Rule: Virtual MFA Should Be Enabled for the Root User
This rule ensures that virtual MFA is enabled for the root user for improved security.
| Rule | Virtual MFA should be enabled for the root user |
| Framework | PCI v3.2.1 |
| Severity | ✔ Critical |
Rule Description: Virtual MFA must be enabled for the root user to meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS) version 3.
Enabling Virtual MFA (Multi-Factor Authentication) for the root user helps ensure an additional layer of security to protect root-level access to your AWS account. This is especially important for PCI DSS compliance, which focuses on securing cardholder data and preventing unauthorized access to sensitive information.
Troubleshooting Steps:
If Virtual MFA is not enabled for the root user, follow these troubleshooting steps to enable it:
- 1.Log in to the AWS Management Console with the root user credentials.
- 2.Go to the IAM service.
- 3.In the left navigation pane, click on "Users."
- 4.Locate the root user in the list of IAM users.
- 5.Check if MFA is already enabled for the root user. If it is enabled, proceed to the remediation steps. If not, continue with the next steps.
- 6.Click on the root user to access the user details.
- 7.In the "Security credentials" tab, locate the "Multi-Factor Authentication (MFA)" card.
- 8.Click "Manage" to configure MFA for the root user.
- 9.Follow the on-screen instructions to set up a virtual MFA device. This typically involves scanning a QR code using an authenticator app like Google Authenticator or Authy.
- 10.Once the MFA device is set up, enter the generated verification code to validate the MFA device.
- 11.Click "Activate MFA" to enable MFA for the root user.
- 12.Test the MFA setup by logging out and logging back in with the root user credentials. You should now be prompted for the MFA verification code in addition to the password.
Necessary Codes:
No specific codes are required for enabling Virtual MFA for the root user. The configuration is done through the AWS Management Console.
Remediation Steps:
To enable Virtual MFA for the root user:
- 1.Log in to the AWS Management Console with the root user credentials.
- 2.Go to the IAM service.
- 3.In the left navigation pane, click on "Users."
- 4.Locate the root user in the list of IAM users.
- 5.Check if MFA is already enabled for the root user. If it is enabled, you have already met the requirement. If not, continue with the next steps.
- 6.Click on the root user to access the user details.
- 7.In the "Security credentials" tab, locate the "Multi-Factor Authentication (MFA)" card.
- 8.Click "Manage" to configure MFA for the root user.
- 9.Follow the on-screen instructions to set up a virtual MFA device. This typically involves scanning a QR code using an authenticator app like Google Authenticator or Authy.
- 10.Once the MFA device is set up, enter the generated verification code to validate the MFA device.
- 11.Click "Activate MFA" to enable MFA for the root user.
- 12.Test the MFA setup by logging out and logging back in with the root user credentials. You should now be prompted for the MFA verification code in addition to the password.
By following these remediation steps, you will enable Virtual MFA for the root user, ensuring compliance with PCI DSS version 3 requirements.