necessary Code:
There is no specific code required for this policy. However, you can use the AWS CLI or SDKs to manage IAM users and MFA settings.
Step-by-Step Guide for Remediation:
- 1.
Open the AWS Management Console and navigate to the IAM service.
- 2.
Select "Users" from the left navigation pane.
- 3.
Identify the IAM user(s) that do not have MFA enabled.
- 4.
Select the user(s) to enable MFA for.
- 5.
Click on the "Security credentials" tab.
- 6.
Under "Multi-factor authentication (MFA)", click on "Manage MFA".
- 7.
Click on "Activate MFA".
- 8.
Choose the appropriate MFA device option (either virtual MFA device or hardware MFA device) and follow the on-screen instructions to set it up.
- 9.
Once the MFA device is configured, select the user(s) again.
- 10.
Under "Multi-factor authentication (MFA)", click on "Manage MFA".
- 11.
Click on "Assign MFA device".
- 12.
Select the appropriate MFA device and complete the assignment process.
- 13.
Repeat steps 5-12 for other IAM users without MFA enabled.
- 14.
Test the MFA setup for the IAM users to ensure it is functioning correctly.
Conclusion:
Enabling MFA for IAM users with console access is crucial to comply with the NIST 800-53 Revision 5 guidelines and enhance the security of your AWS environment. Following the steps outlined above will help ensure that MFA is correctly enabled for the relevant IAM users.